Could you tell me a little bit about what a career in threat modeling looks like? What
are some of the day-to-day tasks of a threat modeler? And is it a job position in itself
or is it sort of an add-on to things like pen testing and so forth?
You know what’s interesting? I have to laugh about this. I’ve been this since 2003. And
I basically learned a lot from Adam Shostack. Adam Shostack is considered to be the grandfather,
the grand opus of – He literally wrote the book on threat modeling. Put it that way.
He and I did – We did some presentations together. I’ve known him for a number of
years. Really nice guy. Well, there never existed a position called a threat modeling
position at all, threat modeler, right?
Right. I was wondering. Yeah.
Yeah, in the last year and a half, and maybe in the last two years, recruiters have been
contacting me and saying, “Hey, we think you’d be great for a junior threat modeler
position.” Of course, I sneakered. But then I think, “A what? A threat modeler position?
What the hell is that?” It’s like I’ve never heard it beforehand. Generally, you
have your cloud ops engineers, your security app sec engineers, that kind of thing. Your
dev sec ops engineers. I get it. But a threat modeler? It’s actually becoming a position,
because as we’re getting more and more complicated, situations and solutions and systems, we’re
of course becoming more specialized. Part of this specialization is a threat modeling
position. I would recommend people don’t become threat modelers. They become threat
modelers only as part of their other jobs. I strongly still believe, if you’re in security,
try to learn as much as you can across a number of different disciplines. If you want to become
an architect, great, a security architect. Learn threat modeling. But don’t make threat
modeling your only focus. Don’t pigeonhole yourself.
If you want to know some engineering, you want to know a broad set of skills. I know
infrastructure, I would call myself an infrastructure security person when I can do it. I can do
network security. Although, again, I wouldn’t call that my forte. App sec is my forte. And
then threat modeling on top of that, and then security architecture. It’s a number of
layers. Now, if you want to have a forte, fine. Have a forte in threat modeling, but
I would still say probably become more of a security architect than a threat modeler,
if that makes sense.
Yeah. That was going to be my next question, is if there’s not really a threat modeling
position, what’s the most adjacent thing that if you want to do a lot of that kind
of thing, where should you be sort of like putting your focus?
Security design and architecture. Yeah, security design. If they don’t have that, a lot of
companies don’t have the concept of security architect, then you’re going to go to app
sec. You’re the app sec guy. If they don’t have that, then you’re going to become a
security champion. You’re going to make yourself a security champion and you’re
the lead security guy within an app dev team, but they don’t actually have a position.
I’m the security champion. Believe me, we need that. Or I should say, “We need you,”
kind of thing.
Yeah. No. We’ve had a couple of people talk to security champions program on here before.
It’s important and it’s underutilized and it’s one of those things that companies
need to sort of have someone twist their arm a little bit. It seems like a lot of them
are a little resistant or –
Well, I get it at my company too. What I don’t understand is – And my company is now starting
to understand it, because I’m one resource and I keep telling them, “Look. I’m one
resource, and I spread myself across a number of different projects. If you want me to work
at high capacity, allow me to dig in to each one of those different teams and have a local
representative there, which then allows me to spread my knowledge. That way, I can scale.”
That’s a big thing for driving a security champion, because it allows the security people
to scale at a proper rate.
There you go.
And everyone minimizes – Well, what they do is it ends up being that you have less
work overall across everyone. I think it’s sort of a win-win
New episodes of Cyber Work are available every Monday at 1pm central and don't forget to
claim your free month of Infosec Skills! Sign up using the code 'cyberwork' and you'll get
unlimited access to hundreds of courses, hands-on labs, certification practice exams, skills
assessments and more. Use code 'cyberwork' for Infosec Skills