عرض عملي: مراجعة النظام الفرعي للطلبات بعد إعادة تصميمه

خطوة بخطوة

1. Draw the redesigned data flow with trust boundaries: gateway, orders, payments adapter, Kafka, database, admin tool.
2. Walk each flow with STRIDE prompts and record threats.
3. Build the authorization matrix and test cross-customer access on internal endpoints.
4. Planned mistake: review only the public API. Fix: include internal calls, consumers, and the admin tool, where a missing check is found.
5. Rate each finding, assign owners and dates, and mark one accepted risk with an expiry.
6. Write the summary and agree actions with the role-played security lead.

اختبر فهمك