Nowadays everything has to have a threat model, otherwise it’s not even considered for development. My talk will be a lessons learned overview of what I’ve done in the past. There will be practical examples at a technical level of things that I always see in threat modeling exercises. Examples about things like secure communication, secure data storage, etc.

One example that I will talk about is on third party libraries. Many people want to use them for cryptography, for example from .NET or OpenSSL but often they don’t know how to use them properly. When validating code I’ve seen things like hardcoded encryption keys in the code that is the same for every client that they deploy the application to. If one of those keys gets compromised, all your clients get compromised. This is something that shouldn’t be done like this. In my talk I will show good practices how to incorporate third party libraries and use them.

Intermediate to advanced level.