What are a system decomposition, a deployment view and a data flow diagram each used for in product security?

Decomposition lists every component and sub-component (the basis for the configuration inventory, classification and vulnerability management). Deployment view shows components and interfaces for threat modelling and mitigation planning. Data flow diagrams trace individual data items between components.

* A decomposition lists every component with its version, which is what new CVEs are checked against. *

Each view answers a different security question:

• System decomposition: a tree of the product down to versions. In the example, a laboratory analyser's control unit runs Windows 10 IoT, MSSQL, .NET, UltraVNC and the control application, and its real-time unit runs FreeRTOS and VxWorks firmware. Because it lists every third-party part with its version, it is what you check against new CVEs, so it drives vulnerability management, and it is the seed of an SBOM.
• Deployment view: where components run and how they connect (web frontend, business logic, database, real-time controller over MQTT). Interfaces are attack surface, so this view drives threat modelling and mitigation planning.
• Data flow diagram: the path of a specific asset, such as a production key from generation through the key server to personalisation. It shows where a secret is exposed, so it suits security use cases such as key handling.

Go deeper:

• Data-flow diagram (Wikipedia) — notation for the view threat modelling starts from