Dave Soldera

Defender of the security realm. Occasional double-agent.

[Threat Modeling Connect @TMConnectHQ]

Imagine having benchmarks, community-proven trends, and documented best practices to enhance your #ThreatModeling efforts. 📊

The first community-led State of Threat Modeling (#SOTM) Survey is here—add your insights 👉 https://t.co/6zK2kbJQNR

[Dave Soldera @samadhicsec]

@halvarflake @dinodaizovi @tecnik but often we should be calculating "time series probabilities" (ie calculate it over dependent events eg 1 company reports cost of 1000 incidents). Sometimes the result is the same (ergodic system), often it is not.

[Dave Soldera @samadhicsec]

@halvarflake @dinodaizovi @tecnik What I took away from his work (which is just a tiny part of it), is that most probabilities are "ensemble probabilities" (ie calculate it over independent events eg a 1000 companies report cost of 1 incident),

[Dave Soldera @samadhicsec]

@halvarflake @dinodaizovi @tecnik Nassim Taleb's books cover low probability, high impact events (black swans), including some strategies for dealing with them.

See also Ole Peters work on ergodicity that explains how we calculate probabilities is often fundamentally flawed.

[Dave Soldera @samadhicsec]

@cyb3rops I'm totally stealing "read teamer" for those of us doing security arch/design reviews 😁

[Dave Soldera @samadhicsec]

For some of the inspiration behind the tool, check out my blog post

https://t.co/WdOBDVjhKI

[Dave Soldera @samadhicsec]

threatware is a threat modelling tool I have been working on. If you want to threat model in a document, and you need to scale and manage threat models, it's worth a look.

#threatmodelling #threatmodeling #threatmodel #threatmodels
https://t.co/JRdEKhxxed

[Dave Soldera @samadhicsec]

Still so much to learn about #containersecurity ...🤔😆

[Dave Soldera @samadhicsec]

@PureGym sorry I meant 'social distancing' not 'self isolation'

[Dave Soldera @samadhicsec]

@PureGym reducing your opening hours (8am open) so people can't go to the gym before work any more (hence at all often) only serves to make self-isolation harder and condense people in the gym. Please reconsider

[Dave Soldera @samadhicsec]

@WaldronKathryn @RSI This is great, but I don't see BSIMM and SABSA in there? I would have thought they counted as frameworks.

[Dave Soldera @samadhicsec]

@TfL why no arrival times for the London 33 bus? At stop or online

[SwiftOnSecurity @SwiftOnSecurity]

Okay, so know how people are like “lol just patch it u dumbass”

I work at a Big Place now.
I had no freaking idea.

There’s literally someone whose job is just scanning machines to patch.
There’s an entire department that just schedules changes.

And downtime is $10,000 a minute

[Edwin Hayward @edwinhayward]

Here's the truth about Brexit, the "punishment" some people claim the EU wants to inflict on us, the full horrific consequences of no deal, and the dangers lurking behind any deal we reach. Buckle in, it's pretty long. Better to be thorough than to leave anything out. 1/47

[Dominique Righetto @righettod]

CSRF prevention cheat sheet refactoring finished by @manideep_k1:

https://t.co/eyr87T5JGw

Big thanks to him for his contribution 👏

#owasp #owaspcheatsheetseries @manicode

[Brook Schoenfield - Elder Statesman for AppSec @BrkSchoenfield]

@cigitalgem @SeniorWata @4Dgifts Stop thinking like a security researcher (everything is important) and think like development/operations faced with 10s thousands of issues. What to address? Only those than can be reached, provide attacker value, and have significant impact. Nothing else.

[Dave Soldera @samadhicsec]

@BrkSchoenfield @jeremiahg @randomuserid my blog article on Game Theory and security https://t.co/bvUPzQPkv0 speaks to considering the attacker more. But no easy answers sorry.

[Dave Soldera @samadhicsec]

We (security defenders) would all be doing well to emulate this kind of clarity about what we are trying to defend and how we are trying to do it. Well done to your team @dk_effect

[Dave Soldera @samadhicsec]

@TfLBusAlerts @TfLBusAlerts Many along Upper Richmond Rd, but specifically Priest's Bridge towards Hammersmith

[Dave Soldera @samadhicsec]

@tfl your live arrival times for the 33 bus have been way off (e.g. >10 mins) for the last week. You should get someone to look into it