Abstract: Evaluating a threat model for structural validity and descriptive completeness. A threat modeling application provides a progress factor or other overall score associated with the structural validity and descriptive completeness of the threat model being evaluated. The structural validity is evaluated based on a data flow diagram associated with the threat model. The descriptive completeness is evaluated by reviewing descriptions of threat types in the threat model. The progress factor encourages modelers to provide effective models to a model reviewer, thus saving time for the model reviewer.

Abstract: Aspects of the subject matter described herein relate to collecting anonymous and traceable telemetry. In aspects, a telemetry source may obtain a certificate or other data from an escrow certificate issuer. The certificate includes information usable by a certificate collector to verify that the certificate is valid, but does not include information usable to identify the telemetry source to the telemetry collector.

Abstract: The subject disclosure is directed towards authentic timing indicators, comprising data (e.g., an animation) that are output to a user to convey security-related information to the user, using timing to call attention to the authentic timing indicators. For example, a browser program may select and output a particular authentic timing indicator based upon whether a connection to a site is unsecure, secure, or secure and the site has an extended validation certificate; an email program may use authentic timing indicators to highlight signed versus unsigned messages. The authentic timing indicator appears before the content is allowed to control the content pane, increasing the difficulty of spoofing a site, or email message.

Abstract: Aspects of the subject matter described herein relate to collecting anonymous and traceable telemetry. In aspects, a telemetry source may obtain a certificate or other data from an escrow certificate issuer. The certificate includes information usable by a certificate collector to verify that the certificate is valid, but does not include information usable to identify the telemetry source to the telemetry collector.

Abstract: Evaluating a threat model for structural validity and descriptive completeness. A threat modeling application provides a progress factor or other overall score associated with the structural validity and descriptive completeness of the threat model being evaluated. The structural validity is evaluated based on a data flow diagram associated with the threat model. The descriptive completeness is evaluated by reviewing descriptions of threat types in the threat model. The progress factor encourages modelers to provide effective models to a model reviewer, thus saving time for the model reviewer.

Abstract: Identifying threats to an information system by analyzing a structural representation of the information system. In some embodiments, a data flow diagram corresponding to the information system is analyzed based on predefined criteria. Potential threats to elements of the data flow diagram are identified based on the predefined criteria. The threats are prioritized and provided to a user for further testing. In an embodiment, the user performs fuzz testing of application programs in the information system based on the prioritized threats.

Abstract: Excluding selected elements in a data flow diagram from a threat model. The selected elements are marked as informational. An automated threat modeling system generates a threat model report for the elements in the data flow diagram except for the elements marked as informational. Excluding the informational elements from the threat model and threat model report reduces the complexity of the threat analysis and enables a modeler to focus the threat model on elements of interest.

Abstract: In one aspect, the invention relates to automatically providing enhancements to computer security software whenever the enhancement becomes available. In another aspect, the invention relates to an integrated system for assessing security vulnerabilities of a computer and/or a computer network.