One alternative to a data flow diagram is a process flow diagram ... Microsoft has a free threat modeling tool available, and the OWASP Foundation has desktop and web app versions of its own ...