{"guid":"bd3aa5dd-5842-4971-be51-11b48a56002f","title":"OWASP Cumulus: Threat Modeling the Ops of DevOps","subtitle":null,"slug":"god2025-56482-owasp-cumulus-threat-model","link":"https://c3voc.de","description":"In this presentation, we will highlight how threat modeling, as a proactive measure, can increase security in DevOps projects.\nWe will introduce OWASP Cumulus, a threat modeling card game designed for threat modeling the Ops part of DevOps processes. This game (in combination with similar games like Elevation of Privilege or OWASP Cornucopia) enables DevOps teams to take the security responsibility for their project in a lightweight and engaging way.\n\nLicensed to the public under https://creativecommons.org/licenses/by-sa/4.0/","original_language":"eng","persons":["Christoph Niehoff"],"view_count":173,"promoted":false,"date":"2025-11-26T12:20:00.000+01:00","release_date":"2025-11-26T00:00:00.000+01:00","updated_at":"2026-06-25T16:15:06.221+02:00","tags":["56482","2025","god2025","Track 2","god2025-eng","god2025","Day 1"],"length":1568,"duration":1568,"thumb_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f.jpg","poster_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/god/2025/56482-bd3aa5dd-5842-4971-be51-11b48a56002f.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/god2025-56482-owasp-cumulus-threat-model","url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_title":"German OWASP Day 2025","conference_url":"https://api.media.ccc.de/public/conferences/god2025","related":[],"recordings":[{"length":1568,"mime_type":"video/mp4","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-11-26T13:55:50.503+01:00","label":"eng 1080p","size":311,"recording_url":"https://cdn.media.ccc.de/events/god/2025/h264-hd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_hd.mp4","url":"https://api.media.ccc.de/public/recordings/93539","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"length":1568,"mime_type":"video/mp4","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-11-26T14:45:28.892+01:00","label":"eng 576p","size":71,"recording_url":"https://cdn.media.ccc.de/events/god/2025/h264-sd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_sd.mp4","url":"https://api.media.ccc.de/public/recordings/93570","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"length":1568,"mime_type":"audio/mpeg","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2025-11-26T14:40:42.930+01:00","label":"eng","size":24,"recording_url":"https://cdn.media.ccc.de/events/god/2025/mp3/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/93566","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"length":1568,"mime_type":"video/webm","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-11-26T14:51:31.134+01:00","label":"eng 1080p","size":210,"recording_url":"https://cdn.media.ccc.de/events/god/2025/webm-hd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/93571","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"length":1568,"mime_type":"video/webm","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-11-26T14:54:38.363+01:00","label":"eng 576p","size":63,"recording_url":"https://cdn.media.ccc.de/events/god/2025/webm-sd/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/93572","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"},{"length":1568,"mime_type":"audio/opus","language":"eng","filename":"god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2025-11-26T14:40:46.524+01:00","label":"eng","size":15,"recording_url":"https://cdn.media.ccc.de/events/god/2025/opus/god2025-56482-eng-OWASP_Cumulus_Threat_Modeling_the_Ops_of_DevOps_opus.opus","url":"https://api.media.ccc.de/public/recordings/93567","event_url":"https://api.media.ccc.de/public/events/bd3aa5dd-5842-4971-be51-11b48a56002f","conference_url":"https://api.media.ccc.de/public/conferences/god2025"}]}