Seriously. This fits directly one of my go to examples of a user story that needs security constraints: "As customer service, I need to be able to help my cust

Seriously. This fits directly one of my go to examples of a user story that needs security constraints: "As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us." I'm teaching a group of developers about Risk Assessment and threat modeling on Wednesday. This is perfect timing to enhance the lesson slides with this story and have them think about "Fraud Against People Assets". As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us. Security Threat: Customer service agents may use their trusted access for fraudulent, purposes. Compensating Controls / Acceptance Criteria 1. Software should log all customer service actions and write to a file that is kept for 1 year for review 2. Users should be informed that their actions are logged in clear, bold language when accessing customer portal 3. Notify customers at already known contact when anything about their account is changed by customer service portal