Threat modelling in DevOps boils down to four simple questions, according to Adam Shostack: What are we working on? What can go wrong? What do we do about it? Did we do it well?
In this interview, he explains how to use threat modeling to anticipate threats to the finished application before development gets started. He is author of the book, Threat Modeling for Security, president of security consultancy and training firm Shostack + Associates, and an early thought leader around threat modelling for cyber security. He’s also developed an elevation of privilege card game—click here for description and links on where to buy them.
