Threat modelling a data flow with STRIDE
Draw the data flow in OWASP Threat Dragon, then go through each element and flow with STRIDE: the boundary, the data, each threat and its control.
A threat model starts with a drawing: the people and systems, the data that flows between them, and the boundaries the data crosses. This post draws ACME's data flow in OWASP Threat Dragon, a free threat modelling tool, and then goes through the elements and flows one at a time with STRIDE. The result is a list of threats with a control for each, which developers, testers and auditors all work from.
Read it on keibisoft.com: Threat modelling a data flow with STRIDE
Part of the series Building a security program for a growing company.
Comments
Join the discussionNice walkthrough. One thing worth adding when applying STRIDE to a data flow: the trust boundary does most of the work. Threats cluster where data crosses a boundary you don't control (client to server, service to third party), so enumerating boundaries first and then running STRIDE per crossing keeps the exercise bounded instead of combinatorial. Also, repudiation is the letter teams most often wave away - concretely it's just 'do you have logs that would survive a dispute', and it usually folds into tampering controls like append-only audit logs. Treating it as a logging requirement rather than an abstract threat makes the output actionable.
Building a security program for a growing company
A series on building, running and improving a security program, following one company from webshop to public sector supplier, for founders and engineers. The full chapters are on keibisoft.com: https://keibisoft.com/blog/security-program.html
