Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to create a DFD for a threat modeling exercise. How much detail should I get into?

  1. The SDL Threat Modeling guidelines state that I know that my DFD needs more detail when there is still a trust boundary in the DFD. Suppose there is a trust boundary between the datastore A and process B. Since there's a trust boundary, I know the DFD is not detailed enough. How can I go deeper, deep enough that no trust boundary is left? If I drill deeper into the process B and decompose it into smaller parts, will it always be possible to eliminate the trust boundary?

  2. I have CRUD Operations on a database in my dataflow diagram, do I need to create 4 distinct dataflows to accomodate the needs or can I mark the dataflow with "CRUD Operation"?

enter image description here

share|improve this question
    
I don't understand what you are asking. When you say "However, there will always be.... entity?", are you asking a question, or are you making a claim? –  D.W. Apr 15 '13 at 17:36
    
I have added an image to my question. I hope I can clearify my question: When I add more details to the elements of the data flow diagram do I dwelve deeper into the Processes and don't show the 'User','Commands' and 'Response' elements in the Level X DFD anymore? –  theXs Apr 15 '13 at 20:52
    
I still don't understand the sentence/question that says "However, there will always be...entity?". Is that a question? If so, what is the question? Is it a statement? If so, what is the statement, and where is the evidence for it? It is phrased as a statement, but with a question mark at the end, so it's hard for me to interpret what you're getting at with that part of the question. –  D.W. Apr 16 '13 at 1:03
    
Let me rephrase the question :). Lets say there is a Trust Boundary between the datastore A and Process B. Now, the SDL Presentation states that I know the DFD is detailed enough if there is a no Trust Boundary in the DFD. My question is how can I go deeper into other DFD level and omit the Trust Boundary. If I go deeper into the process B can I omit the Trust Boundary which is present on the more general level? –  theXs Apr 16 '13 at 7:37
add comment

1 Answer

Let me try to explain you the DFD in different light; attack trees is a standard and common way of describing a threat. The tree ; depicts different stages that it requires for the threat to be realized, from programing relevance it works just like a tree data structure with parents nodes, child nodes all linked together under a certain context, the context of an attack instance. There are many examples of attack tree on the internet, depending upon the particular threat you want to analyze.

However, now for the question how far ? I say as far it is required to sufficiently realize all the stages that goes in the attack. I see for any DFD there would always be a set of limited inputs and set of transactions states it can go; when you have mapped them all, after that you just have to arrange your actors and trust boundary accordingly.

For e.g for eavesdropping threat analysis two actors must act ; a) listening on network b) comprising end nodes to achieve certain sniffing threat scenario.

Now, in DFD you can further drill down each of these cases as separate user/system interaction scenarios. Here you can write misuse scenarios as explained in OWASP testing guide v3.0

Hope it helps.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.