The process of threat modeling is built on a simple principle: To build a feasibly secure system, one must understand all the threats in that system. The challenge, however, is in making threat modeling more accessible to non-specialists. Microsoft has developed a process through which minimal input can produce a feature-rich threat model that identifies a wide range of critical information including contextual threats, trust boundaries, fracture points, attack surfaces, and direct and transitive access control. This podcast describes and demonstrates this threat modeling process, outlines its benefits, and shows how threat modeling fits into the Microsoft Security Development Lifecycle.

Download & Listen