Automating and Scaling of Threat Modelling for Cloud Native Archit... Hanna Papirna & Emma Yuan Fang

This talk covers the complexities of threat modeling for cloud-native applications operating in Kubernetes cross-tenant environments. The speakers, Hanna Papirna and Emma Yuan Fang from EPAM Systems, present a block-based methodology that segments applications into four distinct domains: gateway, service mesh, identity management, and storage. This innovative approach enhances the scalability of threat analysis and integrates it into development workflows. Participants will also learn to implement threat modeling as code using declarative models validated in CI/CD pipelines. A demonstration showcases the optimal use of AI tools to identify security risks in intricate microservices applications and emphasizes how CNCF-graduated project controls mitigate several threats while revealing others that need addressing. Attendees will gain a repeatable workflow for threat modeling applicable to various cloud-native architectures.