Chapter 2 · Practice 4 of 4
Keep the model where the team works, and use more than one view
Why it matters
OWASP's cheat sheet says to store the model where the team can update it. A diagram in someone's laptop or an expired whiteboard photo cannot be maintained.
Practical options:
- Diagrams as text (Mermaid, PlantUML) in the repo next to the design doc, reviewed in pull requests like code.
- OWASP Threat Dragon, a free, open-source threat modeling application that runs on the desktop or as a self-hosted web app. It supports STRIDE, LINDDUN, CIA, DIE and PLOT4ai, and its rule engine suggests threats per diagram element. Its model files can live in the repo.
- A page in your wiki, linked from the design doc and the epic.
The Manifesto's Perfect Representation anti-pattern applies here: it is better to create several representations, because there is no single ideal view and different views show different problems. A sequence diagram of the login flow may reveal a replay issue that the DFD hides, and a deployment diagram may show an exposed admin port.
Limit access to detailed threat models to people who need them, as OWASP's validation step suggests: an unfixed threat list is useful to attackers too.