Places on a network diagram
Physical locations and regions.
4 objects in this group, each named in plain English with the technical terms kept as searchable aliases. 3 of them carry attack notes, and every one of those ships beside the defences that reduce it. 2 are defined in full below, and the other 2 have entries of their own.
Site
office · location · branch
A physical place the organisation operates from.
Why it matters on a security diagram
Network boundaries and legal obligations often follow physical sites.
How it gets attacked
- Entry by following staff through a controlled door
What reduces it
- Keep network sockets in public areas inactive until a device proves itself
- Assess an acquired site before joining it to the corporate network, not afterwards
Whose side, by default · Ours. Belongs to the organisation the diagram is about.
Data centre
server room · colocation · comms room
The building or room where the servers physically live.
Region
country · jurisdiction · cloud region
A country or geographic area.
Why it matters on a security diagram
Which laws apply turns on where the organisation operates, whom it serves and where the data sits, and those three answers frequently disagree. Drawing the region makes the disagreement visible.
What reduces it
- Apply the same records, limits and monitoring to every region you have switched on, not only the ones you expected to use
No attack notes, because this is a boundary rather than a system. What gets attacked is the things inside it.
Whose side, by default · Bystander. No relationship with us and no choice in the matter: an unwitting hosting provider, a stranger's compromised machine.
Bank account
payment account · beneficiary account · receiving account · money · payee
Where money goes, and who it belongs to.
The other groups
- Network7The paths traffic travels along.
- Wireless and radio11The parts of the network that travel through the air, and how far they reach.
- Cloud and subscribed services14Things that only exist because somebody else runs the platform underneath them.
- Security and edge14The things that sit in front of something else and check what is trying to reach it.
- Servers14Machines that run something for other machines.
- Storage4Where data sits still.
- Endpoints and devices9The things people and processes touch directly.
- Identity7Who something claims to be, and what proves it.
- People and organisations5The humans and the entities they belong to.
- Process flow7Shapes for describing a procedure rather than a network.
- Threats18The adversary and the things they bring.
Draw it rather than read it
Every object above is in the editor. Press N, type a few letters of the plain name or the acronym, and it is placed and connected to whatever was selected. Nothing is uploaded, because the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram makerThe catalogue behind this page is published as open data under CC BY 4.0, last reviewed . Every attack note describes a mechanism and contains no procedure. Corrections are welcome.