4 ms·

I'm currently advising a Fortune 500 on their autonomous vehicle work. In some of the design process I've tried to get them to do threat modelling. Every engine

I'm currently advising a Fortune 500 on their autonomous vehicle work. In some of the design process I've tried to get them to do threat modelling. Every engineer is interested in it. Middle management, enterprise IT and enterprise security has tried its hardest to shut it down. The reason why is probably control. Middle management wants to control the narrative and be able to push blame away. Enterprise IT thinks engineers are too stupid to understand security and wants to nanny the dumb engineers. Enterprise security is a black box that no one directly speaks to, but considers themselves above the peasants. It most reminds me of Eddie Izzards "Encore on Computers" [1]. They will almost certainly come back with concerns, but not give any suggestions on workarounds. "You have an issue in your design", "what is the issue, can you tell me please?", "I'm sorry I can't tell you, but let me know when you fixed it" You can't speak directly to the security team. Nobody knows what they do, nobody knows who reviews what. They also rarely have a background in security and also don't know how to do threat modelling. On top of that its becoming increasingly clear that their centralized approach to security has created the biggest security vulnerabilities possible. I.e. Exchange and Solarwinds integrated into the normal LAN environment, while everything else receives extra scrutiny. [1] https://www.youtube.com/watch?v=TKQzqwn-jIM https://www.youtube.com/watch?v=TKQzqwn-jIM

tlavoie 6y ago
Wow, is that incredibly broken. I'm in security, doing testing for internal project teams. Another consultant is typically advising them on general controls, policy and such, and telling them to come to my group to get testing done. I think a large part of what we do is after the report, explaining what it all means, and how these various high/medium/low issues might be combined to create havoc with much more impact. Very low-key threat modeling is part of this, as someone else mentioned, story-telling. Really, it can be something of a mental pen-test, in that you've helped guide a narrative from where someone might discover issue A, leverage it to find B, and so on.

tlavoie 6y ago

Wow, is that incredibly broken. I'm in security, doing testing for internal project teams. Another consultant is typically advising them on general controls, policy and such, and telling them to come to my group to get testing done. I think a large part of what we do is after the report, explaining what it all means, and how these various high/medium/low issues might be combined to create havoc with much more impact. Very low-key threat modeling is part of this, as someone else mentioned, story-telling. Really, it can be something of a mental pen-test, in that you've helped guide a narrative from where someone might discover issue A, leverage it to find B, and so on.