Netsec Explained on YouTube · Open on YouTube
Running production: reliability, observability, performance and security · Proficient · Lesson 75 of 98 · 22 min video, then about 7 hours of practice
Security in production: threat modelling and the supply chain
After this you can run a lightweight threat model for a service and put basic supply-chain protections in place for its dependencies.
Why it matters
Beyond avoiding common bugs, senior engineers think about what an attacker would want and how they would get it. Threat modelling with STRIDE is a structured way to ask that question about a design before it is built. The other large risk is your dependencies: hundreds of packages you did not write. Pin versions, use automated dependency updates and vulnerability scanning, and be wary of new packages with few maintainers. Trap: security as a final review stage. Threat model at design time, when changes are cheap.
How to use this resource
STRIDE threat modelling, practically, in twenty minutes.
Go further
Go deeper
Practice