Adam Shostack — Threat modeling layer 8 and conflict modeling

What if a system works exactly as designed but gives people new ways to harm one another? Adam Shostack explores threat modeling at layer eight: the human interactions that technical security reviews can overlook. He begins by defining success as better decisions and designs, then applies the familiar four threat modeling questions to social features and abuse. The conversation uses photo sharing, real-name policies, and content rules to show why context matters and why no single technical control settles every conflict. Adam introduces his conflict modeling project as a way to collect useful knowledge about those tradeoffs. He also asks who should participate, encouraging teams to bring broader expertise into decisions that affect people using their systems.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates

Mentioned in this episode:
→ Conflict Modeling project
→ Attack Trees by Bruce Schneier

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling human conflict with Adam Shostack
02:35 Recent threat modeling work
04:32 What successful threat modeling looks like
07:26 What threat modeling layer eight means
11:38 Applying the four questions beyond technology
14:24 Social features, real names, and abuse
18:51 Building shared knowledge about conflict
21:01 Modeling threats to a photo-sharing feature
23:36 Who should make decisions about human harm?
27:44 Getting started with conflict modeling
29:41 The project’s intended resources and outcomes
31:42 Context-sensitive content rules
33:38 Closing thoughts and ways to contribute