Release: Microsoft Threat Analysis & Modeling 2.0

Threat Analysis & Modeling is one of that free tools you letting you think Microsoft could do incredible things in security.

Threat modeling is an analysis process aimed to identify characteristics of an application and potential threats they are exposed to.
And, as I already said during beta, this new version perform the task in an impressive way.

Here some of the new features:

• TreeView Navigation with visibility to all nodes at all times


• Wizard based threat model creation


• Default Attack library with descriptive countermeasure guidance


• Automatic Threats and Use Cases generation


• Consolidated Call Flow (System Flow), Attack Surface, Threat Tree are some of the few visualizations available, which can all be exported to Visio


• Exportable Analytics and Reports to HTML


• Import 1.0 Threat Model


• Export countermeasures and attack test cases to Visual Studio Team Foundation Server (TFS)


• Import SDM Deployment Reports from VSTA


• Copy Paste and Drag-&-Drop features


• Enhanced Find Feature

The new wizard is surely the most notable improvement, helping you defining all application aspects, from users to services, from data to components, from business objectives to relevancies, at a very deep level of detail:


Microsoft has also been so smart to create a whole video series to introduce you the tool:

• What is Microsoft Application Threat Modeling


• Creating a Threat Model - Define Application Requirements


• Creating a Threat Model - Define Application Architecture


• Creating a Threat Model - Model


• Creating a Threat Model - Assimilation


• Creating a Threat Model - Measure

Check the development team blog here and obviously download the tool here.


Meanwhile I still wonder if I could have something similar for network security. Microsoft are you listening?