Threat modeling in software engineering has been in the past a real amorphous topic for me. I understand, and am specifically involved, with security and code review processes, however, threat modeling can and should begin during your design and architecture to ensure the mitigation of vulnerabilities before code is committed to any repository.
The SDL Threat Modeling Tool has been developed by Microsoft and helps engineers analyze the security of their systems to find and address design issues early in the software lifecycle. The SDL Threat Modeling Tool is not just a tool for security experts but provides a great mechanism for enabling active discussions and visualizations of complex software processes.
The SDL Threat Modeling Tool enables any developer or software architect to:
- Communicate about the security design of their systems
- Analyze those designs for potential security issues using a proven methodology
- Suggest and manage mitigations for security issues
You can download SDL Threat Modeling Tool 3.1.8 here, additionally this document illustrates the core concepts of the Microsoft Security Development Lifecycle (SDL) and discusses the security activities that should be performed in order to follow the SDL process.
Comments are closed.