Skip to content

Commit a19fb0c

Browse files
committed
Line edits3
1 parent 576d5a0 commit a19fb0c

File tree

3 files changed

+9
-8
lines changed

3 files changed

+9
-8
lines changed

learn-pr/azure/tm-use-recommended-tools-to-create-a-data-flow-diagram/includes/2-threat-modeling-tool.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22

33
The Microsoft Threat Modeling Tool, recognized by the threat-modeling community, helps engineers create data-flow diagrams. It offers customizable templates and a threat-generation engine with threats and risk-reduction strategies.
44

5-
The default template is called "SDL TM Knowledge Base" and gives you a basic set of elements and threat-generation capabilities. All you need is a basic understanding of data-flow diagrams and STRIDE.
5+
The default template is called *SDL TM Knowledge Base* and gives you a basic set of elements and threat-generation capabilities. All you need is a basic understanding of data-flow diagrams and STRIDE.
66

77
### STRIDE
88

9-
STRIDE is a model that categorizes security threats to help identify. The Microsoft Threat Modeling Tool helps apply STRIDE for threat-modeling work. STRIDE is the acronym for the six major threat categories:
9+
STRIDE is a model that categorizes security threats to help identify them. The Microsoft Threat Modeling Tool helps apply STRIDE for threat-modeling work. STRIDE is the acronym for the six major threat categories:
1010

1111
- **Spoofing**: Pretending to be someone or something else.
1212
- **Tampering**: Changing data without authorization.
@@ -15,11 +15,11 @@ STRIDE is a model that categorizes security threats to help identify. The Micros
1515
- **Denial of service**: Overwhelming the system.
1616
- **Elevation of privilege**: Having permissions I shouldn't have.
1717

18-
You can customize the template across the areas we'll discuss next, which are stencils, threat properties, and risk reduction strategies.
18+
With this in mind, you can customize your template across the areas we'll discuss next in stencils, threat properties, and risk reduction strategies.
1919

2020
### Stencils
2121

22-
Stencils are made up of parent stencils that include process, external interactor, data store, data-flow, and trust boundaries. They can be dragged and dropped onto your canvas to build your data-flow diagram.
22+
Stencils are made up of parent stencils that include process, external interactor, data store, data-flow, and trust boundaries. They can be drag-and-dropped onto your canvas to build your data-flow diagram.
2323

2424
:::image type="content" source="../media/parentstencils.jpg" alt-text="Screenshot of Parent Stencils." loc-scope="other":::
2525

@@ -67,14 +67,14 @@ Then in the User view, the Threat Modeling Tool users see changes whenever they
6767

6868
This section is the heart of the threat modeling tool. The threat-generation engine looks at individual and connected elements to decide which threats to generate.
6969

70-
Step 1 specifies sources and targets. The threat-generation engine uses simple sentences to generate a threat. Examples include *target is [element name]* and *source is [element name]*. You can also use the element name on titles and descriptions. The format is *{target.Name}* or *{source.Name}*.
70+
**Step 1 specifies sources and targets**. The threat-generation engine uses simple sentences to generate a threat. Examples include *target is [element name]* and *source is [element name]*. You can also use the element name on titles and descriptions. The format is *{target.Name}* or *{source.Name}*.
7171

72-
Step 2 combines sources and targets. You can be precise with the way a threat is generated. Combine targets, sources, and their individual properties with AND/OR operators. Examples include:
72+
**Step 2 combines sources and targets**. You can be precise with the way a threat is generated. Combine targets, sources, and their individual properties with AND/OR operators. Examples include:
7373

7474
- target.[property name] is 'Yes' **AND** source.[property name] is 'No'
7575
- flow crosses [trust boundary name]
7676

77-
Step 3 generates or ignores threats. The threat-generation engine uses two fields to generate or ignore a threat:
77+
**Step 3 generates or ignores threats**. The threat-generation engine uses two fields to generate or ignore a threat:
7878

7979
- **Include**: A threat is generated if sentences added in this field are true.
8080
- **Exclude**: A threat isn't generated if sentences added in this field are true.

learn-pr/azure/tm-use-recommended-tools-to-create-a-data-flow-diagram/includes/3-visio.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Microsoft Visio is recognized for its robust set of features to help anyone create quality flowcharts and data-flow diagrams. Visio tools help you visualize how an application or systems is organized towards threat modeling.
22

3-
You can use to create flowcharts, basic network diagrams, Venn diagrams, block diagrams, and business matrices. All while being able to start quickly and in a collaborative manner. Let's look at some other pros to using Visio and review any cons.
3+
You can use Visio to create flowcharts, basic network diagrams, Venn diagrams, block diagrams, and business matrices. All while being able to start quickly and in a collaborative manner. Let's look at some other pros to using Visio and review any cons.
44

55
## Pros
66

learn-pr/azure/tm-use-recommended-tools-to-create-a-data-flow-diagram/index.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ metadata:
77
author: rodsan
88
ms.author: rodsan
99
ms.topic: module
10+
ms.service: threat-modeling
1011
title: Use recommended tools to create a data-flow diagram
1112
summary: You can use any canvas, physical or virtual, to create a data-flow diagram. Engineers at Microsoft recommend a few tools to help you in your threat modeling journey.
1213
abstract: |

0 commit comments

Comments
 (0)