Ninjas

Cory at Matasano has a new blog post explaining “Ninja threat modeling.” Ninja threat modeling is Matasano’s approach to threat modeling as part of a penetration test. I’m really happy that they’ve given their approach a name. A few years back, we would just talk about “threat modeling” and it got confusing. With that said, I wanted to offer up our perspective. I’ll do that by first comparing and contrasting the SDL and ninja approaches, and...