user avatar
user avatar
user avatar
Adam Shostack
  • Member for 7 years, 3 months
  • Last seen this week
27 votes
Accepted

Is disabling sudo password prompt a security risk?

21 votes

Writing my own encryption algorithm

21 votes

Teaching "Secure by Design"

7 votes

Correct terminology when describing password security to layman

6 votes

How to store/encrypt fingerprint?

5 votes
Accepted

Threat modelling tools and alternative threats

5 votes

Threat modeling

5 votes

Must a system be insecure against physical access? If so, why?

5 votes

How often do high-end attackers actually use zero-day exploits?

5 votes
Accepted

Isn't separating privileges less useful on a PC, as all my critical data is in my normal user account?

4 votes
Accepted

What is the best protocol for an organisation to make phone calls to clients, where the client is required to verify their identity?

4 votes

Is a threat model totally subjective or can it be based on objective guidelines?

4 votes
Accepted

What are the key steps in threat modeling as a user willing to stay anonymous?

4 votes

Creating root CA to issue certificates programmatically

4 votes

Can Google's employee or Microsoft employee see the files in the cloud?

4 votes

Why would a replay attack be considered a threat to integrity and not confidentiality?

4 votes

Is running wp-cli as root in docker container dangerous?

3 votes

Phish Proof Website. Possible?

3 votes

Is there a process to identify threats related to a deployments?

3 votes

What is a threat tree in threat modeling?

3 votes

Is this "security update" from security-update@amazon.com an advanced phishing scam or a real security measure from Amazon?

3 votes
Accepted

How much can we trust open source implementations of crypto (security) libraries?

3 votes
Accepted

Dataflow diagram - how far do I need to drill down?

3 votes

Difference between STRIDE and Mitre ATTACK

3 votes

What frameworks are available to analyze a security breach?

3 votes

Security of WWAN cards in laptops

3 votes

What is a threat model, and how do I make one?

3 votes
Accepted

Granularity for data assets when determining risk during software development

2 votes
Accepted

Actors and processes in threat models

2 votes
Accepted

How to correctly classify a threats related to Tampering in STRIDE