Solution-aware data flow diagrams for security threat modeling

Threat modelling refers to a number of systematic approaches for eliciting security and/or privacy threats. Data Flow Diagrams (DFDs) are the main input for threat modelling techniques such as Microsoft STRIDE or LINDDUN. They represent system-level abstractions that lack any architectural knowledge on existing security solutions. However, this is not how software is built in practice: there are often previously-made security- and privacy-relevant decisions that originate from the technological context or domain, reuse, or external dependencies. Not taking these into account leads to the enumeration of many non-applicable threats during threat modelling. While recording the effect of these decisions on individual elements can provide some relief, the lack of a proper first-class representation causes conflicts when modifying the architecture and inhibits traceability between effect and decision. In this paper, we enrich Data Flow Diagrams with security solution elements, which are taken into account during threat elicitation. Our modelling approach is supported by a proof-of-concept implementation of a threat modelling framework and validated in the context of a STRIDE analysis of an industrial video conferencing solution that is based onWebRTC. The presented DFD enrichments are a key enabler for future efforts towards dynamic and continuous threat modeling.status: Published onlin