People and organisations on a network diagram
The humans and the entities they belong to.
4 objects in this group, each named in plain English with the technical terms kept as searchable aliases. 3 of them carry attack notes, and every one of those ships beside the defences that reduce it. 2 are defined in full below, and the other 2 have entries of their own.
Person
user · employee · staff member
A named individual involved in the diagram.
Supplier
vendor · third party · contractor · MSP
Another organisation with access to your systems.
Organisation
company · entity · business
A company, agency or other body.
Why it matters on a security diagram
An incident rarely stops at one company. Naming the other entities is what makes a supply chain visible instead of implied.
No attack notes, because this is a boundary rather than a system. What gets attacked is the things inside it.
Whose side, by default · Bystander. No relationship with us and no choice in the matter: an unwitting hosting provider, a stranger's compromised machine.
Customer
client · data subject · end user
Somebody the organisation serves.
Why it matters on a security diagram
Usually the person whose data is at stake, and the reason a breach carries legal weight.
How it gets attacked
- Fraud using details taken from a breach elsewhere
What reduces it
- Tell them promptly when their data is affected, because they cannot act on what they do not know
Whose side, by default · Bystander. No relationship with us and no choice in the matter: an unwitting hosting provider, a stranger's compromised machine.
The other groups
- Network6The paths traffic travels along.
- Wireless and radio11The parts of the network that travel through the air, and how far they reach.
- Cloud and subscribed services12Things that only exist because somebody else runs the platform underneath them.
- Security and edge11The things that sit in front of something else and check what is trying to reach it.
- Servers13Machines that run something for other machines.
- Storage4Where data sits still.
- Endpoints and devices8The things people and processes touch directly.
- Identity6Who something claims to be, and what proves it.
- Places3Physical locations and regions.
- Process flow7Shapes for describing a procedure rather than a network.
- Threats15The adversary and the things they bring.
Draw it rather than read it
Every object above is in the editor. Press N, type a few letters of the plain name or the acronym, and it is placed and connected to whatever was selected. Nothing is uploaded, because the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram makerThe catalogue behind this page is published as open data under CC BY 4.0, last reviewed . Every attack note describes a mechanism and contains no procedure. Corrections are welcome.