DevSecOps & friends

The kind of scalability described here is targeted to a software system undergoing design and developed by multiple engineering teams . In this situation the development is usually divided among the teams, every team r esponsible for a part of the system. It is also likely that there is a dedicated team, the architecture team , coordinating the ‘big picture’ of the whole system, but this is not always the case.   O ther frameworks for threat model scalability l ike P . A . S . T . A . , are more suited for securing a multiplicity of hosted and acquired systems participating on shared data, typically an enterprise business unit .   The challenges met in approaching threat modeling of a developing complex software system are:   Lack of composability and coordinatio n : the composition of the threat model s is less than the sum of parts and often not compatible and h omogeneous , due to:   Different maturity and TM features   Different l evel of abstraction (C4 like)   D