user-story-mapping-for-effective-communication.md

---

title        : Using User Story Mapping for effective communication
type         : working-session      # working-session, user-session, product-session
track        : Maps and Graphs
technology   :
topics       :                    # for example ["GDPR"]
featured     : no                 # review with summit team "yes"
when_day     : Wed
when_time    : PM-1
room_id      : room-3
locked       : true
session_slack: https://os-summit.slack.com/messages/CAX9L015H
status       :               # draft, review-content, done
description  :
organizers   :
    - Fraser Scott
participants :
    - Vladimir Voskresenskiy
    - Orid Ahmed
    - Tony Richards

---

Based on the work by @jeffpatton namely the presentation User Story Mapping, Discover the whole story

Explore how it relates to Threat Modeling

This paragraph from Jeff's User Story Mapping book pretty much describes threat modeling in non-technical terms:

{{% img src="https://user-images.githubusercontent.com/656739/40591139-6d1340b8-6203-11e8-9965-8e0299989d09.png" width="400" %}}

WHY

User story mapping is all about discovery and communication. Threat modeling is all about discovery and communication. What can threat modeling learn from user story mapping and related techniques to help make it more effective? Can using user story mapping techniques reduce the friction to getting started with threat modeling for development and engineering teams?

What

To be determined based on who's in the room, but possibly:

• A discussion of how user story mapping relates to threat modeling

• Experimentation with using story maps in threat modeling

Outcomes

• A summary of how user story mapping can work for threat modeling, and how to get started

• A comparison with more traditional approaches to threat modeling

References