Threat Model Skill Assessment hints

Hi,

Hoping someone can point me in the right direction.
I’m stuck on the hints that are provided when running the grade-dfd command.

My model is nearly correct except for two criteria.
Missing criteria #1
Hint: How does the User interact with the Frontend
On my diagram I have the user entity with the appropriate bi-directional dataflow connecting it to the frontend. I’m not sure what is being looked at, protocol ? Public Network ? A description in the description box ? I’ve filled in as much as I could that made sense under the User entity and the Frontend entity, and I still get the above hint.

Missing criteria #2
Hint: All databases need the same level of protection.
Same thing, I have my two databases, labeled with a clearly labeled trust boundary. Confirmed the spelling and casing of the labels too. Checked the dotted lines of the database entities are within the trust boundaries. I have checked the boxes encrypted and signed within the properties of the entities, and still get the above hint.

Hey @PrincessOfTheHelpdesk ,

Oops - that’s my bad. I pluralized one of the threats, and left out an instruction for adding Protocol to the User ↔ Frontend data flow.

For your second “error”/hint: as you’ve surmised, this indicates your database(s) are not contained in the correct Trust Boundary. And I can tell you that this hint is specifically referring to the “NoSQL Database” entity. It sounds like you crossed your Ts and dotted your Is here, so I can’t make any very-educated guesses about the problem. However, I did tune the grader so that it’s ignorant of whitespace and trailing periods, so on the off-chance this was your issue (people are used to typing and then immediately pressing enter instead of clicking a button) then consider it resolved.

In any case, I’ve updated the latest image with my improvements. If you encounter any further issues - and you’re fairly certain you’ve correctly followed the instructions - feel free to DM me with a screenshot (or better yet, your getjuiced.json file) so that I can take a peek.

Hope this helps; happy hacking!!

Thank you so much, the update resolved my issues. I was starting to suspect an issue with grader or image. I was able to get all three flags and scored well on that particular assessment.

1 Like