In the previous article (i.e., Set 1) we have discussed about the introduction of Microsoft threat modelling Tool- from where to download the tool, steps to install the tool, components available for modelling the system using Data Flow Diagram.
In this article we will be discussing the list of attributes for each element and the values of these attributes that are available to the user.

Properties for Processes –

Properties for Data Store –

Properties for External Interactor –

Properties for DataFlow –

Note – Asterisk (*) means the attribute values are non modifiable.

Apart from above discussed three main panes. there are three more important options:

1. Threat Model Information –
   You can select this dialog from the FILE Menu. This helps user to add basic information about the threat model in order to establish the risk of the component. It includes following questions:
   • Threat Model Name
   • Owner
   • Contributers
   • Reviewer
   • High Level System Description
   • Assumptions
   • External Dependencies
   • Title
   • Version
2. Messages –
   You can select this dialog from the VIEW Menu. This allows to identify warnings, errors or inconsistencies in the knowledge base.
3. Notes –
   This dialog is also available from VIEW Menu. This is not counted during threat generation or analysis. Notes are basically the comments recorded during model discussion.

For the sample I have chosen the Online Shopping System for the DFD Generation and Consequent threat analysis.
There are three entities in the system:

1. Administrator: Its job is to login, make changes to credentials of Administrator Account, Add product details, Update Product Details.
2. Customer: Responsibilities include login, handle its account, search product, purchase product
3. Sales Manager: It performs following operations in the system – Login, Modify Sales Account.

Thus there are 3 external interactors, 8 processes, 6 Data Stores and 34 Data Flow. I am attaching a snapshot of how DFD looks in the Microsoft Threat Modelling tool and also the original DFD for reference.

DFD in Microsoft Threat Modelling Tool –

Original DFD –

Please note this is just a sample system not a actual functioning system so the understanding of the system and inclusion/ exclusion of process/ external interactors/ data flows/ data stores vary from person to person.
In the next article we will see how to generate threat report for the sample system.