Review Template

Overviews¶

According to the clean source principle, any dependencies of your system(s) need to be as secure as your system at a minimum. Otherwise, your system's top security level degrades to match the security level of the least secure dependency. This is especially important for dependencies that are part of your supply chain, such as cloud providers, hosting providers, and other third-party services.

The review templates are guided by the various security principles (including but not limited to):

• Assume Breach: Design as if something is already compromised.
• Defense in Depth: Avoid single-control security designs.
• Shared Responsibility: Know what the provider handles and what remains your responsibility.
• CIA: Evaluate confidentiality, integrity, and availability across each layer.
• Clean Source: Protect upstream/ systems that control downstream systems.
• Security Through Obscurity: Treat hidden details as supporting friction, not primary protection.