Practical Threat Modeling Master Class: STRIDE-Powered

Value of the Information & Strength of the Argument

The video provides valuable insights into practical threat modeling, drawing on the speaker’s real-world experience. The argumentation is solid, with clear explanations of concepts and their application. The discussion on the importance of data flows and the need for ‘just enough security’ is particularly compelling. The use of an e-commerce example helps illustrate the methodology in a tangible way. However, some claims lack empirical evidence, and the argumentation is primarily based on anecdotal experience rather than formal research.

The title accurately reflects the content, which is a practical master class on threat modeling using STRIDE.

8/10

The video is an expert-led discussion with practical insights, but lacks formal citations and rigorous verification of claims.

• 00:0002:30- Introduction and Welcome Pushpinder Singh and his career journey
• 02:3010:55 - Fundamentals and Philosophy of Threat Modeling
• 10:5519:48 - Threat Modeling and Key Questions
• 19:4826:37 - Important Documents and step by step integration required for Threat Modeling
• 26:3727:47 - Five Artifacts
• 27:4729:33 - How we decide Threat Modeling
• 29:3333:11 - Stride Methodology
• 33:1135:49 - Data Flow Diagrams
• 35:4940:07 - Threat Model Flow
• 40:0745:56 - Trust Boundaries
• 45:5657:10 - E-Commerce Application Threat Model
• 57:1001:02:20 - Threat Modeling Process
• 1:02:2001:25:25 - Tool - Threat Modeling 101: E-Commerce example with enhanced DFD
• 1:25:2501:29:40 - How company can do threat modeling if they don't have a tool
• 1:29:40End of the conversation by thanking Pushpinder Singh and looking forward to doing more sessions.

• CISO talks playlist — Related podcast series by Prabh Nair
• NIST Series playlist — NIST-related content on the channel
• GRC Series playlist — GRC-related content on the channel
• ISO 27001 Video — ISO 27001 implementation steps
• ISO 27001 Implementation Guide — ISO 27001 implementation guide
• GRC Practical Series playlist — GRC practical series
• GRC Interview playlist — GRC interview series
• Internal Audit playlist — Internal audit series

• OWASP Threat Modeling — OWASP provides a comprehensive guide to threat modeling, aligning with the video's methodology.
• Microsoft Threat Modeling Tool — Microsoft's tool supports STRIDE, consistent with the video's focus.

• PASTA threat modeling — The video suggests STRIDE is more structured, but PASTA is also a comprehensive methodology; some practitioners argue PASTA provides a more risk-centric approach.