Threat Modeling on Rietta Cybersecurity

Threat Modeling for ADA/WCAG Compliance

Tue, 28 Jul 2026 14:00:00 +0000

Why Accessibility Belongs in Your Threat Model Most organizations treat digital accessibility as a content problem: someone finds a missing alt tag, fixes it, and moves on. I think that’s the wrong frame entirely. Digital accessibility is an organizational risk and governance gap, and once you see it that way, the right tool for the job isn’t a content checklist. It’s the same discipline we already use for application security: threat modeling and continuous technical monitoring.

Practical APPSEC starts with people first, processes second, and technology last

Thu, 04 Feb 2021 11:00:00 -0500

Application Security (APPSEC) is the subset of Information Security that is focused on hardening software to protect humans, be it customers, partners, and the public at large. The software itself must be designed to be more secure because security cannot effectively be bolted on at the end of the development process. It’s an old time idea, but security is about people, processes, and technology in that order. Let’s look at how a web application goes astray by people’s knowledge, incentives, and the working of the development process.

What is an Abuser Story (Software)

Sun, 11 Oct 2015 22:35:36 -0400

I publicly speaking about how development teams and those who employ them should go about using user stories with security constraints and abuser stories as a security documentation tool. At this time there is not an entry on Wikipedia about it, so I am going to take a stab at writing it up for you here.

What is an Abuser Story in Software Development?

In software development and product management, an abuser story is a user story from the point of view of a malicious adversary. Abuser stories are used with agile software development methodologies as the basis for defining the activities that should be actively blocked or mitigated by the software and proven by automated regression testing.