Tag Info

New answers tagged

2

You're right that the Microsoft tooling is aimed at developers. When we developed the v3 SDL tool, we wanted to focus in on what the developer would likely know about. Managing jurisdiction is a requirement that's going to come from somewhere else. So to your question 1, the current Microsoft threat modeling tooling focuses on developers and prioritizes ...


0

Microsoft had the wrong terminology when using the word "threat" in "threat modeling". Cigital replaced this incorrect terminology with "Architectural Risk Analysis", which is a much better description. The best model for working with risk analysis is Factor Analysis of Information Risk (FAIR). One only then needs to apply the concepts to app development or ...


0

A lot of confusing terms and language here. For correct information risk language, please consider FAIR, or Factor Analysis of Information Risk The terminology "Threat modeling" was correctly replaced by Cigital with the term "Architectural Risk Analysis". Using `threat' here is especially incorrect. Risk assessment (e.g., OCTAVE, OCTAVE Allegro) is also ...


1

Your drawing above is kind of a mix of activities, states, and actors, but not of hardware systems or network interconnections. I'd start by modeling the system, not the threats. Perhaps consider creating a UML Communication Diagram showing each of the devices. Then you can start filling in details how data flows from system to system, and how each is ...



Top 50 recent answers are included