Microsoft, can you please cross-breed TAM and your internal TM tools

Been very busy lately. Had no chance to blog, or have any sense of order and time for myself.

Last week was RSA Conference, as well as The Microsoft Strategic Architects Summit. This week its the Microsoft MVP summit in Seattle. Then to Dallas for the SMB Summit before finally heading home.

In the midst of all this, I wanted to make sure I got this thought down for fellow developers who design secure softwrae. Currently at the MVP Summit I am seeing a TONNE of stuff inside of Microsoft that I obviously can't talk about due to NDA disclosure. But I wanted to say one thing without breaching the essence of the protection document:

Microsoft, you need to cross-breed TAM and your own SDLC threat modeling tool. That thing is just wicked.

For those that don't know, Microsoft does NOT use the threat modeling tool produced by their ACE team. Instead, they use their own internal tool, which I am not sure I am even allowed to mention by name. But it makes sense; the SDLC is much different than SDL-IT. A picture taken from the ACE TAM blog could help with that.

I am a fan of TAM, but hate that I cannot easily design my own data flow diagrams. There is too much focus on entering in critical components like use cases before the DFD is laid out. The MS internal tools isn't like that. I can't really go into details, but lets just say they figured out how to layout a DFD right. It's not just a simple Visio shape template like we are used to. There are rules and collection points that can be quite useful.

So Microsoft, when would you like me to babysit that abomination? I'd love to see the two tools converge. Anyone else think so too? Let Microsoft know.