Service Overview
The Software Architecture Review, also referred to as Application Threat Modeling, is a structured evaluation of the high-level applicative architecture of a planned or existing system. The objective is to map potential threats, assess the associated risks, and provide actionable recommendations to improve the system's security posture.
Methodology
This activity supports defense-in-depth and secure-by-design practices by identifying hidden vulnerabilities, design flaws, and implementation errors that are hard or impossible to detect through standard penetration testing.
Deliverables
Following the assessment, the client receives a report that includes:
Executive Summary
Application Introduction
Potential Findings
Verified Findings
Attack Scenarios
Prerequisites
To begin the assessment, the following information is required:
General system description, including a list of roles and user types
High-level architecture diagram
Known threats or probable attack scenarios (if available)
Customer Engagement
Client participation involves:
Two meetings during the first week for a guided review of the system’s architecture
A total of 5 to 7 meetings, each approximately one hour
Availability of the system manager and/or a senior R&D team member for these sessions
Relevant Standards
The methodology is based on the following standards and models:
OWASP Application Security Verification Standard (ASVS)
NIST Cybersecurity Framework
STRIDE model (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
CIA triad (Confidentiality, Integrity, Availability)
Security Domains Covered
Cross-organization policies, procedures, and governance
Security operations, monitoring, and incident response
Network level security
Servers, network equipment, and endpoint security
Application-level security
Sensitive data and information management
Identity management and remote access