I had the incredible opportunity to volunteer at ThreatModCon 2024, the world’s only conference dedicated exclusively to threat modeling. Held in the San Francisco Bay Area, it gathered industry leaders, security engineers, and visionaries to dive into the world of threat modeling. The event was packed with valuable moments, from networking with like-minded professionals to attending sessions that showcased cutting-edge innovations and research.
The event opened with a keynote featuring a powerhouse panel of threat modeling experts, including Adam Shostack, Jonathan Marcil, Caroline Wong, Izar Tarandach, Matt Coles, and Brook Schoenfield. The discussions addressed many long-standing questions about the future of threat modeling. One of the highlights was the use of AI during the panel, which showed how AI could provide insightful answers—something unexpected, but I believe it should be a part of every conference from now on!
Engaging Talks and Sessions
With such a rich lineup of talks, picking just a few to attend was no easy task. I ultimately chose five sessions that piqued my interest the most:
1. Leveraging AI for Automated Threat Modeling by Audrey Long, Senior Security Engineer at Microsoft
Audrey Long’s talk was an eye-opener, as she explored the potential of AI to automate threat modeling. The challenges she outlined, such as scaling threat modeling across increasingly complex environments, resonated with many in the audience. Audrey demonstrated tools that utilized AI to create attack trees, a time-consuming process if done manually. What stood out to me was how AI could not only accelerate the process but also improve accuracy by automatically identifying threats and suggesting mitigations. This session showed how the future of threat modeling could be significantly shaped by AI advancements.
2. Extending the Functionality and Value of Threat Models Beyond Design Time by Brenna Leath
Brenna Leath’s session was a deep dive into the downstream benefits of threat modeling, especially how technology captures and layers can amplify their value beyond the initial design. Brenna discussed how teams could create reusable threat models that cater to different stakeholders, from compliance teams to security engineers. Her point about using layers to help different teams navigate the system, based on their specific needs, was incredibly practical. She also touched on the importance of making threat modeling tools more adaptable, helping teams quickly gather the right information and cut down on repetitive tasks.
3. Modeling Dynamic External Systems: Threat Modeling Volcanoes by Joern Freydank
Joern Freydank’s session on modeling dynamically expandable systems, referred to as “volcanoes,” introduced a fascinating approach to threat modeling. These systems, such as large-scale enterprise software with customizable add-ons (e.g., Salesforce or Slack), often bring unforeseen risks as they evolve. Joern explained how traditional threat modeling techniques struggle to keep up with such evolving systems and highlighted the importance of continuously monitoring and reassessing the system boundaries.
4. Making Threat Modeling More Natural: Recommendations for Practitioners and Tool Developers by Ron E. Thompson
Ron E. Thompson’s talk focused on adapting threat modeling tools to fit the natural workflows of practitioners. As a Ph.D. candidate in Security and Privacy, Ron brought an academic yet practical perspective. His research explored how medical device manufacturers integrate threat modeling into their processes. What I found most intriguing was how he highlighted the flexible, ad hoc nature of threat modeling and recommended approaches to make it more user-friendly for wider adoption.
5. Pragmatics of Threat Modeling AWS Architecture Using STRIDE by Jamil Ahmed, Ph.D.
Although I’ve studied STRIDE and other threat modeling frameworks during my coursework at Carnegie Mellon University, it was fascinating to see how they are applied in the real world. Dr. Jamil Ahmed’s hands-on workshop on AWS architecture provided practical tools for analyzing threats in cloud environments. We explored various AWS-specific threats and how to apply the STRIDE framework to mitigate them.
Networking and Conversations
One of the most rewarding aspects of ThreatModCon was the networking. At the “Birds of a Feather” roundtable event, I connected with attendees who shared my passion for automation, tooling, and AI integration in threat modeling. I had enlightening conversations with Jonathan Marcil, an industry veteran, who shared his experiences and insights on the current threat modeling landscape. It was inspiring to hear from professionals who have been in the industry for years but still see immense potential for innovation.
Key Takeaways and Looking Ahead
ThreatModCon 2024 left me with a wealth of knowledge and fresh perspectives on threat modeling. From Audrey Long’s fascinating demonstration of AI-driven threat models to Brenna Leath’s strategic insights on extending the value of threat models, the conference highlighted the diversity of approaches in the field.
I’d like to express my gratitude to Shuning Hsu for giving me the opportunity to volunteer and be a part of this remarkable event. I’m already looking forward to the next ThreatModCon—wherever it takes place, count me in!
