A threat model starts with a drawing: the people and systems, the data that flows between them, and the boundaries the data crosses. This post draws ACME's data flow in OWASP Threat Dragon, a free threat modelling tool, and then goes through the elements and flows one at a time with STRIDE. The result is a list of threats with a control for each, which developers, testers and auditors all work from.
Read it on keibisoft.com: Threat modelling a data flow with STRIDE
Part of the series Building a security program for a growing company.
