Software

We build software that puts specialist risk methods in the hands of the organisations that need them, so work that needed an expert every time can be run, repeated and evidenced in-house.

InternetHosted serviceInternal network16F1 requestsF110F2 identity tokenF212F3 API callsF310F4 queriesF48F5 admin actionsF56F6 jobsF69F7 job writesF7UserbrowserIdentityproviderWeb frontendAPIJob queueAdminconsoleDatabase
InternetHosted serviceInternal network16F110F212F310F48F56F69F7UserbrowserIdentityproviderWeb frontendAPIJob queueAdminconsoleDatabase
  • F1 requests
  • F2 identity token
  • F3 API calls
  • F4 queries
  • F5 admin actions
  • F6 jobs
  • F7 job writes
9
Risk score, likelihood × impact
1 low25 high

4 of 8 threats to treat at an appetite of 9.

Treat, highest first
  • 16Session token theft and replay
  • 12Missing authorisation check on an API route
  • 10Forged identity token accepted
  • 10Injection through query parameters
Accept, 4 threats, scores 6 to 9
  • 9Request flooding
  • 9Queue worker holds wider write access than it needs
  • 8Misuse of a privileged admin action
  • 6Job message tampered with in transit
View system model, 7 components, 7 flows, 3 trust boundaries Units risk score, 1 to 25 Source synthetic model Point at a threat for its flow and scoring