MOBILE-ID · TRUSTED LTANS
Security Controls
Map risks, target controls, owners and security-acceptance evidence for each LTANS deployment.
From risk to control evidence
This is a control design and acceptance checklist. Organizational ISO certification does not replace LTANS control-enforcement evidence for a specific environment.
| Risk | Target control | Owner | Required evidence |
|---|---|---|---|
| Cross-tenant access | Owning-service object authorization, beyond the gateway. | Identity + service owner | Valid-token cross-tenant access must be denied; retain decision, not token. |
SSRF through dataReference/webhook | Policy allowlist, destination IP and redirects; recheck at connection. | Storage / Webhook + network | Block unauthorized internal destinations and out-of-scope DNS/redirects; no backend test supplied. |
| Bytes changed after freeze | Digest actual bytes and use revisioned object references. | Archive + Storage | One-byte modification fails reconciliation; never update the digest to hide edits. |
| Privileged misuse | Separate author/approve, scope and decision audit. | Policy owner + security | Test self-approval/scope escalation; claim enforcement only after environment acceptance. |
| Data/key disclosure | Store authorization, externalized secrets and minimized logs. | Storage + key custodian | Review logs/exports, key grants and authorized decryption recovery. |
| Evidence-history loss | Immutable revisions and consistent recovery points. | Evidence + Operations | Restore history/digests/material, not merely server uptime. |
| Replay/out-of-order delivery | Webhook signatures, inbox and current-state reconciliation. | Webhook + receiver | One eventId cannot repeat effects; old events cannot regress state. |
Complete security due diligence
- Agree data model, tenant, storage/keys and network boundaries before selecting controls.
- Retain approved configuration, test scope, positive/negative outcomes and open findings.
- Trust-source, privileged-rights and custody changes require impact review.