Developers should make "abuser stories" a thing.
"As an stalker,
I want to track my ex's every move,
so that I can 'coincidentally' run into them at any time."
"As a thief,
I want to be able to reset passwords using SMS verification,
so that I can compromise any account by bribing a telco employee."
@aris It is, but this distills it down to something that is easy to understand by most people.
Who is the threat actor?
What do they want?
Why do they want it?
@simulo @ryanc
Nice. I was looking for something similar.
I played for some time with the idea that there should be a "game" helping development teams doing threat modelling and creating abuse stories (incorporating stalkers and abusive partners)
Something with elements of #EoP and #BackdoorsAndBreaches but with the persona non grata in mind.
@ryanc this would certainly make more sense than my old manager's approach of contorting then into user stories that make no sense.
"As a spammer, I want to sign up with a bot, so I can post links to my website" makes way more sense than "as a user, I want to complete a captcha, so that I can sign up". No they don't. No user has ever wanted that. "As a user, I want a spam-free website" just about works but really, the users are not involved in this one, leave them be
@david_chisnall It's not just security - I included the stalker for a reason.
People have a "how would my partner's creepy ex use this" conversation for major features.
@ryanc I'd include that under the heading of security. It's closely related to the 'can an attacker leak information from my smart device that tells them when my house is unoccupied' threat.
I'm still waiting for an organised crime syndicate to provide a service that aggregates a load of data from Facebook and similar to tell petty criminals which houses near them are unoccupied.
@david_chisnall @ryanc I agree, in both cases the product is being used "as intended", in the sense that no bypass of any security control takes place. They are either both security or both not security, but safety/privacy, depending on your definition of the term security.
In any case, I agree with the original idea as well, and including stalkers in the threat model is one of the most important things for security professionals to do.
@ryanc In the UX world, this is sometimes referred to as “abusability testing”.
(Although it’s more than just testing, of course)
@ryanc I've been in teams where we called these "negative user stories". Very useful for distilling threats.
Sometimes you also need to translate them into "headlines we never want to see our company's name in" for further up the leadership chain.
@ryanc Hiya! A friend passed this toot along to me, and if you're interested I have a post about it: https://24ways.org/2018/be-the-villain/
In my experience the main barrier is organizational attitudes towards suggesting this can potentially happen 😰
Eric Bailey asks us to take on the role of King Herod in our projects to consider how the products, services and processes we design could be abused to cause harm rather than to do good. No matter how good our intentions, we must remember that not every user has pure motivations and that every tool is a weapon if you hold it right.
@ryanc
"As a data breach buyer,
I want a few personal background questions to bypass all other account security,
So that I can access thousands of people's accounts with the marriage and vehicle registration records I already have."
@ryanc @matthewskelton this specifically is a thing we've been doing at a company I used to work at a few years back. Our security team consulted with the dev teams to show them, help them and teach them how to do it.
Now we'd probably call it an enabling team.
One of the coolest initiatives I've ever been part of.
@adamshostack @matthewskelton @ryanc iirc we did come up with these when breaking down epics into stories, so depending on the epic it could be just two or three or a whole number of them.
I don't think calling it threat modeling is appropriate though for what we did. We didn't go much deeper than client side validation abuse and sql injections.
Unfortunately it's been so long, I doubt I have any material left anywhere from that time.
If I find samples, I'll send them your way.
@ryanc ooooh I love this.
Also, one could make it into a website. With specific examples from specific companies implementing these user stories in their systems.
@ryanc
I see people in the comments here talk about using this as threat modeling, but as a developer who think philosophy class was my most valuable subject, I see this as a useful tool for ethics in sysdev.
Less can I do this and more should I do this.
@ryanc
isn’t this basically the objective of a “#RedTeam” in #cybersecurity?
One definition of product strategy is a clear policy articulating what you won’t permit, tolerate, or condone. In that case, Product teams with a sense of responsibility and accountability who employ data governance may inadvertently put themselves in a box. The leadership box says, “we’re not doi
@ryanc This is pretty much https://insights.sei.cmu.edu/blog/the-hybrid-threat-modeling-method/
We've developed this into building security awareness in the dev teams by having them workshop the PnGs as a light-hearted team activity, building the bios and so on.
Then those are used as threat modelling as part of the agile design process, with the co-ordinator asking "What would 'Kevin' do with this feature?" and the team working through 'Kevin''s personality, goals, assets and so on because they *know* 'Kevin'.
Meanwhile one of my devs complained about certs and asked if I could get one with a 20 year expiration.
Also, they'd stored the previous cert in outlook for the last three years 😭
Gail Shaw
Ryan Castellucci (they/them) 
Aris Adamantiadis 
💲Paid
Graham Sutherland / Polynomial
wuest
Jan D
Claudius Link
Andrew
Tursiae
David Chisnall (*Now with 50% more sarcasm!*)
Sophie Schmieg
Adam Shostack 
Tim Ward ⭐🇪🇺🔶 #FBPE
Ken Kinder 
mhoye
John Schrag
Bruno Girin
Sean Blakey
7heo
Eric
recursive 🏳️🌈
Riley S. Faelan
Pau Amma
Jenniferplusplus
(moved)Galbinus Caeli 🌯
Patrick
THIS ACCOUNT HAS MOVED
Chris
Daniel Fisher(lennybacon)
Michał "rysiek" Woźniak · 🇺🇦
Werner
Coach Sankhavaram ®
Ulf
mobbsy
Thomas Reed
Lyndal
Grendel
Dec [{(
)}]
Tanguy ⧓ Herrmann
Su-Shee