Question

Provide a 500-word report on the at least two (2) tools and techniques that you can use to manage a threat modeling. For each, you must provide the following:

1. Provide the tool/technique name
2. Describe the tool/technique
3. Provide advantages/disadvantages of using tool/technique

Answer 1

IriusRisk is one of the threat modelling tool that offers both the use on two hands, first on the community perspective and second a commercial version of the tool. The main notion of the tool is to focus on the development and the overall maintenance of a live running Threat Model throughout the entire Software development life cycle. IriusRisk drives the process by using various risk pattern libraries. It also helps in connecting with other several other different tools examples, OWASP ZAP,Threadfix, etc mainly to empower automation system.

Advantages : It creates a threat model and it also derives various security requirements within few minutes using a simple and straightforward questionnaire based system. It reduces the time and the overall resources required to process and perform the risk analysis and threat modelling method. It manages security risks throughout the entire Software Development Life Cycle by choosing an appropriate risk-response and also by synchronizing various security requirements with suitable issue trackers.

Microsoft’s free threat modeling tool – It was formly known as Microsoft Free SDL Threat Modeling tool. The methodology of this tool is DFD-based. The tool helps in identifying threats based on the "STRIDE" threat classification scheme, primarily for general use. The tool makes the threat modelling process easier for the developers by guiding during its creation and while analyzing of threat models.

Advantages : The main function of any threat Analysis and any threat Modeling tool is to identify all the threats, during the process of defining the functionality of a security strategy. Even if you don't have enough knowledge in this field, you can consistently,subjectively and objectively identify all threats to any of your software application.

Disadvantages: Generated trees are very big and it cannot be visualized and displayed properly on a general computer monitor. This Threat Modeling tool is not as much as intuitive to use like modelling tools like, Microsoft SDL tool, which focuses on the use of DFD in its modelling components and their interactions.