You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/azure/tm-use-recommended-tools-to-create-a-data-flow-diagram/includes/2-threat-modeling-tool.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,11 +2,11 @@
2
2
3
3
The Microsoft Threat Modeling Tool, recognized by the threat-modeling community, helps engineers create data-flow diagrams. It offers customizable templates and a threat-generation engine with threats and risk-reduction strategies.
4
4
5
-
The default template is called "SDL TM Knowledge Base" and gives you a basic set of elements and threat-generation capabilities. All you need is a basic understanding of data-flow diagrams and STRIDE.
5
+
The default template is called *SDL TM Knowledge Base* and gives you a basic set of elements and threat-generation capabilities. All you need is a basic understanding of data-flow diagrams and STRIDE.
6
6
7
7
### STRIDE
8
8
9
-
STRIDE is a model that categorizes security threats to help identify. The Microsoft Threat Modeling Tool helps apply STRIDE for threat-modeling work. STRIDE is the acronym for the six major threat categories:
9
+
STRIDE is a model that categorizes security threats to help identify them. The Microsoft Threat Modeling Tool helps apply STRIDE for threat-modeling work. STRIDE is the acronym for the six major threat categories:
10
10
11
11
-**Spoofing**: Pretending to be someone or something else.
12
12
-**Tampering**: Changing data without authorization.
@@ -15,11 +15,11 @@ STRIDE is a model that categorizes security threats to help identify. The Micros
15
15
-**Denial of service**: Overwhelming the system.
16
16
-**Elevation of privilege**: Having permissions I shouldn't have.
17
17
18
-
You can customize the template across the areas we'll discuss next, which are stencils, threat properties, and risk reduction strategies.
18
+
With this in mind, you can customize your template across the areas we'll discuss next in stencils, threat properties, and risk reduction strategies.
19
19
20
20
### Stencils
21
21
22
-
Stencils are made up of parent stencils that include process, external interactor, data store, data-flow, and trust boundaries. They can be dragged anddropped onto your canvas to build your data-flow diagram.
22
+
Stencils are made up of parent stencils that include process, external interactor, data store, data-flow, and trust boundaries. They can be drag-and-dropped onto your canvas to build your data-flow diagram.
23
23
24
24
:::image type="content" source="../media/parentstencils.jpg" alt-text="Screenshot of Parent Stencils." loc-scope="other":::
25
25
@@ -67,14 +67,14 @@ Then in the User view, the Threat Modeling Tool users see changes whenever they
67
67
68
68
This section is the heart of the threat modeling tool. The threat-generation engine looks at individual and connected elements to decide which threats to generate.
69
69
70
-
Step 1 specifies sources and targets. The threat-generation engine uses simple sentences to generate a threat. Examples include *target is [element name]* and *source is [element name]*. You can also use the element name on titles and descriptions. The format is *{target.Name}* or *{source.Name}*.
70
+
**Step 1 specifies sources and targets**. The threat-generation engine uses simple sentences to generate a threat. Examples include *target is [element name]* and *source is [element name]*. You can also use the element name on titles and descriptions. The format is *{target.Name}* or *{source.Name}*.
71
71
72
-
Step 2 combines sources and targets. You can be precise with the way a threat is generated. Combine targets, sources, and their individual properties with AND/OR operators. Examples include:
72
+
**Step 2 combines sources and targets**. You can be precise with the way a threat is generated. Combine targets, sources, and their individual properties with AND/OR operators. Examples include:
73
73
74
74
- target.[property name] is 'Yes' **AND** source.[property name] is 'No'
75
75
- flow crosses [trust boundary name]
76
76
77
-
Step 3 generates or ignores threats. The threat-generation engine uses two fields to generate or ignore a threat:
77
+
**Step 3 generates or ignores threats**. The threat-generation engine uses two fields to generate or ignore a threat:
78
78
79
79
-**Include**: A threat is generated if sentences added in this field are true.
80
80
-**Exclude**: A threat isn't generated if sentences added in this field are true.
Copy file name to clipboardExpand all lines: learn-pr/azure/tm-use-recommended-tools-to-create-a-data-flow-diagram/includes/3-visio.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
Microsoft Visio is recognized for its robust set of features to help anyone create quality flowcharts and data-flow diagrams. Visio tools help you visualize how an application or systems is organized towards threat modeling.
2
2
3
-
You can use to create flowcharts, basic network diagrams, Venn diagrams, block diagrams, and business matrices. All while being able to start quickly and in a collaborative manner. Let's look at some other pros to using Visio and review any cons.
3
+
You can use Visio to create flowcharts, basic network diagrams, Venn diagrams, block diagrams, and business matrices. All while being able to start quickly and in a collaborative manner. Let's look at some other pros to using Visio and review any cons.
Copy file name to clipboardExpand all lines: learn-pr/azure/tm-use-recommended-tools-to-create-a-data-flow-diagram/index.yml
+1Lines changed: 1 addition & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -7,6 +7,7 @@ metadata:
7
7
author: rodsan
8
8
ms.author: rodsan
9
9
ms.topic: module
10
+
ms.service: threat-modeling
10
11
title: Use recommended tools to create a data-flow diagram
11
12
summary: You can use any canvas, physical or virtual, to create a data-flow diagram. Engineers at Microsoft recommend a few tools to help you in your threat modeling journey.
0 commit comments