Ralph Andalis
Ralph is the Security Director of Gridlock Security (GridlockSec) - a company he founded that focuses on cybersecurity consulting services. He has 10 years experience in the industry as a Security Consultant/Pentester/Security Researcher for a few companies such as Microsoft, NCC Group, Hewlett-Packard (HP), Forward Security, and Ernst & Young (E&Y).
His expertise is mainly Web, Mobile, and Network Pentesting, Threat Modelling, Security Architecture Review, and Security Design Reviews. When he was a Senior Security Engineer at Microsoft, he dealt with security architecture reviews, security design reviews, threat modelling, security research, code reviews, and pentesting on the dedicated product he is directly working on with 100+ software engineers. The threat modelling practice he had daily done with his software engineers had helped secure the product and promoted a culture of secure coding and engineering of the said software.
He is also a major active contributor and a member of the working group for the OWASP Application Security Verification Standard (ASVS) project, making the standard better for fellow pentesters and developers alike.
He trained attendees at BSides Vancouver 2025, BSides Orlando 2025 and BSides Luxembourg 2026 for the workshop, "Threat Modelling Starter Training" which had been well received. He has presented his talk entitled, "OWASP ASVS: A Methodical and Practical Approach to Application Security Testing" on OWASP AppSec Pacific Northwest conference (PNW) 2024 in Vancouver, BC Canada. He has also presented a similar presentation aimed for beginners delivered online at HackStop Cybersecurity Summit 2024 held in Ljubljana, Slovenia.
Session
This 8-hour Threat Modelling training is geared towards intermediate audiences with software engineering and security engineer/pentester backgrounds who have never done any sort of threat modelling work but are trying to get into it. However, it also has some modules that would help beginners to get to speed in threat modelling practically right after the training, so beginners are also welcomed for this type of training. Many cybersecurity practitioners are facing threat modelling requirements to be part of their jobs, but don't know where to start or how to do it, which this training focuses on arming them the knowledge and techniques to do it as practiced by the instructor in his security consultancy career. Practically, anyone can join this class even if they do not have those backgrounds, but at least some basic idea of how programs work on a code level, basic cybersecurity issues and threats and anybody interested in learning them.
The main goal of this training is to equip participants with understanding the importance of threat modelling in dealing and understanding cyber threats to their applications and networks. The trainer's goal is to prevent more software security bugs from inception by teaching students whether they build more secure software or find underlying security flaws and bugs and minimizing the risks and impact of the engineered software. Participants will be immersed with STRIDE, DREAD, PASTA and NIST methodologies for threat modelling and they will create their own threat models during the training. STRIDE and DREAD are the most common threat modelling methodologies which we will immerse on the first half of the day. In the remaining half, we will bring it higher to diving in PASTA which had become increasingly popular methodology asked of practitioners and consultants to present a different point of view of an organization's potential threats. We will also look at the NIST threat modelling methodology as another comparison. This class focuses on being technology-agnostic with threat modelling methodologies where threat modelling software, while would be useful, is not relevant to the main goal of the training.
At the end of the training, students shall expect themselves to be able to do a quick threat model of any function/method that they wish to implement in their software, AI systems, networks, cloud infrastructure and any information system, then realize the threats that they could introduce or deal with, and finally be able to write a full and complete threat model on their own from start to finish including recommendations, threat scenarios and related risk ratings from a score-based weighted risk approach.