4

I want to create a threat model to guide a security-oriented review on a project. I found the OWASP Threat Dragon and would like to do it in that, but from the documentation and example I am unsure how to use the elements provided.

The diagrams can contain following elements:

  • Actors (represented with boxes)
  • Processes (represented with circles)
  • Storage (represented with over and underline)
  • Data flows (represented with arrows)
  • Trust boundaries (represented with dashed lines)

The latter three seem obvious, but there is an example model and that shows Actor “Browser” and Process “Web App”. I would expect actor to mean user, but then on the other hand what would represent the browser? Or should it be represented at all?

And each function should be a separate process, no? I suppose the component itself does not really need to be represented, though where would I then put cross-process concerns like authorization? Or should I mention them for each and every function?

Improve this question
2

I'm unsure why TD calls those things "actors". I call them "external entities", and as Schroeder says, they can be anything - human or code - outside your control or trust.

You can represent the browser as an external entity. Generally, I don't map past the first external entity because it's all untrusted and who knows what's really there?

If by function, you mean a function in C, then that's probably too detailed and you're not going to gain a lot by representing it. A function like "search" is unlikely to be a helpful granularity - search might have an indexer, a set of things to be indexed, and an index as output, and each of those probably belongs in the threat model.

Improve this answer
2
  • By ‘function’ I mean some high-level functionality like “user registration”, “search”, “reading”, “posting”, “moderator approval” etc. Parts of the system that may be implemented in the same service, but are distinct workflows and may have different security concerns (e.g. anybody can read, but you obviously need to be careful who can approve things).
    – Jan Hudec
    Jun 1 '21 at 17:16
  • @JanHudec I think you want to break those out, perhaps even a bit further - see edited answer.
    – Adam Shostack
    Jun 2 '21 at 18:22
4

Actors act on the assets/environments. They can be people, client applications, processes, etc. if they present a possible threat.

Processes are your processes within your scope.

As an example, OWASP has an example.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.