Is ETSI TVRA TS 102 153 165-1 a risk assessment tool or threat modeling tool? And what's the justification? The purpose of the question is to be able to answer if TVRA is suitable to be mapped to Microsoft's SDL and at which practice ("PRACTICE #4: PERFORM SECURITY AND PRIVACY RISK ASSESSMENTS" from the Requirement phase or "PRACTICE #7: USE THREAT MODELING" from the Design phase).
closed as unclear what you're asking by techraf, S.L. Barth, Steffen Ullrich, Iszi, M'vy Sep 7 '16 at 8:19
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
For purposes of mapping to Microsoft's SDL, this is closer to how we* talked about threat modeling. I'm unsure of the purpose of this document, which looks like it took a lot of work, but at a skim, it's unclear why that work was done.
- we = the MS SDL team, of which I was a member from 2006-2010, responsible for threat modeling and other bits.