# Threat modelling a data flow with STRIDE

A threat model starts with a drawing: the people and systems, the data that flows between them, and the boundaries the data crosses. This post draws ACME's data flow in OWASP Threat Dragon, a free threat modelling tool, and then goes through the elements and flows one at a time with STRIDE. The result is a list of threats with a control for each, which developers, testers and auditors all work from.

Read it on keibisoft.com: [Threat modelling a data flow with STRIDE](https://keibisoft.com/blog/threat-modelling-a-data-flow-with-stride.html)

Part of the series [Building a security program for a growing company](https://keibisoft.com/blog/security-program.html).