The Object-Oriented Approach to Threat Modeling - Global Meetup Recap

Techniques & Tooling
,
1

On 2024-10-24T04:00:00Z, we hosted the October Global Community Meetup with Matthew McDonald, where walked us through:

  • The Object-Oriented Programming (OOP) principles
  • How each OPP principle (Abstraction, Encapsulation, Inheritance, Polymorphism) can be applied to threat modeling

Replay

Key concepts

Matthew did a fantastic job breaking down how each OOP principle can enhance your threat modeling approach. Here’s a quick peek:

OOP Principles Overview
OOP Principles Overview1127×636 83.7 KB

"Abstraction" and threat modeling at 2.47.17 PM
"Abstraction" and threat modeling at 2.47.17 PM1128×639 72.9 KB

"Encapsulation" and threat modeling
"Encapsulation" and threat modeling1131×634 91.3 KB

"Inheritance" and threat modeling
"Inheritance" and threat modeling1130×638 95.2 KB

"Polymorphism" and threat modeling
"Polymorphism" and threat modeling1124×637 93.5 KB

:point_right: See the examples of each principle Matthew’s full slides

Working session

After Matthew’s talk, we split into small groups to brainstorm how each OOP principle could be applied to real-world threat modeling. So much great collaboration!

:point_right: Take a look at the insights captured on our Virtual Whiteboard.

Group photo :heart_eyes:

Thanks to everyone who joined us for such a collaborative session! Special shoutout to our amazing speaker @MatthewMcDonald for sharing this framework, and to our awesome facilitators @Alicia, @ClaireAA @Qasim @Simon_monteyne @Tobias for running the group discussions and making the event a blast for all of us!

October Global Meetup Group Photo
October Global Meetup Group Photo1235×863 84.9 KB

Next meetup (Nov 14, 2024)

We’re going to talk about AI Threat Modeling at our Global meetup next month! Leading us is Susanna Cox (https://www.linkedin.com/in/disesdi/), a core member of the OWASP AI Exchange team and a patent holder for AIML system security. She will expand her popular talk on “AI Threat Modeling” at the OWASP conference and delve deep into the strategies for using threat modeling to manage AI risks. Join us!

1 Like
2

Thanks for having organized this meetup which was very inspiring. I see you on the next meetup :slight_smile:

1 Like
3

Thank you for the meetup, and thanks to all the participants in the breakout rooms for their participation! :wink:

When it comes to the Abstraction principle, the main takeaways from our group were that it allows for clearer DFDs, thus enhancing communications but also being less overwhelming for people less experienced in threat modeling.
On top of that, abstracting key features/components permits to assign the identification of threats and mitigations to different teams, with each team focusing on the components in which they have the most expertise :brain:

1 Like
4

Great presentation! I was able to visualize principle of Inheritance as a process which promotes efficiency by allowing established threat models e.g. Identity and Access Management threat model created by a central IAM team to pass it down to the application teams building or buying applications across the organization as a result reducing the duplication of effort.

2 Likes