<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-data-flow-diagram-analysis
description: >-
  Analyze data flow diagrams to identify trust boundary crossings, unprotected data flows, missing authentication points, and encryption gaps for comprehensive security boundary assessment.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - dfd
  - data-flow
  - trust-boundaries
  - boundary-analysis
  - pytm
  - graphviz
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557", "T1040", "T1565"]
---

# Performing Data Flow Diagram Analysis

## Overview

Data Flow Diagram (DFD) analysis is the foundation of structured threat modeling, identifying
how data moves through a system, where trust boundaries exist, and where security controls
are needed. This technique covers DFD construction, trust boundary analysis, and gap detection.

Mode: `[MODE: ARCHITECT]` — Data flow security boundary analysis.

## Prerequisites

- System architecture documentation
- `pytm` for programmatic DFDs: `pip install pytm`
- Graphviz for rendering: `apt install graphviz`
- Python 3.10+

## Key Concepts

### DFD Elements

| Element | Symbol | Security Concern |
|---------|--------|-----------------|
| External Entity | Rectangle | Authentication, input validation |
| Process | Circle | All STRIDE categories |
| Data Store | Parallel lines | Encryption at rest, access control |
| Data Flow | Arrow | Encryption in transit, integrity |
| Trust Boundary | Dashed line | All flows crossing need controls |

### Trust Boundary Types

| Boundary | Example | Required Controls |
|----------|---------|-------------------|
| Network | Internet ↔ DMZ | Firewall, WAF, TLS |
| Privilege | User ↔ Admin | AuthZ, RBAC, MFA |
| Process | Container ↔ Host | Isolation, seccomp, namespaces |
| Data Classification | Public ↔ Confidential | Encryption, DLP, access control |

### Security Gap Patterns

- **Unencrypted boundary crossing**: data flow crosses trust boundary without TLS
- **Missing authentication**: process accepts input without verifying source
- **No integrity check**: data store accessed without tamper detection
- **Excessive trust**: internal components trust each other implicitly

## Workflow

### Step 1: Build DFD

```bash
# Parse architecture into DFD elements
node scripts/agent.js --action build --input architecture.json --output dfd.json

# Render DFD visualization
node scripts/agent.js --action render --input dfd.json --format png
```

### Step 2: Identify Trust Boundaries

```bash
node scripts/agent.js --action boundaries --input dfd.json --output boundaries.json
```

### Step 3: Analyze Security Gaps

```bash
# Find unprotected boundary crossings
node scripts/agent.js --action analyze --input dfd.json --output gaps.json
```

### Step 4: Generate Recommendations

```bash
node scripts/agent.js --action report --input gaps.json --output dfd-report.json
```

## Verification

- [ ] All system components represented as DFD elements
- [ ] Trust boundaries drawn at every network, privilege, and classification change
- [ ] Every flow crossing a boundary has documented security controls
- [ ] No unencrypted flows across trust boundaries
- [ ] All external entity inputs validated and authenticated
- [ ] DFD validated against actual network topology and data flows

## References

- [OWASP Data Flow Diagrams](https://owasp.org/www-community/Threat_Modeling_Process#data-flow-diagrams)
- [pytm Documentation](https://github.com/OWASP/pytm)
- [Microsoft Threat Modeling Tool](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)
