ideas
- A threat model that does not fit in one sentence is not a threat modelIf you cannot say who you are defending against and what they want, the spreadsheet underneath is decoration.
- An alert without an owner is a decorationDetection coverage is easy to buy and easy to measure. Someone whose week gets worse when the alert fires is neither.
- Choosing static was the security decisionThis site has no server, no database, no login and no third-party script. Most of its security work was done by deciding what not to build.