Advancing Your Threat Modeling Approaches in an Agile / DevOps World

The talk opens with a common complaint: teams practicing agile or DevOps often say they have no time for threat modeling. The speaker argues that threat modeling is a thinking exercise rather than a scan or code review, aimed at design flaws such as confusing authentication with authorization. He covers the basic parts of a threat model, including a system representation like a data flow diagram, identified threats, mitigations and prioritized risks, and references the four guiding questions from the Threat Modeling Manifesto.

The middle section focuses on fitting this work into fast-moving teams. Suggested approaches include building a baseline from whatever diagram already exists, adding threat discussion to sprint planning, and writing attacker or abuser stories next to user stories so that defenses and detection become acceptance criteria. He describes a large organization that used a short rapid risk assessment, triggered only when a change affects entry points, attack surface or sensitive data. He also surveys threat-modeling-as-code tools that generate data flow diagrams from annotated code or from Python, YAML and HCL definitions, and recommends modeling CI/CD pipelines with existing knowledge bases such as MITRE ATT&CK.

The closing portion touches on generative AI, which can help map components to likely threats but still needs human judgment to check the results. The speaker stresses that a threat model is never finished and should be revisited as features change. His practical takeaways are to start with what exists, keep sessions short, include operations and testing staff alongside developers, and treat privacy as a related area to study.