Architecture and Design Security Reviews

  • Two people working on laptops in a modern office, with reflections on glass.

    Build Security Review Process, integrate security review in SDLC

    People: security team and product team security champions

    Process: review workflow management by PMs, criticality criteria for review, approval process, exceptions

    Artifact expectation: reviewers, reviewees, design review templates, review questions

    Create an approval gate for development, deployment.

  • Outdoor neon sign with the word 'STANDARD' next to blurred orange lights at night.

    Technology: build technical standards and guidelines

    Coding standards, Open Source Use Standards

    API and Application Security standards,

    Data Classification and Privacy standards, Cryptography Use Standards

    AI use standards

  • Person interacting with a touchscreen display showing architectural images and information.

    Threat & Risk Management and Tracking

    Building and tracking asset inventory, threat models,security controls lists?

    A risk management framework: severity rating, vulnerability management policy, risk tracking

    Remediation tracking and monitoring, artifacts storage, recording