Open In App

Microsoft Threat modelling tool 2016 | Set 1

Improve
Improve
Like Article
Like
Save
Share
Report

After having a discussion on Threat modelling. Now we are aware of what is threat modelling and what are the two approaches for threat modelling- DFD Based Threat Modelling Set 1, & Set 2 and Process Flow Diagram Based Threat Modelling. 
In this article we will in detail discuss Microsoft Threat Modelling Tool 2016. This tool can: 

  • Can create DFD for products and services
  • Analyse DFD to automatically generate a list of potential threats
  • Suggest potential mitigations to design vulnerabilities
  • Produce reports listing identified and mitigated threats
  • Creates custom templates for threat modelling

Microsoft Threat Modelling Tool applies STRIDE threat classification scheme to the identified threats. 
STRIDE is an acronym for Spoofing, Tampering, Repudiation, Information Disclosure, Elevation of Privilege. 
This tool is free to download and use. 
You can download the tool by following the below mentioned link, from the official Microsoft website: 
Microsoft Threat Modelling Tool 
After downloading the tool, next Run ThreatModelingTool2016.msi and install the tool by just following the steps. 

There are four scenarios available when you run the tool. 

  1. Creating New Threat Model: A new model for the system is created by drawing the diagram. We will be discussing this scenario in detail. By default template for the new model is SDL TM Knowledge Base(Core) (4.1.0.9)
  2. Modifying an Existing Threat Model: Open existing model and analyse threats against your system. One can open the existing model for making changes either by selecting the desired model from the list of recently opened models on the initial screen or by navigating to open option in the file menu.
  3. Create New Template: Define stencils, threat types and custom threat properties for your threat model from scratch.
  4. Modifying Existing Template: Open existing template to make modifications to better suit your specific threat analysis

Click on create NEW MODEL option to get started with the threat analysis. 
The main screen will be featuring three panes: Drawing Canvas, Stencils, Element Properties. 

  • Drawing Canvas: This is the space for the user to draw Data Flow Diagram for the system to be modeled. The recommended process is to begin with a simple diagram and add details to explain the system and show all the trust boundaries. If you use child diagrams, you can extend designs laterally into multiple sheets and expand high level elements into their internal component elements. 

     

  • Stencils: This shows the large set of icons and components that help draw DFD more precisely. Using more specific elements allow the generation of more precise threats. The Stencils pane displays tree view of stencils categorized by Generic Stencils. 

     

Below is the list of elements available: 

  1. Generic Process 
    1. OS Process: It means a windows process.
    2. Thread: Means a thread of execution in windows process.
    3. Kernel Thread: It is a thread of execution in windows kernel.
    4. Native Application: It is representation of Win32 or Win64 Application
    5. Managed Application: It is a representation of .NET Application.
    6. Thick Client: It is a representation of thick client
    7. Browser Client: It is a representation of browser client.
    8. Browser and ActiveX Plugins: It is a representation of browser plugin
    9. Web Server: It is a representation of web server process.
    10. Windows Store Process: It is a representation of windows store process.
    11. Win32 Service: It is a representation of network service.
    12. Web Application: Delivers web content to the user.
    13. Web Service: Exposes a programmatic interface.
    14. Virtual Machine: A virtual machine running on Hyper-V partition.
    15. Application Running on a non Microsoft OS: These are the Microsoft applications running on the OS from Google or Apple.
  2. Generic External Interactor 
    1. Browser: It is a representation of external web browser.
    2. Authorization Provider: It is a representation of an external authorization provider. Example Facebook etc.
    3. External Web Application: It is representation of an external web application (such as a portal or front end) that delivers web content to a human user.
    4. External Web Service: It is representation of an external web service that exposes a programmatic interface.
    5. Human User: It is a representation of human user.
    6. Mega Service: A large service that has only one instance on the Internet, such as Outlook.com or Xbox Live.
    7. Windows Runtime: Represents the point where an application calls into an unmanaged runtime library such as the CRT.
    8. Windows .NET Runtime: Represents the point where an application calls into the .NET Framework.
    9. Windows RT Runtime: Represents the point where an application calls into WinRT.
  3. Generic Data Store 
    1. Cloud Storage: It is a representation of cloud storage.
    2. SQL Database: It is a representation of SQL Database
    3. Non Relational Database: It is a representation of Non Relational Database.
    4. File System: It is a representation of file system.
    5. Registry Hive: It is a representation of registry.
    6. Configuration File: Files such as INF, XML etc.
    7. Cache: It is a representation of local cache
    8. HTML5 Local Storage: It is a representation of HTML5 Local Storage.
    9. Cookies: It is a representation of cookie storage
    10. Device: It is a representation of device storage.
  4. Generic Data Flow 
    1. HTTP: It is a representation of HTTP data flow
    2. HTTPS: It is a representation of HTTP, TLS, SSL data flow
    3. Binary
    4. IPSec: It is a representation of IPSec data flow.
    5. Named Pipe: It is a representation of Named Pipe data flow.
    6. SMB: It is a representation of Server Message Block 1.0 or Server Message Block 2.0 data flow
    7. RPC or DCOM: It is a representation of Remote Procedure call or Distributed COM data flow.
    8. ALPC: Inter-process communication using Advanced Local Procedure Call Port.
    9. UDP: User Data Protocol Transport.
    10. IOCTL Interface: An interface of an application to communicate to device driver.
  5. Generic Trust Line Boundary 
    1. Internet Boundary
    2. Machine Trust Boundary
    3. User Mode or Kernel Mode Boundary
    4. App Container Boundary
  6. Generic Trust Border Boundary 
    1. CorpNet Trust Boundary: It is a border representation of corporate network trust boundary.
    2. Sandbox Trust Boundary Border: It is a border representation of sandbox trust boundary.
    3. Internet Explorer Boundaries: It is an arc representation of Internet trust boundary
    4. Other Browser Boundaries: Describes the types of trust boundaries implemented by Google Chrome and Mozilla Firefox.
  7. Free Text Annotation
  8. Element Properties: The attributes or we can say properties vary from element to element. The only property which is common for all elements is Name which identifies each element and Out of Scope property which means to remove the element and its interactions from the threat generation matrix so that it does not get counted while listing the potential threats. 

Each of these components have certain customizable attributes where each of them have a predefined default value so it is upto the user to set these values or not. 
In the Next article (i.e., Set 2) we will be discussing the list of attributes of each component and how to generate the threat report. 

Here’s some information about the Microsoft Threat Modeling Tool 2016:

What is the Microsoft Threat Modeling Tool 2016?
The Microsoft Threat Modeling Tool 2016 is a free tool designed to help developers and security professionals analyze the security of their applications. It allows them to identify potential security threats and vulnerabilities early in the development process, before the application is released.

What are the benefits of using the Microsoft Threat Modeling Tool 2016?
The Microsoft Threat Modeling Tool 2016 offers several benefits, including:

Early identification of potential security threats and vulnerabilities
Improved security of the application
Better understanding of the security requirements of the application
Improved collaboration between developers and security professionals
How does the Microsoft Threat Modeling Tool 2016 work?
The Microsoft Threat Modeling Tool 2016 uses a graphical interface to allow users to model the application and its potential threats. The user can specify the application’s components, data flows, and trust boundaries, and the tool will generate a threat model based on this information. The user can then analyze the model to identify potential threats and vulnerabilities.

What are the system requirements for the Microsoft Threat Modeling Tool 2016?
The Microsoft Threat Modeling Tool 2016 requires the following system requirements:

Windows 7 or later
.NET Framework 4.6.1 or later
1 GHz or faster processor
1 GB of RAM or more
1 GB of available hard disk space or more
How can I get the Microsoft Threat Modeling Tool 2016?
You can download the Microsoft Threat Modeling Tool 2016 for free from the Microsoft website. Just search for “Microsoft Threat Modeling Tool 2016” and follow the instructions to download and install the tool.
I hope this information helps! Let me know if you have any other questions.



Last Updated : 19 Sep, 2023
Like Article
Save Article
Previous
Next
Share your thoughts in the comments
Similar Reads