Advisory and training
Security architecture review and threat modeling
Design flaws are the most expensive to fix once the system is built. Before or during development, I review your architecture with your team, model the threats and point out the decisions that create risk.
Get in touch
Quoted individually, based on the scope.
What's included
- A review of the architecture and data flows.
- Threat modeling: who could attack, how and what they would gain.
- Authentication, authorization and trust boundaries between components.
- Handling of secrets, encryption and sensitive data.
What you get
- Identified threats, each with its risk level and recommended controls.
- Concrete design changes, in order of priority.
Who it's for
- New products or features that handle sensitive data or money.
- Migrations to the cloud or to a new architecture.
Not included
- Implementing the changes (it can be quoted separately).
Frequently asked questions
When is the best time for an architecture review?
Before building, or as early as possible. It's useful at any stage, but the earlier it happens, the cheaper the changes.
Other services
- Secure code review A review of your code to find vulnerabilities before they reach production.
- DevSecOps Security built into your development process: pipelines, dependencies and secrets.
- Security training Hands-on secure development workshops for engineering teams.
- Web and API penetration testing Manual testing of web applications and APIs, the way an attacker would approach them.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.