ThreatModCon 2023

Threat Modeling Connect

Join us at ThreatModCon 2023, the first Threat Modeling Conference in the industry to meet, interact, and connect with top TM practitioners!

Marriott Marquis Washington, DC

Sales have ended for this event. Please join the Threat Modeling Connect community if you haven't already.

Join us this October 29 in Washington DC at the inaugural Threat Modeling Conference, where you can meet, interact, and connect with the top threat modeling practitioners in the industry!Organized by the Threat Modeling Connect community, ThreatModCon 2023 brings together the brightest minds to discuss, debate, and share insights on the latest developments, trends, and best practices in threat modeling. W﻿hat you'll get out of this conference:Learn from the best in the industry: 10 insightful presentations featuring industry leaders in academia, private and public sectors worldwideThreat model with guidance from top experts: 2 hands-on workshops to put your knowledge into practice and gain feedback from leading expertsConnect with fellow threat modeling practitioners: Enjoy plenty of hallway conversations (as we know that’s where meaningful connections happen) as we intentionally keep the conference smallStay ahead of the curve: Come away with the latest trends, tools, and strategies in threat modeling, helping you stay ahead of the curve as you navigate the constantly-changing cybersecurity landscape

Code of Conduct for ThreatModCon<ul><li>Perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles;</li><li>Promote the implementation of and promote compliance with standards, procedures, controls for application security;</li><li>Maintain appropriate confidentiality of proprietary or otherwise sensitive information encountered in the course of professional activities;</li><li>Discharge professional responsibilities with diligence and honesty;</li><li>Communicate openly and honestly;</li><li>Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Threat Modeling Connect;</li><li>Maintain and affirm our objectivity and independence;</li><li>Reject inappropriate pressure from industry or others;</li><li>Not intentionally injure or impugn the professional reputation or practice of colleagues, clients, or employers;</li><li>Treat everyone with respect and dignity;</li><li>Not violate the Threat Modeling Connect trademarks, copyrights, or licenses;</li><li>Provide proper attribution to avoid plagiarism and copyright infringement, both within and outside of Threat Modeling Connect;</li><li>Ensure work submitted to Threat Modeling Connect is entirely yours and not copied, whole or in part, without proper attribution or permission;</li><li>Abide by all provisions in applicable Threat Modeling Connect Foundation organizational documents, agreements, and policies (i) requiring adherence to applicable export laws, including the export control rules and regulations of the United States; or (ii) requiring adherence to the applicable antitrust and competition laws, including the antitrust rules and regulations of the United States.</li><li>Not engage in any intimidating, harassment, discriminatory, abusive, derogatory, or demeaning speech or actions (“harassment” includes, but is not limited to: Communication or conduct that a reasonable person in the individual’s circumstances would consider unwelcome, intimidating, hostile, threatening, violent, abusive or offensive, such communication may be related to gender, gender identity and expression, sexual orientation, disability, national origin, race, age, religion; it also includes stalking, following, harassing photography or recording, sustained disruption of talks or other events, inappropriate physical contact, and unwelcome sexual attention);</li><li>Avoid relationships that impair — or may appear to impair — the Threat Modeling objectivity and independence; and</li><li>Not engage in any illegal activities or commit violations of applicable law, including but not limited to the laws of the United States and its states or the European Union, that (i) could result or actually result in liability or harm to Threat Modeling Connect; or (ii) are related to your participation in ThreatModCon, including use of Threat Modeling Connect materials and publications, sponsored activities; or (iii) are related to your use of software developed in a project sponsored by Threat Modeling Connect.</li></ul>

IriusRisk will process the personal data that you provide in this form, for the purpose of managing your participation in the event, webinar and/or workshop you are registering for. If you have accepted to receive information such as new content, past and upcoming events or other communications, you can withdraw your consent at any time. Your personal data may be shared with other IriusRisk companies and service providers or partners, which may involve international data transfers, for which appropriate safeguards have been applied. You may exercise your data protection rights by sending an email to <a href="mailto:dpo@iriusrisk.com" title="mailto:dpo@iriusrisk.com" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">dpo@iriusrisk.com</a>. If you want to know more, please visit our <a href="https://www.threatmodelingconnect.com/site/terms" title="https://www.threatmodelingconnect.com/site/terms" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Privacy Policy</a>.

Agenda

Registration & Coffee 

Welcome & Introduce the Day

Join some luminaries of the threat modeling world — Adam Shostack, Brook Schoenfield, Matthew Coles, Seba Deleersnyder, Tanya Janca, Robert Hurlbut, and John Taylor — as they share their threat modeling stories.

Keynote: Threat Modeling is for Everyone

The security community is great at finding problems! We can use threat modeling in a real world "system": our community. We'll see how it can be abused or exploited, focusing on social conflicts in a vulnerable community. Importantly, we’ll talk about what we should do to build a safer community.

 The Threats to Our Community 

Explore how to evolve threat models in sync with the ever-changing cloud landscape. This talk emphasizes shifting from static to dynamic threat models and proactive responses to cloud updates. Gain insights into threat minimization, stay abreast of cloud changes, and enhance your threat modeling.

Shifting Threat Models from Static to Dynamic 

Privacy is important. It matters to your users, is required by law, and strengthens your security posture. So let's do some privacy threat modeling! But, how do you actually do that in practice? This talk explores how privacy can, and should, be integrated in your security threat modeling practice.

Shifting Privacy In

While comparing state-of-the-art threat modeling tools as part of an RFP, the speaker analyzed their ability to detect vulnerabilities previously identified through classic STRIDELM by dozens of trained teams. This talk will take you through the results of the analysis, highlighting the type and percentage of vulnerabilities s that cannot be identified by tools and what you can do about it.

Classic Brainstorming Threat Modeling vs. Threat Modeling Tools

"Classic" threat modeling can be improvised for offline, human-organizational security assessment, prioritization, and mitigation. This talk will enumerate how "technical" and "non-technical" users can benefit from the logic and methods of threat modeling.

Operational-Intersectional Threat Modeling: Adapting for IRL and Offline App

In the age of DevOps, determining the nature of a change is a giant compliance, regulatory, and security nightmare. This talk will give you a few questions to easily triage the swarm of product updates coming every hour of the day to find the right level of threat modeling for the job.

Threat Modeling Triage 

Lunch & Birds of a Feather 

Threat modeling is a way of thinking about what can go wrong and how to prevent it. When it comes to building or evaluating information systems, we need to develop a similar mindset. In this workshop, you'll learn the practical strategies to develop a Threat Modeling Mindset by: (1) understanding a system, (2) identifying threats and vulnerabilities, (3) determining mitigations, and (4) applying the mitigations through risk management.

Workshop: Developing a Threat Modeling Mindset 

By using example potential outputs of a Threat Model Session, we'll discuss how each artifact (DFD, Threat Table, Threat Library, Risk Assessment) can: inform development with "security in mind" within the Team(3-5), feed inputs into Red/Purple team engagements for more targeted results(3-5), build collaboration across teams/organizations (10).

Workshop: From Threat Discussion to Completed Mitigation 

Coffee Break

Security teams must creatively budget and scale resources to meet the breakneck pace of development. In this presentation, we’ll share lessons learned from scaling and iterating our threat modeling and secure design in a quest to derive enterprise value on a shoestring budget.

Threat Modeling Program Milestones: A Journey to Scale 

This session is building up on the article ‘Hitchhiker’s Guide for Failing Threat Modeling’. It incorporates the experience and best-fails of various Threat Modeling experts and draws a conclusion on what we should emphasize as a Threat Modeling community. After the session, the listener will have a clear understanding what better not to do and what to consider when setting up a Threat Modeling program.

The Hitchhiker's Guide for Failing Threat Modeling 

Leveraging the manual process of thread modeling to jumpstart a DevSecOps program where it is all about automation may sound counterintuitive. Yet, there are good arguments why it still is an essential part of every DevSecOps program. See how threat modeling can scale up your DevSecOps program.

Being VERY Agile with Rapid Threat Model Protyping (RTMP) 

Introducing threat modeling to engineers regardless of their experience is everyone's goal, isn't it? In this session, you'll be introduced to a framework for decomposing complex systems into constituent components and how to use that information to conduct an AI-assisted threat model.

Everyone is a Threat Modeler: An AI-Enabled Journey for Beginners

Closing Remarks

ThreatModCon 2026 Vienna

Meliá Vienna

ThreatModCon 2026 San Francisco

Hyatt Regency San Francisco

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}

Ticket sales have ended

ThreatModCon 2023

More events from Threat Modeling Connect

Discover more events from Threat Modeling Connect, from Science & Tech to other experiences you might love.

ThreatModCon 2026 Vienna

ThreatModCon 2026 San Francisco

Still looking for the right event?

Explore all events in Washington and filter by date, category, and more to find the perfect fit.

Ticket sales have ended

ThreatModCon 2023

More events from Threat Modeling Connect

Discover more events from Threat Modeling Connect, from Science & Tech to other experiences you might love.

ThreatModCon 2026 Vienna

ThreatModCon 2026 San Francisco

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.

Still looking for the right event?

Explore all events in Washington and filter by date, category, and more to find the perfect fit.