Simple threat model for web app

About this example

Threat modeling is a pivotal security technique in application development. This example provides:

• Flow of sensitive data: Shows how user data traverses the system.
• Potential vulnerabilities: Identifies where data might be exposed.
• Security mechanisms: Highlights areas where encryption and admin tools are applied.
• Admin/User differentiation: Differentiates between user access and admin access points.

When to use

• Initial security planning: When outlining the security measures for a new web application.
• Security training: To educate new team members on security best practices.
• Security assessment: As a checklist during security audits to ensure no critical points are unprotected.

How to use

1. Start editing: Duplicate example file and double click on the diagram.
2. Customize diagram: Add/modify nodes, groups, relationships using Eraser’s simple diagram-as-code syntax. Use icons where possible to enhance understanding.
3. Customize layout: Drag elements on the diagram directly on the canvas to manipulate layout.
4. Collect feedback: Share file with collaborators and encourage them to use the comments feature for feedback.