[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-655976-105":3,"detail-sidebar-cat-0-en-105":80,"doc-detail-655976-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","csci-4271w-development-of-secure-software-systems-day-2-diagrams","CSci 4271W Development of Secure Software Systems Day 2 - Diagrams","","Lecture slides for CSci 4271W on developing secure software systems, Day 2, focused on building security thinking through diagrams and threat modeling. The material explains that describing how a system works is a starting point, and introduces data-flow diagrams (DFDs) and swim lane diagrams to capture system behavior. It covers trust boundaries, grouping parts under mutual trust, encapsulating principals, identifying data sinks, and using sub-diagrams when complexity grows, with examples like Windows firewall components, LMS, and GitHub CI.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/technology/","Technology",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/csci-4271w-development-of-secure-software-systems-day-2-diagrams/655976/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/csci-4271w-development-of-secure-software-systems-day-2-diagrams/655976.png","ImageObject",300,407,{"name":42,"@type":43},"Alex Sinclair","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-11-02","2026-10-25",true,{"@type":52,"interactionType":53,"userInteractionCount":33},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"Why do the slides start with system diagrams for security thinking?","Question",{"text":62,"@type":63},"They present diagramming as a practical way to describe how a system works, which helps structure security reasoning and threat modeling.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"What do DFDs help identify and how are they used?",{"text":67,"@type":63},"DFDs support describing system behavior and reviewing key elements such as data sinks, and whether a system can be explained clearly using the diagram (with sub-diagrams if needed).",{"name":69,"@type":60,"acceptedAnswer":70},"How do swim lane diagrams complement DFDs?",{"text":71,"@type":63},"Swim lane diagrams illustrate sequential interactions, providing a clearer view of how processes and components interact over time, with examples such as GitHub CI.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},655976,1792965256,{"code":4,"msg":81,"data":82},"success",[83,87,91,95,100,104,109,114,119,122,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":84,"show_sort_weight":85,"slug":86},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":88,"show_sort_weight":89,"slug":90},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":92,"show_sort_weight":93,"slug":94},"Exam",70,"exam",{"id":96,"doc_module":4,"doc_module_name":25,"category_name":97,"show_sort_weight":98,"slug":99},5,"Comic",60,"comic",{"id":101,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":102,"slug":103},6,50,"technology",{"id":105,"doc_module":4,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},7,"Healthcare",40,"healthcare",{"id":110,"doc_module":4,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},8,"Research & Report",30,"research-report",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":96,"slug":129},19,"General","general",{"code":4,"msg":81,"data":131},{"doc_id":78,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":101,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":33,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":30,"language":139,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":12,"update_tm":79,"read_time":110},1099523882182,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","CSci 4271W  \nDevelopment of Secure Software Systems Day 2: 􀂓What Are We Building?􀂔 Diagrams  \nStephen McCamant (he/him) University of Minnesota, Computer Science & Engineering  \nBased in large part on slides originally by Prof. Nick Hopper Licensed under Creative Commons Attribution-ShareAlike 4.0  \n\n| Threat modeling |  |\n| --- | --- |\n| \u003Cbr>Star Wars TM and (C) Lucasfilm, Ltd. | What are we building?\u003Cbr>What could go wrong?\u003Cbr>What are you doing about it?\u003Cbr>How did you do? |\n\nWhat are we building?  \nA good way to start thinking about the security of a system is to start by describing how it works.  \nOne way to describe a system is to draw a diagram. . .  \nOutline  \nData-Flow Diagrams  \nSwim Lane Diagrams  \n| Data-flow Diagrams (DFDs) |  |\n| --- | --- |\n|  | |\n|  |  |\n\nMore DFD examples  \nComponents implementing the firewall in Windows. Source: Project Zero [https://googleprojectzero.blogspot.com/2021/08/understanding-network-access-windows-app.html](https://googleprojectzero.blogspot.com/2021/08/understanding-network-access-windows-app.html)  \nExample: LMS (Canvas, etc.)  \nTrust boundaries  \nGrouping parts of the system that have mutual trust  \nShould encapsulate system 􀂓principals􀂔:  \nHosts, UIDs, network segments, . . .  \nMore DFD examples  \nExample: GitHub CI  \nDFD guidelines  \nCan you describe how the system works with the diagram?  \nAre there any data sinks?  \nIf it’s getting too complicated, consider making a sub-diagram  \nIn what context does process P execute?  \nHow is access to data store D mediated?  \nOutline  \nData-Flow Diagrams  \nSwim Lane Diagrams  \n\n| Swim lane diagrams\u003Cbr>Illustrate sequential interactions |  |  |\n| --- | --- | --- |\n|  | |  |\n\n\n| Swim lane diagrams\u003Cbr>Illustrate sequential interactions\u003Cbr>|  |\n| --- | --- |\n\nGitHub CI swim lanes  \n\n| Swim lane diagrams\u003Cbr>Illustrate sequential interactions |  |  |\n| --- | --- | --- |\n|  | |  |\n\n\n| Swim lane diagrams\u003Cbr>Illustrate sequential interactions\u003Cbr>|  |\n| --- | --- |\n\nAnother example","cbCaieeMTqlBzxJT","https://ap.wps.com/l/cbCaieeMTqlBzxJT","pdf",1104281,"English","# What are we building?\n## Diagrams as a way to describe systems\n# Outline\n## Data-Flow Diagrams (DFDs)\n## DFD examples and guidelines\n### Data sinks and sub-diagrams\n### Context of process execution and data store access\n## Swim Lane Diagrams\n### Sequential interactions\n### Examples","[{\"question\":\"Why do the slides start with system diagrams for security thinking?\",\"answer\":\"They present diagramming as a practical way to describe how a system works, which helps structure security reasoning and threat modeling.\"},{\"question\":\"What do DFDs help identify and how are they used?\",\"answer\":\"DFDs support describing system behavior and reviewing key elements such as data sinks, and whether a system can be explained clearly using the diagram (with sub-diagrams if needed).\"},{\"question\":\"How do swim lane diagrams complement DFDs?\",\"answer\":\"Swim lane diagrams illustrate sequential interactions, providing a clearer view of how processes and components interact over time, with examples such as GitHub CI.\"}]","CSci 4271W Development of Secure Software Systems Day 2 - Diagrams | PDF"]