A Guide to Threat Modelling for Developers

Threat modeling is a well-respected practice in designing secure
systems. But it's often done with complicated, exhaustive upfront
analysis. Jim Gumbley has spent the last few years helping ThoughtWorks
teams and clients adopt a different approach, which fits in with the
“little and often” agile philosophy. I'm happy that he's now written an
article to share his way of working, and this first installment explains
applying this incremental thinking to threat modeling.

more…