DEF CON’s Next Top Threat Model

[The Dark Tangent]

DEF CON’s Next Top Threat Model

(Formerly Threat Modeling Challenge from DC27)

Threat Modeling is arguably the single most important activity in an application security program and if performed early can identify a wide range of potential flaws before a single line of code has been written. While being so critically important there is no single correct way to perform Threat Modeling, many techniques, methodologies and/or tools exist.

As part of our challenge we will present contestants with the exact same design and compare the outputs they produce against a number of categories in order to identify a winner and crown DEF CON’s Next Top Threat Model

[noz]

Registration is now LIVE!! https://forms.gle/YpkTNZkZ6tyBm1ri6

[noz]

Form was updated so new registrations will receive an email with all design artifacts.

Here is our FAQ if you would like more information about the contest.
https://drive.google.com/file/d/1D3l...ew?usp=sharing

Results are due by 6PM PDT on Saturday August 7th.

[noz]

We had a small QA issue with our form and unfortunately the design artifacts were not included in emails sent to anyone who registered in person at DEF CON. I have emailed everyone from defcon at threatmodel.us, I BCC'd everyone so this may be in your spam folder.

Also,
Our SSK developer mistakenly populated DFD Annotation 4 SSK->Inventory MicroService with an incorrect description. The proper description is "SSK calls the inventory microservice to populate the menu. " All other fields for this annotation are correct.

[noz]

Results submission is open. Please use the google form link below. In order to upload files a Google account login is required. If you are not able to login to Google you may email 'defcon at threatmodel.us'

https://docs.google.com/forms/d/e/1FAIpQLScMx4EhXkgrYAQZXIICF8hrNFmm7vHg82_P8S3bWDgyQz2fGA/viewform

[AppSecSeanner]

noz Do you have any details on the winning submissions you can post?