Template
Security review template
Before something new goes live: what data it touches, how it could be attacked or misused, what protects it today, and what must be fixed before launch.
The agenda, with a time for each part
- What is being built, and what data it touches10 min
- What personal or sensitive data passes through it, and where is it stored?
- How it could be attacked or misused20 min
- Who could pretend to be somebody else here?
- What could leak if this part were exposed?
- What protects it today10 min
- Which of these threats are already covered, and by what?
- Gaps, and how serious each is10 min
- Which gap would hurt most if found tomorrow?
- What must be done before launch10 min
- What blocks the launch, and what can follow after?
How the notes read afterwards
A made-up example, so you can see the shape. In a real call each line carries the words that were said and who said them.
Data. Names, email addresses and uploaded ID documents, stored in one bucket.
Threat. Anyone with a document's link could open it.
Today. Links are long and random, but never expire.
Before launch. Links expire after 15 minutes (Nora). After. Delete documents 30 days after checks are done (Tom, by March).
Running it well
- Draw how the data moves before the meeting — from the user, through each service, to where it is stored. Most problems show up on the drawing.
- Use a simple checklist of threat types so nothing is missed: pretending to be someone, changing data, denying an action, leaking data, taking the service down, and gaining more access than allowed.
- Split the fixes into must-do-before-launch and can-follow, with dates. A list with no split either blocks everything or nothing.
Ways to change it
When to skip it. For changes that touch no data and no access rules — a new colour, a copy change.
Questions
What is a security review?
A check before launch of how a new feature or system could be attacked or misused, what protects it, and what must be fixed first.
What is threat modelling?
Working through how a system could be attacked, step by step, usually from a drawing of how data moves through it. STRIDE, from Microsoft, is a common checklist of threat types.
When should a security review happen?
Once the design is clear and before it goes live — early enough that fixing a problem is still cheap.
What happens in the room
Everybody joins from the link, with no account. The agenda sits beside the call and each item fills in with what was said about it, under the name of the person who said it.
More templates
Try Meetful
Meetings that take their own notes
Free video meetings in the browser: every line of the transcript under the name of who said it, and the summary and action items when you hang up. Nothing to install — guests just open the link.