John Steven, Technical Director, Cigital

John Steven is a Technical Director with Cigital, Inc. and a founding member of the company?s Office of the CTO. He also holds the title of Principal for Cigital?s Software Security practice. In these roles, John is responsible for creating Cigital?s methodologies and building its knowledge collateral. His experience spans consulting, distributed systems architecture, operating systems, and software quality and security research. Mr. Steven works closely with Cigital?s largest clients to define and roll out enterprise security frameworks as well as security improvement and delivery programs, using his experience with Cigital?s Software Security, Quality Assurance, and Process Improvement practices to deliver clients innovative solutions.

Mr. Steven designed and developed jRapture, a capture/replay tool with profiling support for the Java2 platform. His work was presented at the 2000 International Symposium on Software Testing and Analysis (ISSTA). Mr. Steven has served on conference panels regarding software security, wireless security, and J2EE system development. Mr. Steven is currently under contract with Addison Wesley to publish a book on developing large-scale J2EE software securely. In addition to his extensive Java software development and testing experience, he has served as a technical advisor on large financial securities trading systems, including a J2EE municipal bond trading system. He is a published author and a sought-after reviewer of journal and conference submissions. Mr. Steven holds a B.S. in Computer Engineering and an M.S. in Computer Science from Case Western Reserve University.

Presentation: "Making Threat Modeling Useful to Software Development"

Track: Practical Application Security

Time: Wednesday 13:00 - 14:00

Location: Stanford

Abstract:

How will attackers break your web application? How much security testing is enough? Threat modeling, applied with a risk management approach can answer both of these questions if done correctly. This talk will present threat modeling through examples and exercises using the Java EE platform and focusing on authentication, authorization, and session management.

Participants will learn how to use diagramming techniques to explicitly document threats their applications face, enumerate the attack vectors these threat take advantage of, and plan tests to validate an application resists such attack.

Password protected Download slides