3GSE '14 - Elevation of Privilege: Drawing Developers into Threat Modeling

Elevation of Privilege: Drawing Developers into Threat Modeling

Adam Shostack, Microsoft

This paper presents Elevation of Privilege, a game designed to draw people who are not security practitioners into the craft of threat modeling. The game uses a variety of techniques to do so in an enticing, supportive and non-threatening way. The subject of security tools for software engineering has not generally been studied carefully. This paper shares the objectives and design of the game, as well as tradeoffs made …

adam adam shostack developers drawing game microsoft modeling not security people privilege security shostack techniques threat threat modeling