Stephen de Vries -- Threat Modeling with a bit of #Startup

What developers need from a threat model is often a clear set of requirements they can implement. Stephen de Vries explains how that perspective shaped IriusRisk and his move from security consulting into building a product company. He and Chris discuss reusable threats and countermeasures, the role of OWASP ASVS, and the need to translate guidance into instructions that make sense in an issue tracker. They also examine why spreadsheets and separate security systems create friction, and how existing testing and design habits can provide a bridge into security. Stephen’s startup experience frames a broader conversation about making threat modeling repeatable: reuse what is known, focus human attention on the difficult parts, and meet developers inside their normal workflow.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Stephen de Vries:→ Stephen de Vries on LinkedIn→ IriusRiskMentioned in this episode:→ OWASP Application Security Verification Standard→ OWASP Proactive Controls→ OWASP Web Security Testing GuideFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Threat modeling and startup lessons with Stephen de Vries00:34 Stephen’s development and security background05:01 Starting a security product company06:35 From building a product to building a company07:48 Threat modeling as a route to security requirements10:41 Reusing common threats and countermeasures12:00 Connecting requirements management and threat modeling13:43 Turning ASVS into actionable developer guidance14:16 Meeting developers in their existing tools15:33 Removing spreadsheet and email friction17:00 Building on testing and design habits18:41 Connecting everyday risk thinking to security20:06 Behavior-driven testing and useful OWASP resources