Privacy Shift Left: A Machine-Assisted Threat Modeling Approach

As cybersecurity and privacy have become a core part of product development, there has been a push to shift their implementation left (earlier) in the product development lifecycle. One facet of shifting left is employing threat modeling to identify areas of potential risk in a system’s architecture. While beneficial, though, threat modeling can be labor- and time-intensive. To address this, tools, some of which are open-source, are being developed to automate aspects of the process. These tools have primarily focused on security, but privacy threat detection functionality is being introduced. This talk presents a comparative evaluation of six of these open-source tools. It then introduces possible sources for use in developing a custom library of privacy threats. Finally, it ties the two discussions together by walking through an example of how detection capability for a specific privacy threat can be introduced into one of the six tools.