Trust boundaries

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does a trust boundary show on a data flow diagram?

A Where the fastest part of the system is located

B Where data passes between parts with different levels of trust

2. Which data flow crosses a trust boundary?

A A user's phone sending a login request to a web server

B A function reading a variable inside the same program

3. Data travels from the internet to your school's web server. How should the server treat that data?

A As untrusted until it has been checked

B As safe because it came from a logged-in user

4. Where do threats tend to cluster in a system?

A In the middle of the most trusted zone

B At the trust boundaries

5. Between which two parts is there usually a trust boundary?

A Web server and database

B Two files stored in the same folder

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Browser -\|- Web server		AThe database holds the most sensitive data and has a higher trust level than the web server, so a trust boundary exists here and must be drawn and protected.
2Web server -\|- Database		Bif not valid(user_input): reject()
3Data from a user's device must be checked when it crosses the boundary into the server		CA trust boundary where the web server passes requests to a more protected database
4Threats cluster at trust boundaries, so each boundary crossing is listed in a threat model		DA trust boundary is a line on a diagram, not just a device. It marks where trust levels change, and a firewall is only one control placed there.
5Trust boundary = a firewall device only		EBoundary: Internet to Web server \| Threat: SQL injection
6Web server to Database: no boundary, all trusted		FA trust boundary where data moves from the untrusted internet into the web server

Definitions

trust boundary

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Internet -> Web Server Draw a ______________ between them

Web Server -> ________ Data crosses a trust boundary here

Internet -> Web Server -> Database Threats _______ at each trust boundary

Internet -> Web Server At the trust boundary: ________ all input

Browser __ Web Server Data flow crosses a trust boundary

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A zone1 <- 'Internet'

B zone2 <- 'Web server'

C b <- boundary(zone1, zone1)

D PRINT 'Check data at', b

Question 2

A trust(internet) <- LOW

B trust(database) <- LOW

C IF trust differs THEN

D mark boundary

Question 3

A data <- READ form from user

B // internet to web server

C IF NOT valid(data) THEN

D accept(data)

E ELSE save(data)

Question 4

A name <- request.name

B clean <- escape(name)

C query <- 'WHERE n=' + name

D run(db, query)

Question 5

A boundaries <- list_all()

B FOR EACH b IN zones

C add_checks(b)

D log_traffic(b)

Answer Key

Trust boundaries

Section A: Quick Questions

B — Where data passes between parts with different levels of trust

A — A user's phone sending a login request to a web server

A — As untrusted until it has been checked

B — At the trust boundaries

A — Web server and database

Section B: Match the Pairs

Browser -|- Web server → A trust boundary where data moves from the untrusted internet into the web server

Web server -|- Database → A trust boundary where the web server passes requests to a more protected database

Data from a user's device must be checked when it crosses the boundary into the server → if not valid(user_input): reject()

Threats cluster at trust boundaries, so each boundary crossing is listed in a threat model → Boundary: Internet to Web server | Threat: SQL injection

Trust boundary = a firewall device only → A trust boundary is a line on a diagram, not just a device. It marks where trust levels change, and a firewall is only one control placed there.

Web server to Database: no boundary, all trusted → The database holds the most sensitive data and has a higher trust level than the web server, so a trust boundary exists here and must be drawn and protected.

Section C: Definitions

trust boundary — A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

Section D: Fill in the Blanks

Internet -> Web Server
Draw a trust boundary between them

Web Server -> Database
Data crosses a trust boundary here

Internet -> Web Server -> Database
Threats cluster at each trust boundary

Internet -> Web Server
At the trust boundary: validate all input

Browser -> Web Server
Data flow crosses a trust boundary

Section E: Spot the Error

C — A trust boundary sits between two parts of a system with different trust levels. Using zone1 twice puts it between the same zone. It should be boundary(zone1, zone2), between the internet and the web server.

B — The database holds sensitive data, so it has a HIGH trust level. If both sides were LOW, trust would not differ and no boundary would be marked. It should be trust(database) <- HIGH.

D — Data that fails validation as it crosses the boundary must be rejected, not accepted. Line 4 should be reject(data).

C — The query is built from the raw name, so it skips the cleaned input. Untrusted data crossing from the web server to the database could then cause SQL injection. It should be query <- prepare(clean).

B — Threats cluster at trust boundaries, so the loop should go through the boundaries list. The variable zones is not defined. It should be FOR EACH b IN boundaries.