Claus Cramon HoumannSo @trailofbits released a new threat modelling framework. I really like that, as all of the old existing 'reference' frameworks are so hard to apply in a way that brings any or much value to the process. Or I'm too dumb to do it :P.
Very exciting: https://blog.trailofbits.com/2025/02/28/threat-modeling-the-trail-of-bits-way/
Threat modeling the TRAIL of Bits way
In this blog, we’ll talk about our threat modeling process, TRAIL, which stands for Threat and Risk Analysis Informed Lifecycle. TRAIL enables us to trace and document the impact of flawed trust assumptions and insecure design decisions throughout each client’s system architecture and SDLC. Over time, multiple application security experts have refined TRAIL to provide maximal value for our clients and to minimize the effort required to update the threat model as the system changes.
wvu
Insomni'hack
