Since you refer to SDL I assume you know it already, but to have it mentioned here: Microsoft provides a SDL Threat Modelling Tool (http://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx)

OWASP hosts a primer about Threat Risk Modelling (and recommends the use of Microsoft SDL)

And of course NIST has a whole load of docs on this topic, e.g.: http://csrc.nist.gov/publications/nistpubs/800-12/800-12-html/chapter7.html

Since you refer to SDL I assume you know it already, but to have it mentioned here: Microsoft provides a SDL Threat Modelling Tool (http://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx)

OWASP hosts a primer about Threat Risk Modelling (and recommends the use of Microsoft SDL)

And of course NIST has a whole load of docs on this topic, e.g.: http://csrc.nist.gov/publications/nistpubs/800-12/800-12-html/chapter7.html and: http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf