{"guid":"bd3aa5dd-5842-4971-be51-11b48a56002f","title":"OWASP Cumulus: Threat Modeling the Ops of DevOps","subtitle":null,"slug":"god2025-56482-owasp-cumulus-threat-model","link":"https://c3voc.de","description":"In this presentation, we will highlight how threat modeling, as a proactive measure, can increase security in DevOps projects.\nWe will introduce OWASP Cumulus, a threat modeling card game designed for threat modeling the Ops part of DevOps processes. This game (in combination with similar games like Elevation of Privilege or OWASP Cornucopia) enables DevOps teams to take the security responsibility for their project in a lightweight and engaging way.\n\nLicensed to the public under https://creativecommons.org/licenses/by-sa/4.0/","original_language":"eng","persons":["Christoph Niehoff"],"tags":["56482","2025","god2025","Track 2","god2025-eng","god2025","Day 1"],"view_count":151,"promoted":false,"date":"2025-11-26T12:20:00.000+01:00","release_date":"2025-11-26T00:00:00.000+01:00","updated_at":"2026-02-23T16:15:05.890+01:00","length":1568,"duration":1568,"thumb_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f.jpg","poster_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/god2025-56482-owasp-cumulus-threat-model","url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_title":"German OWASP Day 2025","conference_url":"https://api.media.ccc.de/public/conferences/god2025","related":[],"recordings":[{"size":15,"length":1568,"mime_type":"audio/opus","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2025-11-26T14:40:46.524+01:00","recording_url":"https://cdn.media.ccc.de/events/god/2025/opus/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_opus.opus","url":"https://api.media.ccc.de/public/recordings/93567","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"size":62,"length":1568,"mime_type":"video/webm","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-11-26T14:54:38.363+01:00","recording_url":"https://cdn.media.ccc.de/events/god/2025/webm-sd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/93572","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"size":210,"length":1568,"mime_type":"video/webm","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-11-26T14:51:31.134+01:00","recording_url":"https://cdn.media.ccc.de/events/god/2025/webm-hd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/93571","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"size":70,"length":1568,"mime_type":"video/mp4","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-11-26T14:45:28.892+01:00","recording_url":"https://cdn.media.ccc.de/events/god/2025/h264-sd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_sd.mp4","url":"https://api.media.ccc.de/public/recordings/93570","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"size":23,"length":1568,"mime_type":"audio/mpeg","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2025-11-26T14:40:42.930+01:00","recording_url":"https://cdn.media.ccc.de/events/god/2025/mp3/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/93566","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"size":311,"length":1568,"mime_type":"video/mp4","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-11-26T13:55:50.503+01:00","recording_url":"https://cdn.media.ccc.de/events/god/2025/h264-hd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_hd.mp4","url":"https://api.media.ccc.de/public/recordings/93539","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"}]}