The document discusses using threat models and Wardley maps as a case study for the Glasswall Proxy product. It introduces the Glasswall workflow and architecture, then shifts to discussing threat models and improving an initial threat model diagram. The document suggests threat models are works of art and moves the example threat model to the PlantUML diagramming language. It explores if threat models are maps, refers to Simon Wardley's definition of maps, and how mapping can help decide what to build, buy, or outsource based on maturity and risk.

1. Cybersecurity
Why Context is your
Crown Jewels
MapCamp
Oct 2020

2. I want to talk about
Threat Models
and my big
Wardley Map Epiphany

3. As a case study I’m going to
use the Open Source
Glasswall Proxy
product

4. Glasswall Product workflow
1. User clicks on
files stored on
SharePoint
I don’t have to
worry about
this file
4. Glasswall creates a
NEW visually identical
and safe file
2. During
download a Proxy
(like F5) intercepts
files
3. and sends them to malware
detectors and Glasswall
Anti-virus * CDR
* not provided by Glasswall)

5. High level Solution Architecture
Non-Kubernetes
Dependencies

6. Data flow Architecture *
ICAP Processing
Cluster
Administration
Cluster
ICAP Proxy Client
Sharepoint
Server
Load Balancer

7. Scalable Kubernetes Architecture

8. Let’s look at the
Threat Model
of this app

9. First version of Threat Model

10. Improved version of Threat Model

11. Most (including the ones just shown)
Threat Models are
Works of Art

12. Article on Dot Language
https://medium.com/@dinis.cruz/dot-language-graph-based-diagrams-c3baf4c0decc

13. Lets move the Threat Model to
PlantUML

18. Is an Threat Model an Map?

19. Simon Wardley’s definition of Map

20. Let’s make position matter

22. Now position matter

23. How do you decide
What to Build?
What to Buy?
What to Outsource?

24. This one?
What to Build?
This one?
This one?

25. This is where
Wardley Maps
Helps

27. Mapping
Confidential Data

29. How fast can you patch
(Making Risk Decisions)

31. Thanks