Download Our Complimentary White Paper:

Process Flow Diagrams (PFDs) vs. Data Flow Diagrams (DFDs) in the Threat Modeling Arena

While DFDs are used to document the flow of data in, out, and around a system, application, or process, they lack the deeper contextual insights that PFDs offer. PFDs visually demonstrate the relationships between components and processes, providing a view similar to that of an attacker.

Data flow diagrams (DFDs) have been the de facto approach to threat modeling in the Information Security profession. As technology development has moved towards rapid iterative modular development and deployment, the flaws that result from using DFDs have become painfully obvious. This white paper looks at some flaws and the advantages of moving to a more mature Process Flow Diagram (PFD) approach to threat modeling as a solution.

Some of the most valuable key points discussed are:
  • Engineering security into the early phases of an ever increasingly fast SDLC (proactive) rather than finding flaws to fix at the end (reactive).
  • Leveraging PFD-driven threat modeling, including in DevSecOps.
  • Using the Visual, Agile, Simple Threat Modeling (VAST) approach.
  • Overcoming False Positives, False Negatives and the False Sense of Security characteristic of DFD threat modeling.

Privacy Policy

ThreatModeler is committed to protecting and respecting your privacy, and we’ll only use your personal information to administer your account, and to provide the products, services and information you requested. By submitting this form you agree to receive email communications from and allow us to store and process your personal data.

For more information on our privacy practices, please review our Privacy Policy.

Download Process Flow Diagrams (PFDs) vs. Data Flow Diagrams (DFDs) in the Threat Modeling Arena