topic Re: Security Architecture Reviews in Tech Talk

Security Architecture Reviews

iluom — Fri, 15 Oct 2021 17:26:36 GMT

Hi InfoSec community,

Can anybody suggest how to approach Annual Security Architecture/design review (only Design/Architecture not implementation or VAPT ) of a web application which is not having any proper documentation for Security activities.

When I think about it... it's requires Threat Modeling and Risk Assessment... but it's overwhelming and I would like to get some pointers where to start , what needs to be covered..etc..

Thank you.

Re: Security Architecture Reviews

BadIdea — Sun, 17 Oct 2021 19:25:58 GMT

Start with an assessment of the application. You will identify threats and weaknesses, Translate that into a roadmap of the target state. You cannot boil the ocean so pick the items that pose the greatest risk as your priority items.

Re: Security Architecture Reviews

luisantonio — Wed, 20 Oct 2021 07:24:15 GMT

To me, a quick start in those situations is to get answers about the most common pitfalls I found when working with developers who did not care about Security:
- Authentication: How it interacts with users and other applications.
- Credentials: How are stored.
- Storage: How does it persist changes. What security controls are applied.
- Data flow.
I'm talking about quick wins. Of course you are right and a threat modeling and risk assessment are how things should be accomplished, there are so many additional areas to be covered (for example environment, deployment) but sometimes is overwhelming and a simple document can serve as a starter.

Luis. Security Engineer, IT Manager.

Re: Security Architecture Reviews

rahul28 — Tue, 21 Jun 2022 06:02:53 GMT

You can start with the principle aligned with your organization's objectives. Principles like Single Identity, Security Monitoring, Data Security and etc. You can then assess if the architecture/ design complies with those principles. This will be a continuous process and will get refined over a period of time but you need to start from somewhere and take the feedback for relevant stakeholders and improve.

Thanks!!

Rahul Sharma