Uncle Joe @sydseter.com · May 11 You may be the best threat analyst in the world, but are you able to get the dev team to agree on when and what to fix? OWASP Cornucopia is a mechanism in the form of a card game to assist software development teams in identifying security requirements in Agile development processes.
12 likes 1 replies
?
Replies
It works by allowing the team to agree on "what can go wrong", and "What are we going to do about it"? The team brings a DFD, finds threats by playing, and votes on what to fix in the next sprint. There is no ambiguity because threat elicitation and mitigation are part of "the definition of done".