Management No Comments

1. Determine if the threat requires mitigation and categorize the mitigation by selecting one of the following options from the Threat Status dropdown list. 6. Not Started 6. Needs Investigation 6. Not Applicable 6. Mitigated

Reviewing Threats
The threat list is sortable and filterable. You can click on any column header in the threat list to sort by that column. You can click on the triangles on the column headers to filter as many columns as you like. The clear filters button at the bottom of the threat list will clear any filters. You can drag column headers to reorder them and right click column headers to hide or view them.

Figure 7 Filter the Threat List

Finish and Create a Report
After all threats have been addressed, finish your threat model:

1. If you have not done so already, enter general information about the threat model by selecting Threat Model Information from the main menu. This information includes:

a) Review participants

b) A brief description

To save the model, select File >Save As.

To create a report, select Reports >Full Report.

Figure 8 Sample Threat Modeling Report

Opening an Existing Threat Model
1. Start TMT, and from the Start screen, select the model you want under Recently Opened Models. If the model is not shown, select Open A Model and browse to the file.

1. To update the model, follow the steps described in “Creating a New Threat Model”.

Figure 9 Initial screen showing Recently Opened Models selected

Converting Previous Threat Models to latest Format
You can convert your previous versions threat models to newer format.

If previous threat model is based on TMT 2014 (.tm4)

1. Click on Open A Model on Home Page screen

1. Select your .tm4 file after expanding file type drop down on file selection dialog box

Figure 10 Select .tm4 file

TMT will automatically convert .tm4 file to .tm7 file.

Save the file from File->Save (Save As) menu items.

Note: Your converted diagram may not look exactly the same as the original diagram, but all the elements should be present and connected correctly. Automatic threat generation is disabled for converted threat models. However, you can enable automatic threat generation through the Settings menu.

Overview of Template
The Template specifies the set of elements, attributes, and threat definitions used by the Threat Modeling Tool to create threat models. Most of the time default template shipped with TMT is sufficient to analyze threats for your products however sometime depending upon your product requirements e.g. online services often also need to consider the business impact and privacy implications of the data managed by the service. In this case default template is not sufficient and new template is needed. Open template can be used to edit an existing template and new template can be used to create an altogether new template. In order to create threat models which are based on template created by you, use Browse button from home page to select required template.

Creating a New Threat Template
This section describes the steps to create a new template.

1. Start the Threat Modeling Tool and from the Home screen click Create New Template.

1. Template Information dialog box pops up. Fill Title which you need for template and also version number for your template in Title and Version fields respectively.

Figure 12 Template Information

Click Ok on Template Information dialog box. This brings up Template Editor which you can use to create Stencils, Threat Properties, Threat Categories and Threat Types. During the template creation process, if some error occurs, message for the same will appear in Message tab.

Figure 13 Template Editor

Creating a Stencil
Stencils are the basic building blocks for creating threat models. Stencils tab can be used to create two types of stencils namely Stencils and Derived Stencils. These stencils will show up in the stencil pane of threat model window while creating threat model.

1. Click the Add Stencil button at the top of the Stencils tab to create a Stencil. A new stencil gets created with a default name New Stencil. Modify the name as per your requirements.

Figure 14 Stencils Tab

Choose Image for the stencil.

Choose Image Location for Image. This location will be used to display image while creating threat model.

Assign Behavior and Shape for the stencil.

Define Width and Dash attributes of Stencil.

Define Properties and Values for each property for stencil by clicking Add Property button below the name of the stencil.

Optionally you can create Derived Stencils. Click on a Stencil and click the Add Derived Stencil button at the top of the Stencils tab.

The derived stencils inherit properties of the parent. Additionally Standard Stencils can define their own properties.

Figure 15 Standard Elements

You can reorder properties and properties values.

Creating Custom Columns
By default Threats have Description, Short Description, Justification, Interaction and Priority columns. If you click on Threat Properties tab, these rows are shown greyed out except Priority column since these cannot be modified. These properties will appear as columns in the threat list and threat properties panes in the analysis view of the threat model unless you have marked them as hidden.

Figure 16 Threat Properties

1. You can add custom threat properties by clicking on Add Property button on the Threat Properties page. The system creates a new custom threat property with the name New Threat Property.

1. You can modify the name by clicking on the Name field and modifying it. Name is compulsory and can’t be empty.

1. There are two types of threat properties. One is Text and the other is List. The Text type is used when the property takes just one value. The List type is used when the property can take any one of the multiple values present in the list.

1. The Type is by default set to Text. If you select Text then value field gets disabled. This is because the actual value will be given when the property will be used while defining a new threat type.

1. If you don’t want to show this threat property as column in Threat List in threat model, choose Is Hidden as selected.

1. When the type is set to List, the user can add property values by clicking the Add Value button. By clicking the Delete Value button, one is able to delete property values.

Comments are closed.

Open chat
Whatapp Us
Hey? You want your project done, Whatsapp us Now.
Click to Submit a Project