Adam has a new book out, Threat Modeling: Designing for Security, and it is a great resource for anyone in security. As with New School of Information Security, this is one to grab, read, and keep on the shelf (e-shelf?).
The layout is great, after a short introduction Adam takes you into an easy, but informative practice exercise. After the exercise there is a more in-depth introduction, which builds on what you learn in the exercise- and also answers some questions which inevitably come up during the exercise. From the first couple of chapters the book gets progressively deeper into threat modeling theory and practice. Even if enterprise threat modeling isn’t your world, reading the first few chapters will help you think about securing systems and software more clearly and logically.
I know there are different views and opinions on threat modeling theory and methodology, but even if you approach it differently from Adam, I think you’ll find it informative and valuable.
Those who know me know that I’m a real fan of Adam’s work, he explains complex topics in easy to understand ways- concise and clear without “dumbing things down”.
Gunnar Peterson, who actually knows about this stuff, has an in-depth review of Threat Modeling on his great 1 Raindrop blog.
Grab a copy and give it a read.
Jack
