S2E19: Privacy Threat Modeling - Mitigating Privacy Threats in Software with Kim Wuyts (KU Leuven)

This week's guest is Kim Wuyts, Senior Postdoctoral Researcher at the DistriNet Research Group at the Department of Computer Science at KU Leuven. Kim is one of the leading minds behind the development and extension of LINDDUN, a privacy threat modeling framework that mitigates privacy threats in software systems.

In this conversation, we discuss threat modeling based on the Threat Modeling Manifesto Kim co-authored; the benefits to using the LINDDUN privacy threat model framework; and how to bridge the gap between privacy-enhancing technologies (PETs) in academia and the commercial world.    

Topics Covered:

• Kim's career journey & why she moved into threat modeling.
• The definition of 'threat modeling,' who should threat model, and what's included in her "Threat Modeling Manifesto."
• The connection between threat modeling & a 'shift left' mindset / strategy.
• Design patterns that benefit threat modeling & anti-patterns that inhibit.
• Benefits to using the LINDDUN Privacy Threat Modeling framework for mitigating privacy threats in software, including the 7 'privacy threat types,' associated 'privacy threat trees,' and examples.
• How "privacy threat trees' refine each threat type into concrete threat characteristics, examples, criteria & impact info.
• Benefits & differences between LINDDUN GO and LINDDUN PRO.
• How orgs can combine threat modeling approaches with PETs to address privacy risk.
• Kim's work as Program Chair for the International Workshop on Privacy Engineering (IWPE), highlighting some anticipated talks.
• The overlap of privacy & AI threats, and Kim's recommendation of The Privacy Library of Threats 4 AI ("PLOT4AI") Threat Modeling Card Deck
• Recommended resources for privacy threat modeling, privacy engineering & PETs.
• How the LINDDUN model & methodologies have been adopted by global orgs.
• How to bridge the gap between the academic & commercial world to advance & deploy PETs.
  
  

Resources Mentioned:

• The Threat Modeling Manifesto
• LINDDUN Privacy Threat Model  
• STRIDE threat model
• Threat Modeling Connect Community
• Elevation of Privilege card game
• Plot4AI (privacy & AI threat modeling) card deck
• International Workshop on Privacy Engineering (IWPE)

Guest Info:

• Follow Kim on LinkedIn

Send us a text

Privado.ai
Privacy assurance at the speed of product development. Get instant visibility w/ privacy code scans.

Shifting Privacy Left Media
Where privacy engineers gather, share, & learn

Disclaimer: This post contains affiliate links. If you make a purchase, I may receive a commission at no extra cost to you.

Copyright © 2022 - 2024 Principled LLC. All rights reserved.