Understanding the LINDDUN Threat Modeling Framework
read more : reconbee.com/understandin...
#LINDDUN #threatmodeling #threatmodelingframework #cybersecurity #framework
read more : reconbee.com/understandin...
#LINDDUN #threatmodeling #threatmodelingframework #cybersecurity #framework
Understanding the LINDDUN Threat Modeling Framework
Understanding the LINDDUN Threat Modeling Framework is examined in detail in this article, along with its elements, methodology
reconbee.com
October 12, 2026 at 6:31 AM
Understanding the LINDDUN Threat Modeling Framework
read more : reconbee.com/understandin...
#LINDDUN #threatmodeling #threatmodelingframework #cybersecurity #framework
read more : reconbee.com/understandin...
#LINDDUN #threatmodeling #threatmodelingframework #cybersecurity #framework
[THREAT] Identified threat: Login error message reveals whether the email address has an account
[RESPONSE] Dev/management: Users would notice if their account was compromised.
#threatmodeling #infosec
[RESPONSE] Dev/management: Users would notice if their account was compromised.
#threatmodeling #infosec
October 13, 2026 at 2:00 PM
[THREAT] Identified threat: Login error message reveals whether the email address has an account
[RESPONSE] Dev/management: Users would notice if their account was compromised.
#threatmodeling #infosec
[RESPONSE] Dev/management: Users would notice if their account was compromised.
#threatmodeling #infosec
[THREAT] Identified threat: Password hashing uses an in-house function written in 2018, never reviewed
[RESPONSE] Dev/management: the DBA already addressed this in another PR somewhere.
#threatmodeling #infosec
[RESPONSE] Dev/management: the DBA already addressed this in another PR somewhere.
#threatmodeling #infosec
October 14, 2026 at 2:00 PM
[THREAT] Identified threat: Password hashing uses an in-house function written in 2018, never reviewed
[RESPONSE] Dev/management: the DBA already addressed this in another PR somewhere.
#threatmodeling #infosec
[RESPONSE] Dev/management: the DBA already addressed this in another PR somewhere.
#threatmodeling #infosec
[THREAT] Identified threat: Open redirect on the login page that respects any return_to URL
[RESPONSE] Dev/management: There's no CVE for it yet, so we don't have to act.
#threatmodeling #infosec
[RESPONSE] Dev/management: There's no CVE for it yet, so we don't have to act.
#threatmodeling #infosec
October 12, 2026 at 2:00 PM
[THREAT] Identified threat: Open redirect on the login page that respects any return_to URL
[RESPONSE] Dev/management: There's no CVE for it yet, so we don't have to act.
#threatmodeling #infosec
[RESPONSE] Dev/management: There's no CVE for it yet, so we don't have to act.
#threatmodeling #infosec
[THREAT] Identified threat: Build pulls FROM ubuntu:latest with no digest pinning
[RESPONSE] Dev/management: The vendor said this is best practice.
#threatmodeling #infosec
[RESPONSE] Dev/management: The vendor said this is best practice.
#threatmodeling #infosec
October 11, 2026 at 2:00 PM
[THREAT] Identified threat: Build pulls FROM ubuntu:latest with no digest pinning
[RESPONSE] Dev/management: The vendor said this is best practice.
#threatmodeling #infosec
[RESPONSE] Dev/management: The vendor said this is best practice.
#threatmodeling #infosec
[THREAT] Identified threat: Finance pays invoices on emailed PDFs without out-of-band confirmation
[RESPONSE] Dev/management: CVSS is only 6.8. We focus on 9+.
#threatmodeling #infosec
[RESPONSE] Dev/management: CVSS is only 6.8. We focus on 9+.
#threatmodeling #infosec
October 10, 2026 at 2:00 PM
[THREAT] Identified threat: Finance pays invoices on emailed PDFs without out-of-band confirmation
[RESPONSE] Dev/management: CVSS is only 6.8. We focus on 9+.
#threatmodeling #infosec
[RESPONSE] Dev/management: CVSS is only 6.8. We focus on 9+.
#threatmodeling #infosec
[THREAT] Identified threat: Session ID is not rotated after login, enabling fixation attacks
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
October 9, 2026 at 2:00 PM
[THREAT] Identified threat: Session ID is not rotated after login, enabling fixation attacks
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
Geopolitics and the cyber resilience gap belong in your threat model
📖 Read more: www.helpnetsecurity.com/2026/10/12/a...
#cybersecurity #cybersecuritynews #cyberresilience #CISO #riskmanagement #strategy #threatmodeling
📖 Read more: www.helpnetsecurity.com/2026/10/12/a...
#cybersecurity #cybersecuritynews #cyberresilience #CISO #riskmanagement #strategy #threatmodeling
Geopolitics and the cyber resilience gap belong in your threat model - Help Net Security
WEF's Akshay Joshi on AI threats, cyber-enabled fraud, geopolitics, and the widening cyber resilience gap between large and small companies.
www.helpnetsecurity.com
October 12, 2026 at 1:43 PM
Geopolitics and the cyber resilience gap belong in your threat model
📖 Read more: www.helpnetsecurity.com/2026/10/12/a...
#cybersecurity #cybersecuritynews #cyberresilience #CISO #riskmanagement #strategy #threatmodeling
📖 Read more: www.helpnetsecurity.com/2026/10/12/a...
#cybersecurity #cybersecuritynews #cyberresilience #CISO #riskmanagement #strategy #threatmodeling
[THREAT] Identified threat: Backups have not been test-restored since the runbook was written
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
October 8, 2026 at 2:00 PM
[THREAT] Identified threat: Backups have not been test-restored since the runbook was written
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
[RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem.
#threatmodeling #infosec
🔍 Kennst du die Angriffspfade deines Systems?
Threat Modeling hilft dir, Vertrauensgrenzen, Abhängigkeiten und Risiken früh sichtbar zu machen und passende Security Controls abzuleiten.
🎓 Jetzt im neuen Kurs lernen:
https://f.mtr.cool/7rovitj1x1
#ThreatModeling #CyberSecurity
Threat Modeling hilft dir, Vertrauensgrenzen, Abhängigkeiten und Risiken früh sichtbar zu machen und passende Security Controls abzuleiten.
🎓 Jetzt im neuen Kurs lernen:
https://f.mtr.cool/7rovitj1x1
#ThreatModeling #CyberSecurity
October 9, 2026 at 10:30 AM
🔍 Kennst du die Angriffspfade deines Systems?
Threat Modeling hilft dir, Vertrauensgrenzen, Abhängigkeiten und Risiken früh sichtbar zu machen und passende Security Controls abzuleiten.
🎓 Jetzt im neuen Kurs lernen:
https://f.mtr.cool/7rovitj1x1
#ThreatModeling #CyberSecurity
Threat Modeling hilft dir, Vertrauensgrenzen, Abhängigkeiten und Risiken früh sichtbar zu machen und passende Security Controls abzuleiten.
🎓 Jetzt im neuen Kurs lernen:
https://f.mtr.cool/7rovitj1x1
#ThreatModeling #CyberSecurity
[THREAT] Identified threat: Multifunction printer stores scanned documents on an open SMB share
[RESPONSE] Dev/management: We have a PR firm on retainer for that scenario.
#threatmodeling #infosec
[RESPONSE] Dev/management: We have a PR firm on retainer for that scenario.
#threatmodeling #infosec
October 7, 2026 at 2:00 PM
[THREAT] Identified threat: Multifunction printer stores scanned documents on an open SMB share
[RESPONSE] Dev/management: We have a PR firm on retainer for that scenario.
#threatmodeling #infosec
[RESPONSE] Dev/management: We have a PR firm on retainer for that scenario.
#threatmodeling #infosec
El lado del mal - SANS x Cloudflare Lisboa: 28 de Octubre www.elladodelmal.com/2026/10/sans... #Cloudflare #SANS #AI #IA #ThreatModeling #ArtificialIntelligence #Hacking #Lisboa #Event ¿Tenías ganas de visitar Lisboa? Ven a vernos a Cloudflare Portugal.
SANS x Cloudflare Lisboa: 28 de Octubre
Blog personal de Chema Alonso ( https://MyPublicInbox.com/ChemaAlonso ): Ciberseguridad, IA, Innovación, Tecnología, Cómics & Cosas Personasles.
www.elladodelmal.com
October 7, 2026 at 8:11 AM
El lado del mal - SANS x Cloudflare Lisboa: 28 de Octubre www.elladodelmal.com/2026/10/sans... #Cloudflare #SANS #AI #IA #ThreatModeling #ArtificialIntelligence #Hacking #Lisboa #Event ¿Tenías ganas de visitar Lisboa? Ven a vernos a Cloudflare Portugal.
Researchers propose CVE2AP, an LLM-based method that automatically generates PDDL-encoded attack paths from natural-language CVE descriptions, aiming to scale up formal cybersecurity analysis.
#cybersecurity #AIsecurity #threatmodeling #LLM
https://arxiv.org/abs/2610.03383
#cybersecurity #AIsecurity #threatmodeling #LLM
https://arxiv.org/abs/2610.03383
October 6, 2026 at 12:01 AM
Researchers propose CVE2AP, an LLM-based method that automatically generates PDDL-encoded attack paths from natural-language CVE descriptions, aiming to scale up formal cybersecurity analysis.
#cybersecurity #AIsecurity #threatmodeling #LLM
https://arxiv.org/abs/2610.03383
#cybersecurity #AIsecurity #threatmodeling #LLM
https://arxiv.org/abs/2610.03383
[THREAT] Identified threat: MQTT broker accepts anonymous connections to all device topics
[RESPONSE] Dev/management: We've discussed it with leadership and accepted the risk.
#threatmodeling #infosec
[RESPONSE] Dev/management: We've discussed it with leadership and accepted the risk.
#threatmodeling #infosec
October 6, 2026 at 2:00 PM
[THREAT] Identified threat: MQTT broker accepts anonymous connections to all device topics
[RESPONSE] Dev/management: We've discussed it with leadership and accepted the risk.
#threatmodeling #infosec
[RESPONSE] Dev/management: We've discussed it with leadership and accepted the risk.
#threatmodeling #infosec
A multi-agent framework uses an LLM to perform design-time security review from requirements and architecture inputs, producing attack trees and mitigation recommendations without retrieving from CWE databases…
#AIsecurity #LLMagents #ThreatModeling #CyberDefense
https://arxiv.org/abs/2610.03820
#AIsecurity #LLMagents #ThreatModeling #CyberDefense
https://arxiv.org/abs/2610.03820
October 6, 2026 at 6:01 PM
A multi-agent framework uses an LLM to perform design-time security review from requirements and architecture inputs, producing attack trees and mitigation recommendations without retrieving from CWE databases…
#AIsecurity #LLMagents #ThreatModeling #CyberDefense
https://arxiv.org/abs/2610.03820
#AIsecurity #LLMagents #ThreatModeling #CyberDefense
https://arxiv.org/abs/2610.03820
[THREAT] Identified threat: Bastion allows SSH password auth as root from anywhere on the internet
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
October 5, 2026 at 2:00 PM
[THREAT] Identified threat: Bastion allows SSH password auth as root from anywhere on the internet
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[THREAT] Identified threat: TLS 1.0 still enabled on the customer login endpoint
[RESPONSE] Dev/management: Works on my machine.
#threatmodeling #infosec
[RESPONSE] Dev/management: Works on my machine.
#threatmodeling #infosec
October 4, 2026 at 2:00 PM
[THREAT] Identified threat: TLS 1.0 still enabled on the customer login endpoint
[RESPONSE] Dev/management: Works on my machine.
#threatmodeling #infosec
[RESPONSE] Dev/management: Works on my machine.
#threatmodeling #infosec
#OWASP #Ottawa is proud to announce Farshad Abasi founder of Forward Security will be speaking at #OWASPOttawa2026.
"Your Threat Model is Lying to You: Why Modeling the design Isn't Enough in 2026"
📅 Oct 17
📍 UofO- STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ tinyurl.com/mr2z6z8r
#ThreatModeling #DevSecOps
"Your Threat Model is Lying to You: Why Modeling the design Isn't Enough in 2026"
📅 Oct 17
📍 UofO- STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ tinyurl.com/mr2z6z8r
#ThreatModeling #DevSecOps
October 3, 2026 at 4:00 PM
#OWASP #Ottawa is proud to announce Farshad Abasi founder of Forward Security will be speaking at #OWASPOttawa2026.
"Your Threat Model is Lying to You: Why Modeling the design Isn't Enough in 2026"
📅 Oct 17
📍 UofO- STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ tinyurl.com/mr2z6z8r
#ThreatModeling #DevSecOps
"Your Threat Model is Lying to You: Why Modeling the design Isn't Enough in 2026"
📅 Oct 17
📍 UofO- STEM 117
ℹ️ tinyurl.com/87j33b82
🎟️ tinyurl.com/mr2z6z8r
#ThreatModeling #DevSecOps
[THREAT] Identified threat: Backups have not been test-restored since the runbook was written
[RESPONSE] Dev/management: We're not interesting enough for nation-state attackers.
#threatmodeling #infosec
[RESPONSE] Dev/management: We're not interesting enough for nation-state attackers.
#threatmodeling #infosec
October 3, 2026 at 2:00 PM
[THREAT] Identified threat: Backups have not been test-restored since the runbook was written
[RESPONSE] Dev/management: We're not interesting enough for nation-state attackers.
#threatmodeling #infosec
[RESPONSE] Dev/management: We're not interesting enough for nation-state attackers.
#threatmodeling #infosec
[THREAT] Identified threat: Sensitive Android activity is exported with no permission declared
[RESPONSE] Dev/management: Legacy system. We're sunsetting it next quarter.
#threatmodeling #infosec
[RESPONSE] Dev/management: Legacy system. We're sunsetting it next quarter.
#threatmodeling #infosec
October 1, 2026 at 2:00 PM
[THREAT] Identified threat: Sensitive Android activity is exported with no permission declared
[RESPONSE] Dev/management: Legacy system. We're sunsetting it next quarter.
#threatmodeling #infosec
[RESPONSE] Dev/management: Legacy system. We're sunsetting it next quarter.
#threatmodeling #infosec
[THREAT] Identified threat: Password policy permits 'password1' and has done since 2014
[RESPONSE] Dev/management: TOTP in Slack is fine, the channel is private.
#threatmodeling #infosec
[RESPONSE] Dev/management: TOTP in Slack is fine, the channel is private.
#threatmodeling #infosec
October 2, 2026 at 2:00 PM
[THREAT] Identified threat: Password policy permits 'password1' and has done since 2014
[RESPONSE] Dev/management: TOTP in Slack is fine, the channel is private.
#threatmodeling #infosec
[RESPONSE] Dev/management: TOTP in Slack is fine, the channel is private.
#threatmodeling #infosec
Threat Modeling erst nach Launch? Das kostet Zeit und Geld. Sicherheit muss in der Planung anfangen – mit echten Checklisten nach BSI und OWASP. Praxis statt Theorie für 2026.
#ITSicherheit #ThreatModeling
groenewold-it.solutions/blog…
(KI-generiertes Bild)
groenewold-it.solutions/blog…
#ITSicherheit #ThreatModeling
groenewold-it.solutions/blog…
(KI-generiertes Bild)
groenewold-it.solutions/blog…
October 1, 2026 at 10:48 PM
Threat Modeling erst nach Launch? Das kostet Zeit und Geld. Sicherheit muss in der Planung anfangen – mit echten Checklisten nach BSI und OWASP. Praxis statt Theorie für 2026.
#ITSicherheit #ThreatModeling
groenewold-it.solutions/blog…
(KI-generiertes Bild)
groenewold-it.solutions/blog…
#ITSicherheit #ThreatModeling
groenewold-it.solutions/blog…
(KI-generiertes Bild)
groenewold-it.solutions/blog…
[THREAT] Identified threat: Vendor binary is downloaded at build time with no checksum verification
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
September 30, 2026 at 2:00 PM
[THREAT] Identified threat: Vendor binary is downloaded at build time with no checksum verification
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[THREAT] Identified threat: Endpoint feeds user input into yaml.load() without SafeLoader
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
September 29, 2026 at 2:00 PM
[THREAT] Identified threat: Endpoint feeds user input into yaml.load() without SafeLoader
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[RESPONSE] Dev/management: Traffic is low enough that no one will notice.
#threatmodeling #infosec
[THREAT] Identified threat: /export.csv returns the entire user table without authentication
[RESPONSE] Dev/management: Marketing is technically a partner, not a vendor.
#threatmodeling #infosec
[RESPONSE] Dev/management: Marketing is technically a partner, not a vendor.
#threatmodeling #infosec
September 28, 2026 at 2:00 PM
[THREAT] Identified threat: /export.csv returns the entire user table without authentication
[RESPONSE] Dev/management: Marketing is technically a partner, not a vendor.
#threatmodeling #infosec
[RESPONSE] Dev/management: Marketing is technically a partner, not a vendor.
#threatmodeling #infosec