Visualize risk

  • 20 minutes

The next step in the infrastructure threat modeling process is to create a data-flow diagram.

General assumptions

To build this diagram, we make the following assumptions:

Elements

Process

Process element.

What is process?

Process is a task that receives, modifies, or redirects input to output.

Process context to include

Context Questions
Code Is this process running in C#, C++, Objective C, Java, or a scripting language?
Permission level Does this process need kernel, local, or administration level permissions to run?
Service isolation Is the process running in a sandbox?
Input Can this process accept input from everyone, local accounts, or just administrators?
Validation How does the process parse, handle and accept input?
Authentication Does the process rely on Microsoft Entra ID for authentication? If not, what does it rely on?
Authorization Does it rely on Access Control Lists (ACL) for authorization? If not, what does it rely on?

Woodgrove process elements

  • Microsoft 365
  • Open-source bug management service
  • SaaS offerings (grouped)
  • GitHub
  • Machine
  • Firewall service
  • VPN service
  • NAS file share service
  • Logging and monitoring service
  • NAS backup service
  • SQL server
  • Build servers (grouped)
  • Active directory service
  • Removable drive backup service
  • Azure Iaas

Process labeling example

Microsoft 365 - Microsoft 365/SaaS/Azure ADauth (user credentials, session token, request/response)


Data-store

Data store element.

What is data store?

Data store refers to permanent and temporary storing of data.

Data store context to include

Context Questions
Type Does the system use Azure SQL, cookies, local or some other type of storage? If so, what is it?
Function How is the storage used? Is it used to share data, store backups, security logs, credentials, secrets?
Permission level How is access control implemented? Who has read and write permissions?
Extra controls Is data encrypted? What about the disk? Are digital signatures used?

Woodgrove data store elements

  • Credentials and tokens VPN store
  • NAS store
  • Logging and monitoring store
  • Active directory store
  • Removable drive store

Data store labeling example

NAS - (file share, backup, credentials, secrets)


External entity

External entity element.

What is external entity?

External entity is a task, entity, or data store outside of your direct control.

External entity context to include

Context Questions
Source Is the entity internal or external?
Type Is the entity human, a service provider, or web service?
Authentication Does the process rely on Microsoft Entra ID for authentication? If not, what does it rely on?
Authorization Does it rely on Access Control Lists (ACL) for authorization? If not, what does it rely on?

Woodgrove external entity elements

  • User

External entity labeling example

User - User/AD (FTE)


Data-flow

Data-flow element.

What is data-flow?

Data-flow refers to data movement between processes, data stores, and external entities.

Data-flow context to include

Context Questions
Description Is the data-flow passing a session token, SQL string, or user credentials? If not, what is it passing?
Protocol Does the flow use HTTPS or SOAP? If not, what does it use?
Flow sequence Is the data-flow enumerated to make it easier to follow the flow sequence?
Type What type of data is in the data-flow? Cookies? XML? SOAP payload? REST payload? JSON payload?
Extra controls Does the data-flow have forgery protection enabled? Other security flags enabled?
Authentication Does the process rely on Microsoft Entra ID for authentication? If not, what does it rely on?
Authorization Does it rely on Access Control Lists (ACL) for authorization? If not, what does it rely on?

Woodgrove data-flow elements

  • Request and responses between element connections

Data-flow labeling example

Data-flow - 1- HTTPS Request(session token)


Trust boundary

Trust boundary box element.

What is trust boundary?

Trust Boundary refers to trust zone changes as data flows through the system.

Lines are used to represent large trust zone changes like the internet.

Boxes are used to represent smaller trust zone changes, like a corporate network.

Trust boundary context to include

Context Questions
Description Is it a corporate network boundary? internet? Azure subscription?

Woodgrove trust boundary elements

  • Woodgrove corporate boundary
  • Azure IaaS boundary
  • Internet boundary

Trust boundary labeling example

Azure IaaS boundary - Boundary box that identifies when data flows from Woodgrove corporate boundary into Azure.

Note

Check out the Create a threat model using data-flow diagram elements module from our Threat Modeling Security Fundamentals learning path for an in-depth review of each element.

Interactions

The next step is to capture the data-flow between each interaction:

User

User threat model.

Element A Data-flow Element B Crosses boundary Details
User external entity.
User		 Bi-directional flow between user external entity and Microsoft 365 process
Bi-directional		 Microsoft 365 process
Microsoft 365		 Crosses trust boundary
Yes
  • HTTPS
  • Microsoft Entra authentication
  • User credentials
  • Session tokens
  • Requests and responses
User external entity.
User		 Bi-directional flow between user external entity and bug management service process
Bi-directional		 Bug management service process
Bug management service		 Crosses trust boundary
Yes
  • HTTPS
  • Service authentication
  • User credentials
  • Session tokens
  • Requests and responses
User external entity.
User		 Bi-directional flow between user external entity and SaaS offerings (grouped) process
Bi-directional		 SaaS offerings (grouped) process
SaaS offerings (grouped)		 Crosses trust boundary
Yes
  • HTTPS
  • SaaS authentication
  • User credentials
  • Session tokens
  • Requests and responses
User external entity.
User		 Bi-directional flow between user external entity and GitHub process
Bi-directional		 GitHub process
GitHub		 Crosses trust boundary
Yes
  • HTTPS
  • GitHub authentication
  • User credentials
  • Session tokens
  • Requests and responses
User external entity.
User		 Bi-directional flow between user external entity and machine process
Bi-directional		 Machine process
Machine		 Does not cross trust boundary
No
  • AD authentication
  • User credentials

Initial services

Initial services threat model.

Element A Data-flow Element B Crosses boundary Details
GitHub process.
GitHub		 Bi-directional flow between GitHub process and firewall service process
Bi-directional		 Firewall service process
Firewall service		 Crosses trust boundary
Yes
  • HTTPS
  • IP allowlist
  • IPSec tunnel
  • Requests and responses
Machine process.
Machine		 Bi-directional flow between machine process and firewall service process
Bi-directional		 Firewall service process
Firewall service		 Crosses trust boundary
Yes
  • IP allowlist
  • Requests and responses
Machine process.
Machine		 Bi-directional flow between machine process and active directory service process
Bi-directional		 Active Directory service process
Active Directory service		 Crosses trust boundary
Yes
  • User credentials
  • Session tokens
Machine process.
Machine		 Bi-directional flow between machine process and user external entity
Bi-directional		 User external entity
User		 Crosses trust boundary
Yes		 See User for details
Github process.
GitHub		 Bi-directional flow between GitHub process and user external entity
Bi-directional		 User external entity
User		 Crosses trust boundary
Yes		 See User for details
Microsoft 365 process.
Microsoft 365		 Bi-directional flow between Microsoft 365 process and user external entity
Bi-directional		 User external entity
User		 Crosses trust boundary
Yes		 See User for details
Bug management service process.
Bug management service		 Bi-directional flow between bug management service process and user external entity
Bi-directional		 User external entity
User		 Crosses trust boundary
Yes		 See User for details
SaaS offerings (grouped) process.
SaaS offerings (grouped)		 Bi-directional flow between SaaS offerings (grouped process and user external entity)
Bi-directional		 User external entity
User		 Crosses trust boundary
Yes		 See User for details

Firewall

Firewall threat model.

Element A Data-flow Element B Crosses boundary Details
Firewall service process.
Firewall service		 Bi-directional flow between firewall service process and VPN service process
Bi-directional		 VPN service process
VPN service		 Does not cross trust boundary
No
  • VPN tunnel
  • Requests and responses
Firewall service process.
Firewall service		 Bi-directional flow between firewall service process and build servers (grouped) process
Bi-directional		 Build servers (grouped) process
Build servers (grouped)		 Does not cross trust boundary
No
  • Requests and responses
  • GitHub IPSec tunnel
Firewall service process.
Firewall service		 Bi-directional flow between firewall service process and logging and monitoring service process
Bi-directional		 Logging and monitoring service process
Logging and monitoring service		 Does not cross trust boundary
No
  • Requests and responses
Firewall service process.
Firewall service		 Bi-directional flow between firewall service process and Azure IaaS process
Bi-directional		 Azure IaaS process
Azure IaaS		 Crosses trust boundary
Yes
  • IPSec tunnel
  • IP allowlist
  • Requests and responses
Firewall service process.
Firewall service		 Bi-directional flow between firewall service process and machine process
Bi-directional		 Machine process
Machine		 Crosses trust boundary
Yes		 See Initial services for details
Firewall service process.
Firewall service		 Bi-directional flow between firewall service process and GitHub process
Bi-directional		 GitHub process
GitHub		 Crosses trust boundary
Yes		 See Initial services for details

VPN

VPN threat model.

Element A Data-flow Element B Crosses boundary Details
VPN service process.
VPN service		 Bi-directional flow between VPN service process and firewall service process
Bi-directional		 Firewall service process
Firewall service		 Does not cross trust boundary
No
  • IP allowlist
  • User credentials
  • Session tokens
  • Requests and responses
VPN service process.
VPN service		 Bi-directional flow between VPN service process and credentials and tokens VPN store
Bi-directional		 Credentials and tokens VPN data store
Credentials and tokens VPN store		 Does not cross trust boundary
No
  • VPN tunnel
  • User credentials
  • Session tokens
  • Requests and responses
VPN service process.
VPN service		 Bi-directional flow between VPN service process and NAS file share service process
Bi-directional		 NAS file share service process
NAS file share service		 Does not cross trust boundary
No
  • VPN tunnel
  • Requests and responses
VPN service process.
VPN service		 Bi-directional flow between VPN service process and SQL server process
Bi-directional		 SQL server process
SQL server		 Does not cross trust boundary
No
  • VPN tunnel
  • Requests and responses
Credentials and tokens VPN data store.
Credentials and tokens VPN store		 Bi-directional flow between credentials and tokens VPN data store and NAS backup service process
Bi-directional		 NAS backup service process
NAS backup service		 Does not cross trust boundary
No
  • Requests and responses

Network attached storage (NAS)

NAS threat model.

Element A Data-flow Element B Crosses boundary Details
NAS file share service process.
NAS file share service		 Bi-directional flow between NAS file share service process and NAS store
Bi-directional		 NAS data store
NAS store		 Does not cross trust boundary
No
  • Requests and responses
NAS backup service process.
NAS backup service		 Bi-directional flow between NAS backup service process and NAS data store
Bi-directional		 NAS data store
NAS store		 Does not cross trust boundary
No
  • Requests and responses
NAS backup service process.
NAS backup service		 Bi-directional flow between NAS backup service process and Active Directory data store
Bi-directional		 Active Directory data store
Active Directory store		 Does not cross trust boundary
No
  • Requests and responses
NAS backup service process.
NAS backup service		 Bi-directional flow between NAS backup service process and logging and monitoring data store
Bi-directional		 Logging and monitoring data store
Logging and monitoring store		 Does not cross trust boundary
No
  • Requests and responses
NAS backup service process.
NAS backup service		 Bi-directional flow between NAS backup service process and SQL server process
Bi-directional		 SQL server process
SQL server		 Does not cross trust boundary
No
  • Requests and responses
NAS backup service process.
NAS backup service		 Bi-directional flow between NAS backup service process and build servers (grouped) process
Bi-directional		 Build servers (grouped) process
Build servers (grouped)		 Does not cross trust boundary
No
  • Requests and responses
NAS file share service process.
NAS file share service		 Bi-directional flow between NAS file share service process and VPN service process
Bi-directional		 VPN service process
VPN service		 Does not cross trust boundary
No		 See VPN for details
NAS backup service process.
NAS backup service		 Bi-directional flow between NAS backup service process and credentials and tokens VPN data store
Bi-directional		 Credentials and tokens VPN data store
Credentials and tokens VPN store		 Does not cross trust boundary
No		 See VPN for details

Servers

Servers threat model.

Element A Data-flow Element B Crosses boundary Details
SQL server process.
SQL server		 Bi-directional flow between SQL server process and removable drive backup service process
Bi-directional		 Removable drive backup service process
Removable drive backup service		 Does not cross trust boundary
No
  • Requests and responses
Build servers (grouped) process.
Build servers (grouped)		 Bi-directional flow between build servers (grouped) process and removable drive backup service process
Bi-directional		 Removable drive backup service process
Removable drive backup service		 Does not cross trust boundary
No
  • Requests and responses
SQL server process.
SQL server		 Bi-directional flow between SQL server process and VPN service process
Bi-directional		 VPN service process
VPN service		 Does not cross trust boundary
No		 See VPN for details
SQL server process.
SQL server		 Bi-directional flow between SQL server process and NAS backup service process
Bi-directional		 NAS backup service process
NAS backup service		 Does not cross trust boundary
No		 See NAS for details
Build servers (grouped) process.
Build servers (grouped)		 Bi-directional flow between build servers (grouped) process and NAS backup service process
Bi-directional		 NAS backup service process
NAS backup service		 Does not cross trust boundary
No		 See NAS for details
Build servers (grouped) process.
Build servers (grouped)		 Bi-directional flow between build servers (grouped) process and firewall service process
Bi-directional		 Firewall service process
Firewall service		 Does not cross trust boundary
No		 See Firewall for details

Logging and monitoring

Logging and monitoring threat model.

Element A Data-flow Element B Crosses boundary Details
Logging and monitoring service process.
Logging and monitoring service		 Bi-directional flow between logging and monitoring service process and logging and monitoring data store
Bi-directional		 Logging and monitoring data store
Logging and monitoring store		 Does not cross trust boundary
No
  • Requests and responses
Logging and monitoring data store.
Logging and monitoring store		 Bi-directional flow between logging and monitoring data store and NAS backup service process
Bi-directional		 NAS backup service process
NAS backup service		 Does not cross trust boundary
No		 See NAS for details
Logging and monitoring service process.
Logging and monitoring service		 Bi-directional flow between logging and monitoring service process and firewall service process
Bi-directional		 Firewall service process
Firewall service		 Does not cross trust boundary
No		 See Firewall for details

Active Directory

Active Directory threat model.

Element A Data-flow Element B Crosses boundary Details
Active Directory data store.
Active directory store		 Bi-directional flow between Active Directory data store and Active Directory service process
Bi-directional		 Active Directory service process
Active directory service		 Does not cross trust boundary
No
  • User credentials
  • Session tokens
  • Requests and responses
Active Directory service process.
Active directory service		 Bi-directional flow between Active Directory service process and removable drive backup service process
Bi-directional		 Removable drive backup service process
Removable drive backup service		 Does not cross trust boundary
No
  • User credentials
  • Session tokens
  • Requests and responses
Active Directory service process.
Active directory service		 Bi-directional flow between Active Directory service process and machine process
Bi-directional		 Machine process
Machine		 Crosses trust boundary
Yes		 See Initial services for details
Active Directory data store.
Active directory store		 Bi-directional flow between Active Directory data store and NAS backup file service process
Bi-directional		 NAS backup service process
NAS backup service		 Does not cross trust boundary
No		 See NAS for details

Removable drive

Removable drive threat model.

Element A Data-flow Element B Crosses boundary Details
Removable drive backup service process.
Removable drive backup service		 Bi-directional flow between removable drive backup service process and removable drive data store
Bi-directional		 Removable drive data store
Removable drive store		 Crosses trust boundary
Yes
  • Requests and responses
Removable drive backup service process.
Removable drive backup service		 Bi-directional flow between removable drive backup service process and SQL server process
Bi-directional		 SQL server process
SQL server		 Does not cross trust boundary
No		 See Servers for details
Removable drive backup service process.
Removable drive backup service		 Bi-directional flow between removable drive backup service process and build servers (grouped) process
Bi-directional		 Build servers (grouped) process
Build servers (grouped)		 Does not cross trust boundary
No		 See Servers for details
Removable drive backup service process.
Removable drive backup service		 Bi-directional flow between removable drive backup service process and Active Directory service process
Bi-directional		 Active Directory service process
Active directory service		 Does not cross trust boundary
No		 See Active directory for details

Azure

Azure threat model.

Element A Data-flow Element B Crosses boundary Details
Azure IaaS process.
Azure IaaS		 Bi-directional flow between Azure IaaS process and firewall service process
Bi-directional		 Firewall service process
Firewall service		 Crosses trust boundary
Yes
  • IPSec tunnel
  • Microsoft Entra authentication
  • User credentials
  • Session tokens
  • Requests and responses

Finished diagram

Infrastructure threat model.