Effective threat modeling for better software security

Karen Lu, a software security architect at Thales, argues that threat modeling matters more as products grow more complex, rely on wider supply chains and ship on faster agile and DevOps cycles. Demand has risen while teams still have limited people. The talk treats threat modeling as a structured record of assets, objectives, threats and planned mitigations, rather than a how-to guide.

She walks through a simple identity-and-access example with a relying party and an identity provider. Two ways to find threats are covered: the STRIDE categories and the confidentiality, integrity and availability properties. She points to knowledge bases such as MITRE ATT&CK and OWASP material, and notes that open-source and commercial tools each have trade-offs. One anecdote shows an early risk assessment of a requested feature leading a product owner to drop it, avoiding the cost of building and testing it.

For scale, she describes training security champions inside engineering teams to lead sessions, with architects reviewing only when needed. Other practices include short threat discussions in regular team meetings, opening sessions with quick prompts about what worries people most, linking threat artifacts to task trackers and user stories, and separating inherent threats that need ongoing controls and detection from accidental ones. Her takeaways are to start early, revisit models throughout a product's life, and pick methods suited to each context.