threatspec

Continuous Threat Modelling through code. It's open source, so get involved!

[threatspec @ThreatSpec]

@stephendv @zeroXten Great idea!

[threatspec @ThreatSpec]

Equally exciting - threatspec was featured as an article in a threat modeling focused edition of @PenTestMag! Check out the article written by @zeroXten here: https://t.co/gP5n920Wse

[threatspec @ThreatSpec]

Big news! A long time coming, but threatspec has had a bit of a rewrite. Actually, a complete rewrite. It's much easier to install and use now. Same idea - annotate your code, generate a threat model. Just just easier and prettier. Check it out! https://t.co/G2tuYLErU2

[threatspec @ThreatSpec]

We're currently experimenting with using ThreatSpec to threat model APIs by putting annotations like x-threatspec-mitigates into Swagger/OpenAPI files. Thoughts, ideas, criticism welcome :) #appsec #threatmodeling #API

[threatspec @ThreatSpec]

Ok people. We're at 43 responses. So thank you all very much! Many of responses are from Cyber Security people, so let's see if we can squeeze in a couple more developers.

Reply to this tweet tagging your favourite developer ���

https://t.co/IVoKwOL0jT

#coding #programming

[threatspec @ThreatSpec]

@izar_t Thanks for that! We're now at 40 responses, only 10 more to go :D

[threatspec @ThreatSpec]

25 responses! Half way towards the goal of 50. Thanks to everyone who has filled it in. There's still time, so if you write code on a regular basis, we'd love to hear from you.

https://t.co/3XgwuS7FJu

#coder #programmer #developer #opensource

[threatspec @ThreatSpec]

Still looking for developers, engineers, QEs, DevOps engs to fill in our brief survey on threat modeling. If you have 3 minutes to spare to help an open source project, that would be amazing 😍. Plz RT for reach. https://t.co/IVoKwOL0jT
#developers #DevOps #programming

[threatspec @ThreatSpec]

Hello Twitter. We're still looking for people to fill in our little survey on code-driven threat modeling. We're especially interested in hearing from developers. Check it out:

https://t.co/IVoKwOL0jT

Please RT for much ❤️❤️❤️

Thanks! 🤩

[threatspec @ThreatSpec]

@stephendv Haha thanks :)

[threatspec @ThreatSpec]

Are you a software engineer? We'd love to hear from you. Help an open source project by filling in a brief survey on code-driven threat modelling. Please retweet for reach :) Thanks!

https://t.co/IVoKwOL0jT

#developers #opensource #cyber

[Robert Hurlbut @roberthurlbut]

Special thanks to @abhaybhargav and @zeroXten in particular for their work on Threat Modeling as Code for inspiration for this talk a few months ago.

[Robert Hurlbut @roberthurlbut]

Special shout outs and pointers made to the work of @adamshostack,@BrkSchoenfield, @threatmodeling,@t0nyuv, @abhaybhargav, @zeroXten, @ThreatSpec, @IreneMichlin, @JohnLaTwC during the #ThreatModeling Workshop at @owasp @BASConf

[threatspec @ThreatSpec]

Interested in threat modeling? Interested in the idea of code-driven threat modeling? We've just created a new ThreatSpec Slack workspace. Come join us!

https://t.co/Gt0lD1xNyT

#threatmodeling #devsecops #everythingascode

[threatspec @ThreatSpec]

@AppSecPodcast Absolutely!

[threatspec @ThreatSpec]

Would probably also apply in some way to BDD/TDD tests.

[threatspec @ThreatSpec]

I wonder if @ThreatSpec could be used to train machine learning based classification of function-level threats 🧐. So use ThreatSpec to tag a function F as mitigating against threat X, function G exposing threat Y etc. ML learns which code exposes, mitigates different threats etc

[Brook Schoenfield - Elder Statesman for AppSec @BrkSchoenfield]

@cigitalgem @lfservin https://t.co/NunJZABNsh @ThreatSpec & https://t.co/tU2c2M8NRD @abhaybhargav

[threatspec @ThreatSpec]

@BrkSchoenfield @cigitalgem @lfservin @abhaybhargav engineering and security to get an idea of what works and what doesn't. 2/2

[threatspec @ThreatSpec]

@BrkSchoenfield @cigitalgem @lfservin @abhaybhargav Thanks++ for the mention @BrkSchoenfield! We're doing to spend some time over the coming weeks and months thinking about the next steps for ThreatSpec and code-driven threat modeling in general - ideas are more than welcome. We'll be looking to speak to people across 1/2