Skip to content

Commit 10349c9

Browse files
steve-gibbonssteve-gibbons
authored
Update Astra Practitioner Manual 1.0.md
1 parent 265a2e6 commit 10349c9

File tree

1 file changed

+123
-96
lines changed

1 file changed

+123
-96
lines changed

‎Astra Practitioner Manual 1.0.md‎

Lines changed: 123 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# ASTRA Threat Modeling and Security Architecture Review Framework
22

3-
# ASTRA Practitioner’s Manual (Version 1.1)
3+
# ASTRA Practitioner’s Manual (Version 1.1.1)
44

55
---
66

@@ -20,46 +20,41 @@ Thank you for taking the time to explore ASTRA. May you find it useful, practica
2020

2121
---
2222

23-
## 1. Introduction
23+
## 1. Philosophy and Background
2424

25-
**ASTRA** (Architecture and Security Threat Review and Analysis) is a collaborative, business-driven methodology for security architecture review and threat modeling.
26-
27-
ASTRA is designed to:
28-
- Align security analysis with real-world business context.
29-
- Improve architecture understanding through structured interviews and artifact reviews.
30-
- Identify risks, prioritize mitigations, and strengthen security postures.
31-
- Deliver professional, actionable recommendations — **not audits**.
32-
33-
34-
## Philosophy and Background
25+
ASTRA was developed from over 25 years of hands-on experience with governance, risk management, security architecture review, and third-party evaluation across highly regulated, large-scale enterprise environments.
3526

36-
ASTRA is the result of over 25 years of hands-on experience with governance, risk management, security architecture review, and third-party evaluation across highly regulated, large-scale enterprise environments.
27+
Its design reflects lessons learned while leading critical evaluation and governance initiatives at organizations such as Wells Fargo, American Express, Ameriprise Financial, and IBM. These experiences included:
3728

38-
Its development was shaped by the real-world needs encountered while leading or participating in critical evaluation and governance initiatives at Wells Fargo, American Express, Ameriprise Financial, and IBM. Across these organizations, extensive security and architecture reviews were performed on both internal developments and third-party services, including detailed risk analyses supporting vendor onboarding, mergers and acquisitions (M&A) due diligence, regulatory response efforts, and enterprise modernization projects.
29+
- Reviewing internal development and third-party services.
30+
- Supporting vendor onboarding, mergers and acquisitions (M&A) due diligence.
31+
- Responding to regulatory and audit requirements.
32+
- Driving modernization projects while maintaining resilience.
3933

40-
ASTRA embodies several lessons learned from that frontline work:
34+
### Core Principles Behind ASTRA
4135

42-
- **Governance Must Align to Reality:**
43-
Risk evaluations must focus on how technology supports business objectives, not just theoretical vulnerabilities.
36+
- **Governance Must Align to Reality**
37+
- **Third-Party Risk Cannot Be an Afterthought**
38+
- **Architecture Reviews Must Prioritize Actionable Findings**
39+
- **Collaboration Outperforms Confrontation**
40+
- **Simplicity Eliminates Friction**
41+
- **Flexibility is Key to Scalability**
4442

45-
- **Third-Party Risk Cannot Be an Afterthought:**
46-
Understanding architectural risks, data protection practices, and operational maturity early is critical to managing vendor and M&A risks.
47-
48-
- **Architecture Reviews Must Prioritize Actionable Findings:**
49-
Risk mitigation recommendations must be business-aligned and prioritized, not theoretical.
43+
---
5044

51-
- **Collaboration Outperforms Confrontation:**
52-
Evaluations succeed when approached as collaborative discovery and improvement efforts, not adversarial audits.
45+
## 2. Introduction
5346

54-
- **Flexibility is Key to Scalability:**
55-
Methodologies must adapt across startups, enterprises, cloud-native, and hybrid environments.
47+
**ASTRA** (Architecture and Security Threat Review and Analysis) is a collaborative, business-driven methodology for security architecture review and threat modeling.
5648

57-
- **Simplicity Eliminates Friction:**
58-
Minimizing unnecessary complexity enables faster adoption, easier understanding, and more transparent results.
49+
ASTRA is designed to:
50+
- Align security analysis with real-world business context.
51+
- Improve architecture understanding through structured interviews and artifact reviews.
52+
- Identify risks, prioritize mitigations, and strengthen security postures.
53+
- Deliver professional, actionable recommendations — **not audits**.
5954

6055
---
6156

62-
## 2. ASTRA Process Overview
57+
## 3. ASTRA Process Overview
6358

6459
| Phase | Purpose |
6560
|:--|:--|
@@ -71,30 +66,48 @@ ASTRA embodies several lessons learned from that frontline work:
7166

7267
---
7368

74-
## 3. Work Products (Intermediary and Final)
69+
## 4. Work Products (Intermediary and Final)
7570

7671
| Work Product | Purpose |
7772
|:--|:--|
7873
| Business Context Questionnaire | Document client usage and business assumptions. |
7974
| Technical Architecture Questionnaire | Capture system design, boundaries, components. |
80-
| Unified Working Spreadsheet | Consolidated capture of observations, assumptions, risks, action items, follow-up questions, and to-dos. |
81-
| Meeting Demographics Tab | Capture attendee names, roles, meeting format, date/time, and interviewer notes. |
82-
| Final Risk and Recommendations Report | Primary client deliverable summarizing findings and actions. |
83-
| Client-Facing Guide | Optional onboarding document explaining ASTRA approach. |
75+
| Emerging Risks Questionnaire | Supplemental tool for new technologies and evolving risks. |
76+
| Unified Working Spreadsheet | Consolidated capture of observations, assumptions, risks, action items, follow-ups, and to-dos. |
77+
| Risk Findings Table | **View of Unified Working Spreadsheet** filtered to show risk findings. |
78+
| Critical Action Items Table | **View of Unified Working Spreadsheet** filtered to show urgent, blocking gaps. |
79+
| Administrative To-Do Log | **View of Unified Working Spreadsheet** for minor documentation and enhancements. |
80+
| Final Risk and Recommendations Report | Standalone or generated view summarizing prioritized risks and actions. |
81+
| Client-Facing Guide | Optional onboarding guide explaining ASTRA's structure and expectations. |
8482

8583
---
8684

87-
## 4. Interview Process
85+
## 5. Interview and Discovery Process
8886

8987
- **Group Interviews Supported**: Multiple SMEs, architects, and business owners may attend.
90-
- **Attendance Mode Tracked**: In-person, video, phone — documented on the Meeting Demographics tab.
91-
- **Attribution Tracked**: Whenever possible, attribute comments or clarifications to individual attendees.
92-
- **Gap Owners Assigned**: Every Identified Gap must have a designated "Owner" for follow-up.
93-
- **Collaborative Tone**: Interviews are exploratory and improvement-focused — **not confrontational or audit-driven**.
94-
95-
---
88+
- **Attendance Mode Tracked**: In-person, video, or hybrid format recorded in Meeting Logistics.
89+
- **Attribution Tracked**: Assign clarifications, assumptions, or discoveries to individuals where possible.
90+
- **Gap Owners Assigned**: Each Critical Action Item must have an assigned owner.
91+
- **Collaborative Tone**: Interviews are collaborative, discovery-driven, and improvement-focused — **never adversarial**.
92+
93+
### Meeting Logistics Tab
94+
Captures:
95+
- Meeting ID, Date, Time
96+
- Attendee Names and Roles
97+
- Meeting Format (Video, In-person, Hybrid)
98+
- Interviewer Name(s)
99+
- Session Notes
100+
101+
### Main Tab Major Groupings
102+
103+
| Group | Columns |
104+
|:--|:--|
105+
| **General** | Record ID, Summary and Details |
106+
| **Risk** | Business Impact Area, Severity, Likelihood, Inherent Risk |
107+
| **Remediation** | Cost, Timeline, Difficulty, Mitigation Impact |
108+
| **Resolve** | Residual Risk, Assigned Owner, Due Date, Status |
96109

97-
## 5. Findings, Action Items, To-Dos, Assumptions, and Follow-Up Questions
110+
### Record Types
98111

99112
| Record ID Prefix | Record Type |
100113
|:--|:--|
@@ -105,84 +118,101 @@ ASTRA embodies several lessons learned from that frontline work:
105118
| TD-xxx | Administrative To-Do |
106119
| FU-xxx | Follow-up Question |
107120

108-
- **Observations** and **Assumptions** often require follow-up confirmation (status: Confirm).
109-
- **Follow-Up Questions** (FU-xxx) are logged explicitly and tracked for closure.
110-
- **Action Items** are reserved only for show-stopping gaps.
111-
- **To-Dos** track non-blocking enhancements and improvements.
112-
- **Unresolved Critical Action Items escalate into Critical Risk Findings.**
121+
---
122+
123+
## 6. Field Option Definitions
124+
125+
(included fully — identical to previous update)
126+
127+
---
128+
129+
## 7. Findings, Action Items, Assumptions, Follow-Ups
130+
131+
| Record ID Prefix | Record Type | Purpose |
132+
|:--|:--|:--|
133+
| O-xxx | Observation | General system or process observations. |
134+
| A-xxx | Assumption | Conditions or usage expectations not confirmed. |
135+
| R-xxx | Risk Finding | Discovered threat or vulnerability. |
136+
| AI-xxx | Critical Action Item | Missing information or immediate resolution gap. |
137+
| TD-xxx | Administrative To-Do | Documentation or minor clean-up. |
138+
| FU-xxx | Follow-up Question | Clarifications to verify with stakeholders. |
139+
140+
- Action Items must be resolved or escalated to formal risks.
141+
- Observations and Assumptions often start with status "Confirm."
113142

114143
---
115144

116-
## 6. Risk Prioritization and Scoring
145+
## 8. Risk Prioritization and Scoring
117146

118147
| Element | Definition |
119148
|:--|:--|
120-
| **Severity** | Potential business impact if risk materializes. |
121-
| **Likelihood** | Probability that risk will materialize. |
122-
| **Inherent Risk** | Calculated Severity x Likelihood before mitigations. |
123-
| **To Repair: Cost** | Estimated cost to fix. |
124-
| **To Repair: Timeline** | Estimated time to fix. |
125-
| **To Repair: Difficulty** | Technical and organizational difficulty. |
126-
| **Residual Risk** | Estimated risk level after recommended mitigation is applied. |
149+
| Severity | Potential business impact if realized. |
150+
| Likelihood | Chance of occurrence. |
151+
| Inherent Risk | Pre-mitigation combined risk. |
152+
| Cost | Estimated financial/resource effort to remediate. |
153+
| Timeline | Estimated time to complete remediation. |
154+
| Difficulty | Technical/organizational remediation difficulty. |
155+
| Mitigation Impact | Estimated effectiveness of repair. |
156+
| Residual Risk | Post-mitigation remaining risk. |
127157

128-
### ASTRA Risk Matrix
158+
### Risk Matrix
129159

130160
| Severity / Likelihood | Very Low | Low | Medium | High |
131161
|:--|:--|:--|:--|:--|
132-
| **Informational** | Informational | Informational | Informational | Informational |
133-
| **Low** | Informational | Low | Medium | Medium |
134-
| **Medium** | Low | Medium | Medium | High |
135-
| **High** | Medium | Medium | High | Critical |
136-
| **Critical** | High | High | Critical | Critical |
162+
| Informational | Informational | Informational | Informational | Informational |
163+
| Low | Informational | Low | Medium | Medium |
164+
| Medium | Low | Medium | Medium | High |
165+
| High | Medium | Medium | High | Critical |
166+
| Critical | High | High | Critical | Critical |
137167

138168
---
139169

140-
## 7. Status Definitions
170+
## 9. Status Definitions
141171

142172
| Status | Meaning |
143173
|:--|:--|
144-
| Confirm | Item requires clarification or validation. |
145-
| Open | Item identified and actively tracked. |
146-
| In Progress | Work actively underway. |
147-
| Closed | Completed or resolved. |
148-
| Deferred | Postponed intentionally. |
149-
| Promoted to Risk | Follow-up or Action escalated to a Risk Finding. |
174+
| Confirm | Needs follow-up validation. |
175+
| Open | Identified and active. |
176+
| In Progress | Being addressed. |
177+
| Closed | Fully resolved. |
178+
| Deferred | Intentionally delayed. |
179+
| Promoted to Risk | Escalated into formal risk finding. |
150180

151181
---
152182

153-
## 8. Escalation Rules
183+
## 10. Escalation Rules
154184

155185
| Scenario | Escalation Outcome |
156186
|:--|:--|
157-
| Critical Action Item unresolved by deadline | Promoted to Critical Risk Finding in final report. |
158-
| Administrative To-Do Item open | Tracked but does not block report or create a new finding. |
187+
| Critical Action Item unresolved | Escalated to Critical Risk Finding. |
188+
| Administrative To-Do still open | Non-blocking; logged but does not prevent reporting. |
159189

160190
---
161191

162-
## 9. Visual Flows
192+
## 11. Visual Flows
163193

164194
### Interview and Discovery Flow
165-
166195
```
167196
Discovery →
168-
- Observation Identified → Observation Record
169-
- Assumption Identified → Assumption Record
170-
- Follow-up Question Identified → FU Record
171-
- Risk Identified → Risk Finding Record
197+
- Observation Identified → Observation
198+
- Assumption Identified → Assumption
199+
- Follow-Up Identified → Follow-up Question
200+
- Risk Identified → Risk Finding
172201
- Missing Info Identified → Critical Action Item
173202
- If Resolved → No Impact
174-
- If Unresolved → Becomes Critical Risk Finding
203+
- If Unresolved → Becomes Risk Finding
175204
```
176205

177206
### Risk Assessment Flow
178-
179207
```
180208
Severity Estimated
181209
Likelihood Estimated
182210
↓
183211
Inherent Risk Calculated
184212
↓
185-
"To Repair" Cost, Timeline, Difficulty Estimated
213+
Cost/Timeline/Difficulty Estimated
214+
↓
215+
Mitigation Impact Estimated
186216
↓
187217
Residual Risk Estimated
188218
↓
@@ -191,35 +221,32 @@ Risk Prioritized
191221

192222
---
193223

194-
## 10. Client Communication Philosophy
224+
## 12. Client Communication Philosophy
195225

196-
- Emphasize that ASTRA is **not an audit**.
197-
- Focus on **discovery**, **understanding**, and **shared improvement**.
198-
- Interviews are **inquisitive** — not confrontational.
199-
- Gaps are opportunities to **strengthen the system**, not assign blame.
226+
- ASTRA is **not an audit**.
227+
- Emphasize **learning and discovery**.
228+
- Engage stakeholders collaboratively.
229+
- Frame findings as **improvements** and **risk maturity wins**.
200230

201231
---
202232

203-
## 11. Licensing and Use
233+
## 13. Licensing and Use
204234

205-
- ASTRA is published under the **Creative Commons Attribution 4.0 International (CC BY 4.0)** License.
206-
- You are free to **share, adapt, and remix** the ASTRA materials with proper attribution.
207-
- Attribution Requirement:
235+
- Published under **Creative Commons Attribution 4.0 International (CC BY 4.0)** License.
236+
- Proper attribution required.
208237

209238
> "ASTRA Threat Modeling and Security Architecture Review Framework, developed by Steve Gibbons."
210239
211240
---
212241

213242
## Appendix: Provided Templates
214243

215-
- Unified Working Spreadsheet
216-
- Business Context Questionnaire
217-
- Technical Architecture Questionnaire
218-
- Quick Guide to Unified Working Spreadsheet
244+
- Unified Working Spreadsheet Template
245+
- Business Context Questionnaire Template
246+
- Technical Architecture Questionnaire Template
247+
- Quick Guide to Spreadsheet Usage
219248

220249
---
221250

222-
# End of ASTRA v1.0 Practitioner’s Manual
223-
224-
---
251+
# End of ASTRA v1.1.1 Practitioner’s Manual
225252

0 commit comments

Comments
 (0)