Threat modeling: PhaaS, platform abuses, and content moderation
❗️Disclosure: I work at Pitch since December 2021. This write-up aggregates public knowledge previously shared by third parties (e.g., security firms, infosec community, etc.) or us. I hope this can be helpful for younger security teams that need to understand how to identify and mitigate phishing abuses for the first time. Threat model When you work in the startup ecosystem long enough, you learn that company cybersecurity risks are not only related to IT failures or the OWASP Top 10 but also to reputation. It doesn’t matter if your infrastructure is solid and redundant, if your engineers follow best practices, if you have real-time monitors and alerts in place, or if you implement other good practices: if stakeholders don’t trust your security standards, you are not secure in their eyes. This is why startups and companies invest money and time into security certifications like ISO 27001 or SOC 2 Type 2 (though this is a controversial topic, and I have strong opinions on it, I won’t delve into that now). ...