The kind of scalability described here is targeted to a software system undergoing design and developed by multiple engineering teams . In this situation the development is usually divided among the teams, every team r esponsible for a part of the system. It is also likely that there is a dedicated team, the architecture team , coordinating the ‘big picture’ of the whole system, but this is not always the case. O ther frameworks for threat model scalability l ike P . A . S . T . A . , are more suited for securing a multiplicity of hosted and acquired systems participating on shared data, typically an enterprise business unit . The challenges met in approaching threat modeling of a developing complex software system are: Lack of composability and coordinatio n : the composition of the threat model s is less than the sum of parts and often not compatible and h omogeneous , due to: Different maturity and TM features Different l evel of a...
CyberKsen Blog
The Software Security blog