Showing 13–24 of 35 articles
Page 2 of 3
How to threat-model a small product in one sitting
Start with one important journey through your product. Follow the data, identities, and trust boundaries, then ask what misuse could cause a meaningful consequence.
Read the visual guide
How a small organisation should give volunteers access
Volunteers need access that fits their actual work, including a clear owner and a defined review point. Shared accounts and indefinite permissions make changes harder to control.
Read the visual guide
Account recovery that can walk around the second check
Strong sign-in protection can be undermined by a weaker recovery process. Review every way to regain access, including support-assisted changes and replacement recovery details.
Read the visual guide
Change the default passwords on network appliances
A device may have separate credentials for administration, monitoring, support, and cloud services. Review all of them before deciding that the factory access has been removed.
Read the visual guide
An open-source licence is not a security review
Being able to inspect source code is valuable, but it does not prove that a component has been reviewed or is safe for your use. Assess the actual dependency and its operating context.
Read the visual guide
Why two people should approve a payment
A second approval helps only when it independently checks the important details. Tie the review to the actual beneficiary, amount, and transaction that will be released.
Read the visual guide
Who should be allowed to change your DNS records
Control of DNS can affect email, websites, and other essential services. Identify the registrar, DNS host, privileged users, and applications that can change records.
Read the visual guide
What to do when a password is pasted into chat
Deleting a chat message does not invalidate a password or token that someone may have copied. Identify the credential, revoke or rotate it, and review its possible use.
Read the visual guide
What encryption at rest and in transit each protect
Storage encryption and connection encryption protect different parts of a data journey. Neither replaces the decision about who can ask the service to reveal the information.
Read the visual guide
Who should have administrator rights on a work laptop
Administrator access changes what software can do to a device. Limit routine privilege while giving staff a clear, workable route for approved installation and support.
Read the visual guide
What you still have to secure when you use the cloud
A managed cloud service does not remove every security responsibility from your team. Map the provider’s role and your own configuration, identities, data, and recovery duties.
Read the visual guide
How long a shared file link should stay open
A sharing link should serve a specific task and audience. Named recipients, suitable permissions, and an expiry date can reduce access that continues after the work is done.
Read the visual guide