BlogSecurity
The security risks hidden in business workflows
How to identify security questions in the steps of a business process.
An application can validate individual requests and still allow a sequence of actions that breaks a business rule. To find those risks, teams need to understand what a workflow is supposed to permit, who can act and what happens when steps occur out of order.
Start with the intended process
Imagine a fictional expense system: an employee submits a claim, a manager approves it and finance processes payment. The important rule is not simply whether each screen loads. It is whether the right person approves the right version of the claim before payment.
Map the actors, states and transitions with someone who owns the process. Note which fields can change after approval, who can cancel an action and which systems receive events. Do not assume that a technical implementation reflects the intended rule.
Consider exceptions and timing
Ask what should happen if a request is repeated, two users act at nearly the same time, or a downstream service is temporarily unavailable. Could an approved amount change before payment? Can an action be repeated after it has already completed? These are questions to investigate, not evidence that a particular system is vulnerable.
Test only with explicit authorisation, agreed accounts and safe data. Agree boundaries for side effects such as payments, emails and third-party services; a test environment or sandbox may be appropriate.
Turn questions into checks
Document the expected outcome for both permitted and prohibited actions. Review the relevant application and integration boundaries, then record observations, gaps and uncertainty. When a fix is made, check that it prevents the unwanted sequence while preserving the legitimate workflow.
Our tailored security service starts with the software and processes that matter to your organisation.
