Export to

• Google Calendar
• iCalendar file
• hCalendar markup
  <div class="vevent h-event"> <h1 class="summary p-name">OWASP: Add TAL, improve a threat model!</h1> <div class='date'><time class="dtstart dt-start" title="2016-06-21T18:00:00" datetime="2016-06-21T18:00:00">Tuesday, June 21, 2016 from 6</time>–<time class="dtend dt-end" title="2016-06-21T19:30:00" datetime="2016-06-21T19:30:00">7:30pm</time></div> <div class="location vcard p-location h-card"> <a class="url" href='http://calagator.org/venues/202395261'><span class='fn org p-name'>WebMD</span></a> <div class="adr p-adr h-adr"> <div class="street-address p-street-address">2701 Northwest Vaughn Street</div> <span class="locality p-locality">Portland</span> , <span class="region p-region">OR</span> <span class="postal-code p-postal-code">97210</span> <div class="country-name p-country-name">US</div> (<a href='https://maps.google.com/maps?q=2701%20Northwest%20Vaughn%20Street,%20Portland%20OR%2097210%20US'>map</a>) </div> </div> <div class="description p-description"> <h1>Add TAL, improve a threat model!</h1> <p>To improve your (threat) modeling career, you need a better (threat) agent (library)! Threat modeling is a process for capturing, organizing, and analyzing the security of a system based on the perspective of a threat agent. Threat modeling enables informed decision-making about application security risk. In addition to producing a model, typical threat modeling efforts also produce a prioritized list of security improvements to the concept, requirements, design, or implementation. In 2009, OWASP posted wiki pages on threat modeling. Although there was the start of a section on threat agents, it has yet to be completed.<br></p> <p>Intel developed a unique standardized threat agent library (TAL) that provides a consistent, up-to-date reference describing the human agents that pose threats to IT systems and other information assets. Instead of picking threat agents based on vendor recommendations and space requirements in Powerpoint, the TAL produces a repeatable, yet flexible enough for a range of risk assessment uses. We will cover both the TAL, the Threat Agent Risk Assessment (TARA), how they can be used to improve threat modeling.</p> <h1>Speaker</h1> <p>Eric Jernigan<br> Information Security Architect<br> Umpqua Bank<br></p> <hr> <p>Eric Jernigan is an Information Security Architect at Umpqua Bank and focuses on risk assessment, Secure project support, information security governance, and security awareness. Prior to this, Eric He has also served as an information security manager and adjunct instructor at PCC. He has also served as an active duty Information Warfare Analyst in the Air National Guard in support of NORTHCOM/NORAD. He has almost twenty years of intelligence, counter-terrorism, Information warfare, information security, and compliance experience. His current professional certifications include CISM, CRISC, and CISSP, so love him. A staunch privacy advocate, he hates Facebook.</p> <br> <hr> <p>The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide charitable organization focused on improving the security of application software. To sign up for future meeting notes and to discuss security topics with local gurus, sign up on the OWASP Portland mailing list: <a href="https://lists.owasp.org/mailman/listinfo/owasp-portland">https://lists.owasp.org/mailman/listinfo/owasp-portland</a></p> <br> <p>Meetings are free and open to the public.</p> </div> <h3>Links</h3> <ul> <li><a class="url u-url" href="https://www.owasp.org/index.php/Portland">Website</a></li> </ul> </div>