Is ETSI TVRA TS 102 153 165-1 a risk assessment tool or threat modeling tool? And what's the justification? The purpose of the question is to be able to answer if TVRA is suitable to be mapped to Microsoft's SDL and at which practice ("PRACTICE #4: PERFORM SECURITY AND PRIVACY RISK ASSESSMENTS" from the Requirement phase or "PRACTICE #7: USE THREAT MODELING" from the Design phase).
For purposes of mapping to Microsoft's SDL, this is closer to how we* talked about threat modeling. I'm unsure of the purpose of this document, which looks like it took a lot of work, but at a skim, it's unclear why that work was done.
- we = the MS SDL team, of which I was a member from 2006-2010, responsible for threat modeling and other bits.