Sample Assessment Report
Redacted for confidentiality
Architecture Review
Security Architecture Assessment
Confidential Client — FinTech Startup (Series B)
AWS-hosted microservices architecture (14 services), API gateway, authentication service, data processing pipeline, third-party integrations (3 payment providers, 2 identity providers)
7 business days
STRIDE Threat Modelling
Executive Summary
UnlockSec performed a threat-model-driven architecture review of the client's cloud-native financial platform. The review identified fundamental trust boundary weaknesses between microservices, an absence of secrets management leading to credentials stored in environment variables, and a data flow design that routes raw PII through a logging service without field-level filtering.
Methodology
Sample Findings
PII Data Flow — Unfiltered Logging of Financial Records
Description
The centralised logging pipeline ingests raw API request and response payloads without field-level filtering. This causes customer PAN, CVV, bank account numbers, and SSN values to be stored in plaintext in CloudWatch Logs, accessible to any principal with CloudWatch read permissions (currently 47 IAM users).
Recommendation
Implement field-level filtering in the logging pipeline to redact sensitive fields before ingestion. Apply data classification tagging to all data flows. Conduct a GDPR/PCI-DSS data flow mapping exercise.
Microservice Trust — No Service-to-Service Authentication
Description
Internal microservice communication is unauthenticated — any service within the VPC can call any other service's internal API endpoints without presenting credentials. Compromise of any single microservice provides unrestricted access to all internal APIs.
Recommendation
Implement mutual TLS (mTLS) for all service-to-service communication. Use AWS IAM service accounts with instance profile roles. Consider a service mesh (AWS App Mesh) for certificate management and policy enforcement.
Secrets Management — Credentials in Lambda Environment Variables
Description
Database passwords, third-party API keys, and JWT signing secrets are stored as Lambda function environment variables in plaintext. These are visible to any IAM principal with lambda:GetFunctionConfiguration permission and are logged in CloudTrail.
Recommendation
Migrate all secrets to AWS Secrets Manager or Parameter Store (SecureString). Rotate all currently exposed credentials. Restrict lambda:GetFunctionConfiguration to the deployment pipeline role only.
Missing Egress Controls — Data Exfiltration Path
Description
All VPC subnets have unrestricted internet egress via a NAT gateway with no network-level filtering. A compromised Lambda function or container can exfiltrate data to any internet destination without detection or blocking.
Recommendation
Implement VPC endpoint policies to restrict AWS service access. Add an egress firewall (AWS Network Firewall) with domain allowlist filtering. Instrument all outbound connections with VPC Flow Logs and CloudWatch alarms.
* Showing 4 of 33 total findings. Full report provided upon engagement.
Risk Summary
Deliverables Included
- STRIDE threat model with attack surface diagram
- Data flow security analysis with PII mapping
- Trust boundary assessment per microservice
- Secure architecture target state recommendations
- Risk-ranked remediation roadmap (30/60/90-day plan)
Ready for a real assessment?
Get a tailored Architecture Review engagement led by certified operators with unlimited retests.
Request AssessmentView All Services