Brett Crawley -- Threat Modeling Gameplay with EoP

Brett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development. The discussion explores recent extensions to the game including privacy-focused suits and TRIM (Transfer, Retention/Removal, Inference, Minimization) categories. Crawley emphasizes that threat modeling shouldn't end with the game but should be an ongoing process throughout an application's lifecycle, ideally starting before implementation. He also shares insights from his book, which provides detailed examples and guidance for teams new to threat modeling using EoP. On today's episode, we're excited to host Brett Crawley, a principal application security engineer with over 25 years in software engineering and more than a decade in AppSec.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results.
→ Learn more about Security Journey

Connect with Brett Crawley:
→ Brett on X
→ Threat Modeling Gameplay with EoP

Mentioned in this episode:
→ Brett on X
→ Threat Modeling Gameplay with EoP
→ Conscious Business by Fred Kofman
→ Elevation of Privilege
→ Adam Shostack
→ Threat Modeling Manifesto
→ MITRE CAPEC
→ The Security Table (podcast)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brett Crawley: Threat Modeling Gameplay with EoP
01:57 Yeah, it's like almost the only thing we ever talk about
05:16 Okay. Very cool. So diving into our topic today, to get
06:45 About the Elevation of Privilege card game
08:44 There a, just to clarify here, make sure I understand, we
13:26 Anybody win
15:20 Um, just to go back and revisit, uh, who created the
17:45 Well, insecure data flows or open data flows, for example, things
20:11 Then people can say, well, we've got TLS everywhere now, which
22:38 For example, privacy and trim, T-R-I-M. Could you describe those or
25:49 Can I take these cards that are extensions and put them
27:45 Um, so is the goal then that I finish the card
29:51 You mentioned from, as a key to success for a threat
38:45 All right, let's jump in the lightning round. So we have
41:06 Yes, thank you. So next question is, if you could display