Read on Twitter
How to Scale Threat ModelingMany AppSec teams struggle with this
Here's how @JacobSalassi did it in a hypergrowth startup: @SnowflakeDB
Now the story of a scrappy startup on its way to IPO, and the teams who had no choice but to scale their processes, together
Out of the 100s of AppSec articles I've read in the past year, this is easily one of my top 3 on threat modeling
Tons of detailed, actionable insights and a few spot on memes
Summary thread
below, but check out the article here: https://r2c.dev/blog/2021/appsec-development-keeping-it-all-together-at-scale/
Tons of detailed, actionable insights and a few spot on memes
Summary thread
below, but check out the article here: https://r2c.dev/blog/2021/appsec-development-keeping-it-all-together-at-scale/
First, ProdSec threat modeled every story
Consistent quality, standardized evidence collection
Painful backlog: few security engs vs devs, slowed engineeringThis could not continue. Security was slowing the business down.
How can we decentralize security reviews?
Devs threat model every storyEvery team gets a Security Champion who own the process
Devs were unblocked, backlogs stabilized Threat modeling was too slow: 2-6 hours eachDevs felt they "didn't have time" for security
We needed a lighter weight way to assess risk
Devs assess risk on every storyDo a risk assessment for every story and only TM on 'non low' outcomes
Fewer stories need TMing, still had auditability for compliance Still required TMing too many things, process had friction
Insight: more things can be skipped
What started workingCurrent process:
1. Project risk assessment - help teams manage risk timeline
2. Security Impact Assessment - exit if changes don't affect security
3. Risk assessment - is this high risk?
4. Threat model - analyze risky designs and create mitigations
Where they're headed1. Converting mitigations created by threat models into re-usable secure defaults. Never threat model the same thing twice.
2. Using SAST tools like Semgrep to reduce the cognitive overhead of code reviews and increase the odds a bug will be detected.
Here's the article! I hope you enjoy it as much as I did working on it with @JacobSalassi 
How has *your* company scaled threat modeling?
Would love to hear any tips and tricks
https://r2c.dev/blog/2021/appsec-development-keeping-it-all-together-at-scale/
How has *your* company scaled threat modeling?
Would love to hear any tips and tricks
https://r2c.dev/blog/2021/appsec-development-keeping-it-all-together-at-scale/