April 16, 2008

Microsoft, can you please cross-breed TAM and your internal TM tools

Been very busy lately. Had no chance to blog, or have any sense of order and time for myself.

Last week was RSA Conference, as well as The Microsoft Strategic Architects Summit. This week its the Microsoft MVP summit in Seattle. Then to Dallas for the SMB Summit before finally heading home.

In the midst of all this, I wanted to make sure I got this thought down for fellow developers who design secure softwrae. Currently at the MVP Summit I am seeing a TONNE of stuff inside of Microsoft that I obviously can't talk about due to NDA disclosure. But I wanted to say one thing without breaching the essence of the protection document:

Microsoft, you need to cross-breed TAM and your own SDLC threat modeling tool. That thing is just wicked.

For those that don't know, Microsoft does NOT use the threat modeling tool produced by their ACE team. Instead, they use their own internal tool, which I am not sure I am even allowed to mention by name. But it makes sense; the SDLC is much different than SDL-IT. A picture taken from the ACE TAM blog could help with that.

I am a fan of TAM, but hate that I cannot easily design my own data flow diagrams. There is too much focus on entering in critical components like use cases before the DFD is laid out. The MS internal tools isn't like that. I can't really go into details, but lets just say they figured out how to layout a DFD right. It's not just a simple Visio shape template like we are used to. There are rules and collection points that can be quite useful.

So Microsoft, when would you like me to babysit that abomination? I'd love to see the two tools converge. Anyone else think so too? Let Microsoft know.

Posted by SilverStr at April 16, 2008 12:35 AM | TrackBack

Hi Dana,

For clarification all LOB apps built in MSFT use the TAM tool, the product teams use something different.

I own the TAM tool. Drop me a note offline and lets talk about what you want us to do. No promises but I am sure we can move this in the way you are suggesting!

Posted by: Mark Curphey at April 16, 2008 09:29 AM

Hey Mark,

I'll do that. Thanks for being open enough to explore this. Wish I could have met you on campus today when I was there.

Posted by: Dana Epp at April 17, 2008 12:10 AM