Threat modeling is a vital aspect of software development and cybersecurity, but it can be a challenge for product owners, software architects, developers, project managers, and business analysts to fully understand its importance and how to participate in it with impact. However, by understanding the obstacles that these stakeholders face and providing them with value in their specific roles, we improve their participation and the overall security of our systems.
One of the biggest issues with threat modeling is that stakeholders may not always be actively involved in the process. Additionally, during threat modeling workshops, some knowledge is expected from stakeholders, which can lead to valuable meeting time being lost if one or a part of the group needs explanations while others do not.
But with a good understanding of the threat modeling process, the quality of the threat model will be improved. Additionally, a good threat model process is an effective tool for raising awareness about threats to a system, which in turn improves overall security.
To solve these problems, we propose a solution of training and retraining participants up front, preferably with self-paced e-learning on demand. This will allow stakeholders to learn at their own pace and on their own schedule, minimizing the need for in-person reminders. Additionally, recorded training with spaced repetition can be used for future reference. For one-time participants, a simple introduction can be provided.
