Security › Module 4 › Lesson 3
Mitigation Map
DFD literacy names processes, data stores, external entities, data flows, and trust boundary overlays — draft DFD element row on YOUR $ARCH_LAB before STRIDE worksheet lab.
Visual · t41_dfd_literacy
DFD literacy. $ARCH_LAB only. Original Cyberlium.
Opening
Threat models need readable diagrams — literacy teaches data flow diagram vocabulary so fictional org flows on $ARCH_LAB support STRIDE worksheets without live target maps.
Data flow diagrams show processes that transform data, data stores that persist data, external entities that interact from outside, and labeled flows between them — with trust boundaries drawn across zones. On Cyberlium you draft DFD elements for fictional LAB-ARCH-001 services under $ARCH_LAB — example.local user, web process, API store — not employer production architecture exports. Cyberlium writes DFD row on YOUR $ARCH_LAB — element type, name, connected flows, boundary note for one fictional LAB-ARCH-001 slice. Next: STRIDE Worksheet Lab.
1. DFD elements (named)
External entity: fictional user or partner outside LAB-ARCH-001 boundary. Process: web app, API handler transforming data. Data store: database, cache, file share. Data flow: labeled connection — auth token, order record placeholder. Trust boundary: line separating zones on diagram.
On $ARCH_LAB, write DFD row — element type, name, inbound/outbound flows, boundary placement.
Command guide
Try these commands — DFD elements (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Microsoft SDL threat modeling — https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool OWASP Threat Modeling — https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
export ARCH_STRIDE=${ARCH_STRIDE:-$ARCH_LAB/LAB-ARCH-001/stride}
cat > "$ARCH_STRIDE/worksheet-template.md" <<'EOF'
# STRIDE Worksheet Template — LAB-ARCH-001
| Element | Boundary | S | T | R | I | D | E | Mitigation (defensive) | Status |
|---------|----------|---|---|---|---|---|---|------------------------|--------|
| Browser → API GW | Internet edge | ✓ | | | | | | OAuth2 + TLS 1.3 | open |
| API GW → Order svc | Service mesh | | ✓ | | ✓ | | ✓ | mTLS + JWT scope + input validation | open |
| Order svc → DB | Data tier | | ✓ | | ✓ | | ✓ | least-privilege DB role + encryption | open |
Legend: S=Spoofing T=Tampering R=Repudiation I=Info disclosure D=DoS E=Elevation
LAB SAMPLE — defensive mitigations only — NOT attack instructions
EOFCommand — copy this
grep -E 'Mitigation|LAB SAMPLE|Spoofing' "$ARCH_STRIDE/worksheet-template.md"
python3 -c "print('STRIDE template: mark threats + defensive mitigations — fictional org')"Primary tools to practice this lesson: grep, python3. Reference sites: Microsoft SDL threat modeling (https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool); OWASP Threat Modeling (https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why DFD literacy precedes STRIDE worksheets
STRIDE applies to components and flows — incomplete DFDs miss stores and external entities. Consistent diagram legend helps reviewers trace threats to mitigations. Lab DFDs stay small and fictional — production DFDs follow system inventory and change control.
Students draft lab DFD elements on notes — production diagrams follow enterprise threat modeling standards.
3. Lab boundary
Forbidden: copying real customer architecture into lab DFD as training shortcut. Allowed: DFD literacy card — element list with $ARCH_LAB fictional placeholders.
Ship: DFD element row for YOUR lab slice. Next: STRIDE Worksheet Lab.
4. What you ship: DFD element row for $ARCH_LAB
Element type, name, flows, boundary note. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. DFD row. $ARCH_LAB named. File t41-m04-l03-dfd-literacy.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip data stores because 'flows are enough.' Paste employer architecture PDF into lab DFD.
Right
Write DFD element row for YOUR $ARCH_LAB fictional slice. Next: STRIDE Worksheet Lab.
Mission: draft DFD elements on YOUR lab
1) Name one external entity, process, and store. 2) Label two data flows with placeholders. 3) Mark trust boundary placement. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
DFDs need stores and external entities — process-only sketches miss STRIDE targets.
Knowledge Check
APPLY: DFD literacy on Cyberlium covers:
Multiple choice
Knowledge Check
APPLY: True or False: Data flow diagrams label connections between components.
True or False
Knowledge Check
APPLY: DFD literacy on Cyberlium uses:
Multiple choice