Brett Crawley -- Threat Modeling Gameplay with EoP

Brett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development. The discussion explores recent extensions to the game including privacy-focused suits and TRIM (Transfer, Retention/Removal, Inference, Minimization) categories. Crawley emphasizes that threat modeling shouldn't end with the game but should be an ongoing process throughout an application's lifecycle, ideally starting before implementation. He also shares insights from his book, which provides detailed examples and guidance for teams new to threat modeling using EoP. On today's episode, we're excited to host Brett Crawley, a principal application security engineer with over 25 years in software engineering and more than a decade in AppSec.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results.→ Learn more about Security JourneyConnect with Brett Crawley:→ Brett on X→ Threat Modeling Gameplay with EoPMentioned in this episode:→ Brett on X→ Threat Modeling Gameplay with EoP→ Conscious Business by Fred Kofman→ Elevation of Privilege→ Adam Shostack→ Threat Modeling Manifesto→ MITRE CAPEC→ The Security Table (podcast)Follow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Meet Brett Crawley: Threat Modeling Gameplay with EoP01:57 Yeah, it's like almost the only thing we ever talk about05:16 Okay. Very cool. So diving into our topic today, to get06:45 About the Elevation of Privilege card game08:44 There a, just to clarify here, make sure I understand, we13:26 Anybody win15:20 Um, just to go back and revisit, uh, who created the17:45 Well, insecure data flows or open data flows, for example, things20:11 Then people can say, well, we've got TLS everywhere now, which22:38 For example, privacy and trim, T-R-I-M. Could you describe those or25:49 Can I take these cards that are extensions and put them27:45 Um, so is the goal then that I finish the card29:51 You mentioned from, as a key to success for a threat38:45 All right, let's jump in the lightning round. So we have41:06 Yes, thank you. So next question is, if you could display