TestBash Revisited - Threat Modelling: How Software Survives in a Hacker’s Universe - Saskia Coplans

In this session, we will be revisiting Saskia Coplan's talk from TestBash Manchester 2019. Saskia will join us on the main stage for a chat whilst we watch the talk and discuss what was said back in 2019 and what could have changed since then.

This is the story of how a client lost millions due to a costly oversight that allowed attackers to exploit a devastating vulnerability. Although the client was aware that this weakness existed when the final product was launched, it would have been too expensive to fix and would have required them to miss critical deadlines.

In this talk, we'll discuss how with version 2, we helped our client by starting with some threat modelling techniques in order to understand; which assets an attacker would be after, what weaknesses existed in the design that would allow an attacker to access them, and what protections could be put in place to stop the same level of attack happening again.