Threat Modelling: Or How I Learned to Stop Worrying and Love Misconfigurations (PG)

No ratings

Presented at STEELCON 2025 by

Finux Finnon

Andrea Jones

Presented by Andrea Jones and Arron “finux” Finnon Let’s be real — “threat modelling” sounds fancy. Like the sort of thing that involves flowcharts, frameworks, and someone insisting you need to ‘shift left’. But most of the time? It’s just asking whether you’ve accidentally left your cloud hanging out in the breeze. Again. This talk brings threat modelling back down to earth. Andrea and finux will walk you through how it’s often less about predicting cyber doom, and more about spotting that someone’s enabled public access… again. We’ll look at real-world examples where basic missteps caused major headaches, and how just paying attention to the boring stuff can save you a world of pain. We’ll also take a quick spin through a tool that might just help you catch those “oops” moments before they become incidents. Expect practical takeaways, a few sarcastic grins, and at least one moment where you’ll mutter, “Oh yeah, we totally do that…” Because sometimes the most effective security posture is just not leaving the door wide open in the first place.