Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond
Om avsnittet
What happens when a threat model has to account for patient privacy and clinical harm as well as attackers? Bill Dougherty joins Chris and Robert to explain INCLUDES NO DIRT, the model he developed with Patrick Curry at Omada Health. They discuss why conventional security categories did not fully capture digital healthcare's competing security, privacy, and compliance needs, and how combining ideas from existing frameworks produced a memorable checklist. Bill walks through the practical workflow, from understanding a system and drawing data flows to asking targeted questions and prioritizing deeper review. The conversation also covers training product teams to use the model themselves, avoiding checkbox risk assessments, and adapting the published questionnaires to the risks an organization actually needs to understand.
The Application Security Podcast is brought to you by Security Journey.
About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey
Connect with Bill Dougherty:
→ LinkedIn
→ INCLUDES NO DIRT at Omada Health
Mentioned in this episode:
→ LINDDUN privacy threat modeling
→ Microsoft threat modeling
Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook
Chapters:
00:00 Introduction
02:17 Bill's path into security leadership
04:21 Security responsibilities at Omada Health
06:38 Why digital healthcare needed another threat model
10:20 The INCLUDES NO DIRT acronym
11:09 Security, privacy, and clinical threat categories
12:33 What makes healthcare different
14:07 Turning the categories into a practical process
18:21 Diagrams and understanding the system
21:08 Applying the checklist to data flows
23:35 Helping product teams become self-sufficient
25:11 Requirements and compliance considerations
27:00 Getting started with the questionnaires
30:07 Closing thoughts
The Application Security Podcast med Chris Romeo and Robert Hurlbut finns tillgänglig på flera plattformar. Informationen på denna sida kommer från offentliga podd-flöden.