Threat model of a payroll SaaS

Views in this map

1. 1
   Data flowsHow payroll data moves: from employers and employees to the bank and the tax agencies.
2. 2
   ThreatsTwelve STRIDE threats, each pinned beside the element it attacks.
3. 3
   MitigationsEach threat swapped for the control that closes it, in the same place.
4. 4
   Pay-run engineInside the engine: earnings in, taxes withheld, approval, then one locked run.

Data flows ‹ › Threats ‹ › Mitigations ▸ Pay-run engine

Flows to play

• ▷
  A pay run, end to endOne employer’s biweekly run, from approval to money in employees’ accounts.
• ▷
  A forged webhookAn attacker fakes the bank’s callback to redirect one employee’s net pay. In the Threats view, where it reaches the bank file, and in Mitigations, where it stops at the signature check.
• ▷
  An insider exports SSNsA support agent copies employee records out of the support console. In the Threats view, where nothing stops it, and in Mitigations, where access is per ticket, masked and logged.
• ▷
  Inside a pay runOne run through the engine, from earnings to the locked hand-off. In the Pay-run engine view.

The model behind it

57 records of 7 types. Every box on the map is one of them, so the filters and the record panel read the same data.

• Processes 14
• Threats 12
• Controls 12
• External entities 7
• Data stores 7
• Trust boundaries 3
• Threat actors 2

Filters

STRIDE category and Risk: pick a value and everything else fades.