[THREAT] Identified threat: Finance pays invoices on emailed PDFs without out-of-band confirmation [RESPONSE] Dev/management: CVSS is only 6.8. We focus on 9+. #threatmodeling #infosec

[THREAT] Identified threat: Session ID is not rotated after login, enabling fixation attacks [RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem. #threatmodeling #infosec

[THREAT] Identified threat: Backups have not been test-restored since the runbook was written [RESPONSE] Dev/management: If something breaks, we'll do a blameless post-mortem. #threatmodeling #infosec

[THREAT] Identified threat: Multifunction printer stores scanned documents on an open SMB share [RESPONSE] Dev/management: We have a PR firm on retainer for that scenario. #threatmodeling #infosec

[THREAT] Identified threat: MQTT broker accepts anonymous connections to all device topics [RESPONSE] Dev/management: We've discussed it with leadership and accepted the risk. #threatmodeling #infosec

[THREAT] Identified threat: Bastion allows SSH password auth as root from anywhere on the internet [RESPONSE] Dev/management: Traffic is low enough that no one will notice. #threatmodeling #infosec

[THREAT] Identified threat: TLS 1.0 still enabled on the customer login endpoint [RESPONSE] Dev/management: Works on my machine. #threatmodeling #infosec

[THREAT] Identified threat: Backups have not been test-restored since the runbook was written [RESPONSE] Dev/management: We're not interesting enough for nation-state attackers. #threatmodeling #infosec

[THREAT] Identified threat: Password policy permits 'password1' and has done since 2014 [RESPONSE] Dev/management: TOTP in Slack is fine, the channel is private. #threatmodeling #infosec

[THREAT] Identified threat: Sensitive Android activity is exported with no permission declared [RESPONSE] Dev/management: Legacy system. We're sunsetting it next quarter. #threatmodeling #infosec

[THREAT] Identified threat: Vendor binary is downloaded at build time with no checksum verification [RESPONSE] Dev/management: Traffic is low enough that no one will notice. #threatmodeling #infosec

[THREAT] Identified threat: Endpoint feeds user input into yaml.load() without SafeLoader [RESPONSE] Dev/management: Traffic is low enough that no one will notice. #threatmodeling #infosec

[THREAT] Identified threat: /export.csv returns the entire user table without authentication [RESPONSE] Dev/management: Marketing is technically a partner, not a vendor. #threatmodeling #infosec