SecureFlag ThreatCanvas for Azure
Threat model your features with AI-powered tooling.
The SecureFlag ThreatCanvas plugin helps you integrate security early in your development lifecycle by automatically generating threat model diagrams from your Azure Boards work item descriptions.
Developers can customize these diagrams to address the unique security challenges of their applications. A security-first approach to application development has never been easier.
Installation
Access the app via Visual Studio Marketplace.
Click the Get it free button. From there, select the organization on which to install the plugin and click Install.
The plugin is available for free.
Admin Settings
Azure DevOps administrators can configure the app to use a Custom ThreatCanvas URL.
Accessing the Configuration
- From the Azure DevOps organization home page, select Organization Settings (gear icon on the bottom left).
- In the left pane, under Extensions, select ThreatCanvas Configuration.
Configuration Options
Custom URL Settings
Admins can configure a custom URL for ThreatCanvas:
- Enable Custom URL: Toggle on to allow the use of a custom ThreatCanvas URL.
- ThreatCanvas Custom URL: Enter the full URL (including protocol).
Saving the Configuration
After making changes, click Save to apply the settings.
Usage
Navigate to the ThreatCanvas tab on the work item describing a feature.
Click on Launch, and you will be prompted to log in to your SecureFlag account. Optionally, you may include the parent or child work items in the ThreatCanvas context by selecting them from the Additional Work Item dropdown before launching.
Example Additional Work Items Selection:
That’s it! A threat model diagram will be generated automatically based on the description of the current work item and any additional work items you selected. You can now explore and refine the diagram as needed.
For example:
The work item description above generated the following threat model:
Approve Work Items (Read) Permission
The plugin requires the Work items (read) permission to enable the additional issues selection feature.
Note: For versions earlier than 1.2.0, an admin must authorize this permission to update the plugin to the latest version. If you have administrative privileges, follow these steps to authorize and update the plugin:
- Go to Organization settings > Extensions (under General).
- Locate the SecureFlag ThreatCanvas plugin banner, which should display Pending review.
- Click Review on the message: "SecureFlag ThreatCanvas is requesting authorization of new scopes".
- In the authorization window that appears, click Authorize.
Once authorized, the plugin will automatically update to the latest version with the required permissions.
Feedback
Got a new feature in mind? Something not working quite right? We genuinely want to hear from you! Please reach out using our contact form.