9. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising: receiving application modeling data in a user interface, the application modeling data defines a business application including one or more business application components, and one or more use cases, a use case includes a list of business application calls, a business application call in a given one of the use cases identifies a caller, first data affected by the call, an action taken by the caller with respect to the first data, and at least one of the components affected by the action of the caller; converting, by a threat modeling application, the list of business application calls for each use case into allowed actions of the callers with respect to the first data and the components for the use case; automatically generating threat information derived from the allowed actions of the callers and an attack library, the automatically generating threat information includes generating one or more threats for each call in each use case; and generating a threat model associated with the business application.
9. One or more processor readable storage devices having processor readable code embodied on said processor readable storage devices, said processor readable code for programming one or more processors to perform a method comprising: receiving application modeling data in a user interface, the application modeling data defines a business application including one or more business application components, and one or more use cases, a use case includes a list of business application calls, a business application call in a given one of the use cases identifies a caller, first data affected by the call, an action taken by the caller with respect to the first data, and at least one of the components affected by the action of the caller; converting, by a threat modeling application, the list of business application calls for each use case into allowed actions of the callers with respect to the first data and the components for the use case; automatically generating threat information derived from the allowed actions of the callers and an attack library, the automatically generating threat information includes generating one or more threats for each call in each use case; and generating a threat model associated with the business application. 13. One or more processor readable storage devices according to claim 9 , further comprising: determining un-allowable actions based on the allowed actions, wherein the determining un-allowable actions includes determining an unauthorized disclosure that is a variation of one of the allowed actions.