MSDN Magazine - January 2009 - (Page 99)

ADAM ShoSTAck Security BriefS Getting Started With The SDL Threat Modeling Tool In November 2008, Microsoft announced the to our Web server—the circle is any running Diagram general availability of the Security Developcode, and the arrow gives us the direction of ment Lifecycle (SDL) threat modeling tool as a communication. The Web server is consulting a free download from MSDN (see microsoft.com/sdl database, which, just as with anywhere we store for details). This column follows a team through data, is two parallel lines. The system is called a Identify Validate the process of getting started with the SDL threat data flow diagram (DFD). There’s a good WikiThreats modeling approach and shows you how to use pedia article on DFDs at en.wikipedia.org/wiki/Data_ the new tool to develop great threat models as flow_diagram. The only bit that’s not covered there a backbone of your security process. is these trust boundary dotted lines between Mitigate This column isn’t a primer on SDL threat modwhere different people are in control. For exeling. For that, see the article I co-authored in ample, you know the IT pros require that we the November 2006 issue of MSDN Magazine Figure 1 The Threat Modeling use their Active Directory system for logon inon using the STRIDE approach, “Threat Mod- Process formation, and so the Active Directory is shown eling: Uncover Security Design Flaws Using the as outside our control.” STRIDE Approach” (msdn.microsoft.com/magazine/cc163519). Figure 1 When the tool starts, the diagram screen is displayed. This is provides a quick overview of the process. where Paul used the Visio tools and the provided stencil to draw his DFD (see Figure 4). Even though this was his first time, he was Starting the Threat Modeling Process comfortable because the validator on the left gave him feedback, When you launch the SDL threat modeling tool, you’ll see that based on his experience using threat modeling as part of the SDL. the lower left-hand corner looks quite a bit like Microsoft Office As he found himself drawing more complexity, he added additional Outlook with four screens: diagram, analyze, environment, and re- details by right-clicking on the context folder in the upper- right ports (see Figure 2 for details). Note that these screens are slight- and was able to create a complex, layered diagram. ly different from the outline shown in Figure 1 because it makes Figure 2 Threat Modeling Tool Screens sense to consider threats and mitigations together since they are Screen Description closely related. Diagram Use this screen to draw the architecture of your In this section, I will follow Deb (a developer), Paul (a program software. manager), and Tim (a tester) through the process of developing their Analyze The center for analysis of the model, where you use first threat model, and I’ll also discuss each screen of the tool. STRIDE/element to find each threat and figure out how “Hi Deb, I’ve been working on that threat model diagram, and to mitigate it. wanted to walk through it with you to make sure we’ve gotten the Environment Allows you to track project information, such as details right.” dependencies. “Sure thing, Paul! Come on in.” Reports Brings out all the data you’ve entered in a variety of Paul brings out a print-out of a diagram that he’s already made useful forms. from the threat model tool’s “Diagrams only” report, shown in Figure 3. “Paul, I haven’t seen these diagrams before. It looks pretty simple, but can you walk me through what the different shapes mean?” “The way this works is Carl, our normal customer persona, is drawn as an outside entity—a rectangle. He’s sending commands Send your questions and comments to briefs@microsoft.com. Figure 3 Paul’s DFD Diagram January 2009 99 http://www.microsoft.com/sdl http://en.wikipedia.org/wiki/Data_flow_diagram http://en.wikipedia.org/wiki/Data_flow_diagram http://msdn.microsoft.com/magazine/cc163519

Table of Contents Feed for the Digital Edition of MSDN Magazine - January 2009

Toolbox CLR Inside Out Basic Instincts Cutting Edge Test Run First Look� Geneva Framework Silverlight Windows Mobile Service Station Security Briefs Extreme ASP.NET Foundations .NET Matters { End Bracket }

MSDN Magazine - January 2009

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.