The Microsoft SDL Threat Modeling Tool

Threat modeling is a core element of the Security Development Lifecycle

As part of the design phase of the Security Development Lifecycle (SDL), threat modeling allows software architects to identify and mitigate potential security issues early, when they are relatively easy and cost-effective to resolve. Therefore, it helps reduce the total cost of development.

The SDL Threat Modeling Tool is not just a tool for security experts

The SDL Threat Modeling Tool is the first threat modeling tool which isn't designed for security experts. It makes threat modeling easier for all developers by providing guidance on creating and analyzing threat models.

The SDL Threat Modeling Tool enables any developer or software architect to:

• Communicate about the security design of their systems
• Analyze those designs for potential security issues using a proven methodology
• Suggest and manage mitigations for security issues

The SDL Threat Modeling Process

Capabilities and innovations of the SDL Threat Modeling Tool

The SDL Threat Modeling Tool plugs into any issue-tracking system, making the threat modeling process a part of the standard development process.
Innovative features include:

• Integration: Issue-tracking systems
• Automation: Guidance and feedback in drawing a model
• STRIDE per element framework: Guided analysis of threats and mitigations
• Reporting capabilities: Security activities and testing in the verification phase

The unique methodology of the SDL Threat Modeling Tool

The Microsoft SDL Threat Modeling Tool differs from other tools and approaches in two key areas:

• It is designed for developers and centered on software
  Many threat modeling approaches center on assets or attackers. In contrast, the Microsoft Security Development Lifecycle's (SDL) approach to threat modeling is centered on the software. This new tool builds on activities that all software developers and architects are familiar with - such as drawing pictures for their software architecture.
• It is focused on design analysis
  The term "threat modeling" can refer to either a requirements or a design analysis technique. Sometimes, it refers to a complex blend of the two. The Microsoft SDL approach to threat modeling is a focused design analysis technique.

Some resources to get started with the SDL Threat Modeling Tool

• Watch a 5 minute demo of the SDL Threat Modeling Tool:

• Let Adam Shostack and Michael Howard walk you through the tool. Click here to see the 23 minute video.
• Getting started with the SDL Threat Modeling Tool - Follow Deb (a developer), Paul (a program manager), and Tim (a tester) through the process of developing their first threat model.
• Uncover Security Design Flaws Using the STRIDE Approach – Learn how to uncover and mitigate security design vulnerabilities using the STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service, Elevation of privileges) model.
• For more information and resources, visit the Threat Modeling section of the SDL Training and Resources page.
• If you want to discuss how to develop more secure applications by using the SDL Threat Modeling Tool, visit our Microsoft SDL Threat Modeling Forum.