{"format":"epicdraw-workspace","version":1,"charts":[{"id":"template-threat-model-stride-dfd","name":"Threat model with STRIDE","paper":"white","pattern":"blank","wobble":0.22,"ppm":48,"nodes":[{"id":"threat-model-stride-dfd-n1","type":"lane","text":"","x":0,"y":0,"w":1720,"h":1000,"fill":"none","fst":"solid","seed":701,"font":"sans","fs":22,"bold":false,"lv":0,"lock":true,"z":-20,"ink":"navy"},{"id":"threat-model-stride-dfd-n2","type":"text","text":"Threat model with STRIDE","x":42,"y":24,"w":1620,"h":64,"fill":"none","fst":"solid","seed":702,"font":"hand","fs":48,"bold":true,"lv":0,"align":"left","ink":"navy"},{"id":"threat-model-stride-dfd-n3","type":"text","text":"Draw the data flows of a web app across trust boundaries, then list STRIDE threats and mitigations for each flow.","x":42,"y":96,"w":1620,"h":44,"fill":"none","fst":"solid","seed":703,"font":"sans","fs":23,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"threat-model-stride-dfd-n4","type":"line","text":"","x":42,"y":160,"w":1636,"h":4,"fill":"none","fst":"solid","seed":704,"font":"sans","fs":22,"bold":false,"lv":0,"rot":0,"head":"none","ink":"navy"},{"id":"threat-model-stride-dfd-n5","type":"text","text":"EXAMPLE TEMPLATE · Replace the example content, owners and dates with your own.","x":42,"y":952,"w":1630,"h":30,"fill":"none","fst":"solid","seed":705,"font":"sans","fs":18,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"threat-model-stride-dfd-n6","type":"lane","text":"","x":45,"y":300,"w":260,"h":520,"fill":"none","fst":"solid","seed":706,"font":"sans","fs":22,"bold":false,"lv":0,"z":-2,"dash":true,"ink":"red"},{"id":"threat-model-stride-dfd-n7","type":"text","text":"Trust boundary: Internet","x":55,"y":306,"w":240,"h":30,"fill":"none","fst":"solid","seed":707,"font":"sans","fs":15,"bold":true,"lv":0,"align":"left","ink":"red"},{"id":"threat-model-stride-dfd-n8","type":"lane","text":"","x":330,"y":300,"w":300,"h":520,"fill":"none","fst":"solid","seed":708,"font":"sans","fs":22,"bold":false,"lv":0,"z":-2,"dash":true,"ink":"red"},{"id":"threat-model-stride-dfd-n9","type":"text","text":"Trust boundary: DMZ","x":340,"y":306,"w":280,"h":30,"fill":"none","fst":"solid","seed":709,"font":"sans","fs":15,"bold":true,"lv":0,"align":"left","ink":"red"},{"id":"threat-model-stride-dfd-n10","type":"lane","text":"","x":660,"y":300,"w":440,"h":520,"fill":"none","fst":"solid","seed":710,"font":"sans","fs":22,"bold":false,"lv":0,"z":-2,"dash":true,"ink":"red"},{"id":"threat-model-stride-dfd-n11","type":"text","text":"Trust boundary: Internal network","x":670,"y":306,"w":420,"h":30,"fill":"none","fst":"solid","seed":711,"font":"sans","fs":15,"bold":true,"lv":0,"align":"left","ink":"red"},{"id":"threat-model-stride-dfd-n12","type":"rect","text":"Customer\n(browser)","x":75,"y":500,"w":200,"h":80,"fill":"sky","fst":"solid","seed":712,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"threat-model-stride-dfd-n13","type":"ellipse","text":"Web app","x":370,"y":480,"w":220,"h":110,"fill":"leaf","fst":"solid","seed":713,"font":"sans","fs":18,"bold":true,"lv":0},{"id":"threat-model-stride-dfd-n14","type":"ellipse","text":"API","x":700,"y":480,"w":200,"h":110,"fill":"leaf","fst":"solid","seed":714,"font":"sans","fs":18,"bold":true,"lv":0},{"id":"threat-model-stride-dfd-n15","type":"rect","text":"Customer database","x":700,"y":700,"w":220,"h":64,"fill":"sand","fst":"solid","seed":715,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"threat-model-stride-dfd-n16","type":"rect","text":"Payment provider","x":890,"y":215,"w":210,"h":70,"fill":"sky","fst":"solid","seed":716,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"threat-model-stride-dfd-n21","type":"table","text":"","x":1140,"y":300,"w":535,"h":420,"fill":"sky","fst":"solid","seed":721,"font":"sans","fs":15,"bold":false,"lv":0,"rows":[["Flow","STRIDE","Threat","Mitigation"],["1","S","Stolen password","MFA, rate limits"],["1","I","Traffic sniffed","TLS only, HSTS"],["2","T","Tampered request","Signed tokens, validation"],["2","E","Reaches admin API","Role check on every call"],["3","I","SQL injection","Parameterised queries"],["4","R","Disputed payment","Signed audit log"],["All","D","Request flood","WAF, rate limiting"]]},{"id":"threat-model-stride-dfd-n22","type":"text","text":"S spoofing · T tampering · R repudiation · I information disclosure · D denial of service · E elevation of privilege","x":45,"y":850,"w":1630,"h":30,"fill":"none","fst":"solid","seed":722,"font":"sans","fs":17,"bold":false,"lv":0,"align":"left","ink":"grey"}],"edges":[{"id":"threat-model-stride-dfd-e17","from":"threat-model-stride-dfd-n12","to":"threat-model-stride-dfd-n13","label":"1 Login","seed":717,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"threat-model-stride-dfd-e18","from":"threat-model-stride-dfd-n13","to":"threat-model-stride-dfd-n14","label":"2 API calls","seed":718,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"threat-model-stride-dfd-e19","from":"threat-model-stride-dfd-n14","to":"threat-model-stride-dfd-n15","label":"3 Queries","seed":719,"style":"elbow","head":"end","lv":0,"font":"sans","fs":18,"sa":"b","ea":"t"},{"id":"threat-model-stride-dfd-e20","from":"threat-model-stride-dfd-n14","to":"threat-model-stride-dfd-n16","label":"4 Payment request","seed":720,"style":"elbow","head":"end","lv":0,"font":"sans","fs":18,"sa":"r","ea":"b"}],"strokes":[],"imgs":{}}],"cur":"template-threat-model-stride-dfd"}