Threat modelling session checklist template
For architects and engineers before build starts on a new design. A data flow diagram with trust boundaries is attached, threats are listed per component from spoofing to elevation of privilege and rated by likelihood and impact, and accepted risks get an owner.
- App: Checklist Flow for Jira
- Category: Security review
- Edition: Needs a paid licence; without one it shows with a Pro badge and a preview
- Items: 8 items, 4 required
- Suggested for: Epic, Task
Items
#| Item | Required |
|---|---|
| Data flow diagram drawn and attached | Required |
| Trust boundaries marked on the diagram | Required |
| Threats listed per component (spoofing, tampering, repudiation, disclosure, denial of service, elevation) | Required |
| Each threat rated by likelihood and impact | Required |
| Mitigations agreed for every high rated threat | Optional |
| Mitigations created as linked work items | Optional |
| Accepted risks recorded with an owner | Optional |
| Review date set for when the design changes | Optional |
Use it
#In a Jira work item, open the Checklist Flow panel, then Template library in the Templates section. Find the template under its category, use Preview to see the items and Install to add it to your site's templates. From then on you can apply it to any work item, or, with a paid licence, have it added automatically by issue type.
Related
#- Checklist Flow for Jira documentation
- Jira checklist templates: all 49 templates