Threat models that fit on paper
A one-page model the on-call engineer can hold is worth more than a 90-page appendix nobody opens.
Otto Král’s threat models fit on one sheet. Assets, actors, what we already do, what we will do this quarter. The rest lives in the issue tracker, not in a binder.
A long appendix is useful for an audit. It is useless at 3 a.m. The sheet goes next to the on-call phone. When the model changes, we reprint it.
Security work at Lumen is mostly subtraction: fewer open ports, fewer standing privileges, fewer secrets in chat. The interesting part is making that subtraction survivable for the people who ship.