(Hybrid) Threat Modeling Embedded Systems with MITRE EMB3D (Robert Hurlbut)

This is a hybrid event, and we'll share the Zoom link a couple of minutes before the meeting starts.

Topic:
Threat Modeling Embedded Systems with MITRE EMB3D

Description:
Connected devices are commonly found across critical infrastructure, automotive, and healthcare. Securing embedded hardware and firmware has never been more critical. This talk bridges the gap between traditional enterprise AppSec and physical device security. Attendees will learn how to transition from reactive vulnerability patching to proactive, secure-by-design development using the MITRE EMB3D threat model. We will explore how to enumerate hardware and software device properties, map them to known threat vectors, and apply tiered mitigations mapped directly to standards like ISA/IEC 62443-4-2. Furthermore, the session will cover how to integrate MITRE ESTM ⁠for advanced attack path analysis and how to align these practices with the Threat Modeling Manifesto.

Note: This is a preview of a presentation that will be given at the upcoming OWASP Global AppSec SF 2026 conference in San Francisco on November 2-6, 2026.

Bio:
Robert Hurlbut is a Threat Modeling Trainer and Consultant at Horizon Cyber LLC and
has over 30 years of experience in secure coding and software architecture.
Prior to founding Horizon Cyber LLC, he initiated and led threat modeling programs at Bank of America
and Aquia. Robert is passionate about empowering teams to identify, communicate,
and understand threats and mitigations, ultimately enhancing the security of workloads
through effective threat modeling. He is an ISC2 Certified Secure Software Lifecycle
Professional (CSSLP), holds a Master of Science in Cyber Security from Southern New
Hampshire University, and is pursuing a Ph.D. in Space Cybersecurity at Capitol
Technology University. Additionally, Robert is a co-author of the Threat Modeling
Manifesto and the Threat Modeling Capabilities Model, and he co-hosts the Application
Security Podcast. Globally recognized as an expert in threat modeling, he regularly
contributes thought leadership and delivers workshops and training at industry events.

Venue and Food:
This is a hybrid event!

Virtual: Zoom link will be provided at the time of the meeting.

In-Person: We are meeting at 6:30 pm at Paragus IT at 112 Russell St, Hadley, MA. Please RSVP for the pizza and soda count.