shaping-reviewing-security

A security review evaluates threat models, authentication, authorization, PII handling, and data protection within an architecture sketch to identify risks and provide mitigation recommendations before implementation begins.

Threat modeling identifies potential threats and attack vectors against your architecture sketch and API contract. You need it after architecture shaping is complete to ensure the design adequately addresses security concerns and prevents costly post-implementation fixes.

Assessing third-party risk and data protection involves evaluating security posture across input validation, audit logging, and PII handling dimensions within your architecture sketch, generating detailed findings by severity with actionable mitigation recommendations.

Yes, the security review specifically requires a completed architecture sketch and API contract as input. It evaluates authentication, authorization, and threat models against these artifacts to produce a pre-implementation risk assessment with mitigation recommendations.

The best way is conducting a dimension evaluation that assesses security posture across authentication, authorization, input validation, and audit logging, generating findings by severity with actionable recommendations for pre-implementation risk assessment.

Running a security risk assessment before implementation identifies and mitigates potential threats, PII handling issues, and authorization gaps in the architecture sketch early, preventing costly post-implementation fixes and ensuring the design adequately addresses security concerns.