Think Like an Attacker (The Defender's Mindset)

Why this matters

Security work is fundamentally about disagreement: every attacker has read the same docs as you, and they're looking for the cases the docs didn't cover. The defender's mindset is the discipline of imagining what an adversary would do with your system before they do it, then writing code (and policies) so that the adversary's best move is still a loss.

Demo

Same login form, two readings: a developer sees 'username and password'; a defender sees 'two input fields whose contents I can't trust, an auth function with timing characteristics, and an error surface that may leak account existence'.

Try it yourself

1. Pick a feature you've shipped. Write three things an attacker could try first — be specific (e.g. 'send ' OR 1=1 -- in the email field'), not vague ('inject SQL').
2. For each, name the layer that should block it (validation, parameterised query, error masking).
3. Notice that you have to think like the attacker to know which control to design. That's the mindset.

References

• OWASP — Threat Modeling Process
• Adam Shostack — Threat Modeling: Designing for Security