Build: Create the Data Flow Diagram

0/4 steps

✓📚 Read

✓👁 See

✓🎞 Animate

✓🎯 Test

5⚙️ Build

Build Steps

Progress

0/4

◆ Before you start

Prerequisites

Python 3.8+Optional
For PyTM (programmatic threat modeling)
OWASP Threat DragonRequired
Free desktop app or web app
Get it ↗
Architecture diagramRequired
At least a rough sketch of the system being modeled

🗺️

Step 1 of 4

Create the Data Flow Diagram

In OWASP Threat Dragon, draw the Level 1 DFD for a feature you're building. Identify all processes, external entities, data stores, and trust boundaries.

Tasks

Download and install OWASP Threat Dragon

Create a new threat model for a login feature or an API you own

Draw at least: 1 external entity (browser), 1 process (API), 1 data store (DB), 1 trust boundary

Label all data flows with the data type and protocol

🎯 What You'll Learn

▸Understand DFD notation (process, external entity, data store, flow)
▸Identify trust boundaries correctly
▸Focus on data flows that cross trust boundaries

Code

JSONthreat-model-dfd-template.json
1 {
2   "summary": {
3     "title": "Login Feature — Threat Model",
4     "owner": "team@company.com",
5     "description": "User authenticates with email/password, receives JWT",
6     "reviewer": "Security Champion",
7     "date": "2026-08-21",
8     "diagrams": []
9   },
10   "detail": {
11     "contributors": [],
12     "diagrams": [
13       {
14         "id": 0,
15         "title": "Login Flow",
16         "diagramType": "DATA_FLOW",
17         "thumbnail": "",
18         "version": "2.0",
19         "cells": [
20           {
21             "type": "process",
22             "label": "Auth API",
23             "attrs": { "label": { "text": "Auth API" } }
24           },
25           {
26             "type": "actor",
27             "label": "Browser"
28           },
29           {
30             "type": "store",
31             "label": "Users DB"
32           }
33         ]
34       }
35     ]
36   }
37 }

💡 Pro Tips

▸Start with Level 0 (context diagram) before Level 1 (detailed flow)
▸Every data flow crossing a trust boundary MUST be analysed in the next step

Expected Output

DFD with all elements, trust boundaries, and labelled data flows visible in Threat Dragon

Discussion

1 { 2 "summary": { 3 "title": "Login Feature — Threat Model", 4 "owner": "team@company.com", 5 "description": "User authenticates with email/password, receives JWT", 6 "reviewer": "Security Champion", 7 "date": "2026-08-21", 8 "diagrams": [] 9 }, 10 "detail": { 11 "contributors": [], 12 "diagrams": [ 13 { 14 "id": 0, 15 "title": "Login Flow", 16 "diagramType": "DATA_FLOW", 17 "thumbnail": "", 18 "version": "2.0", 19 "cells": [ 20 { 21 "type": "process", 22 "label": "Auth API", 23 "attrs": { "label": { "text": "Auth API" } } 24 }, 25 { 26 "type": "actor", 27 "label": "Browser" 28 }, 29 { 30 "type": "store", 31 "label": "Users DB" 32 } 33 ] 34 } 35 ] 36 } 37 }

1	{
2	"summary": {
3	"title": "Login Feature — Threat Model",
4	"owner": "team@company.com",
5	"description": "User authenticates with email/password, receives JWT",
6	"reviewer": "Security Champion",
7	"date": "2026-08-21",
8	"diagrams": []
9	},
10	"detail": {
11	"contributors": [],
12	"diagrams": [
13	{
14	"id": 0,
15	"title": "Login Flow",
16	"diagramType": "DATA_FLOW",
17	"thumbnail": "",
18	"version": "2.0",
19	"cells": [
20	{
21	"type": "process",
22	"label": "Auth API",
23	"attrs": { "label": { "text": "Auth API" } }
24	},
25	{
26	"type": "actor",
27	"label": "Browser"
28	},
29	{
30	"type": "store",
31	"label": "Users DB"
32	}
33	]
34	}
35	]
36	}
37	}