Corstorphine Building Society / BG-Demo – Security Review
Callcompleted
Corstorphine Building Society · 1 Oct 2026 16:45
Security review on 1 Oct 2026: Euan Rattray is minded to accept the just-in-time access design as evidenced, but keeps the post-incident finding open until both actions are complete, due by the end of December.
What was said
What this says
As at Fri 9 Oct 2026Security review on 1 Oct 2026: Euan Rattray is minded to accept the just-in-time access design as evidenced, but keeps the post-incident finding open until both actions are complete, due by the end of December.
What happened: Euan Rattray, Head of Information Security, went through his open findings with Hannah Lowe and Tobias Renwick. Tobias showed just-in-time access and the grant log in a sandbox account, not a live customer.
Customer view: Euan is minded to treat the access design as evidenced, subject to a failed-revoke test. He keeps the finding on the post-incident actions open until both are complete, and wants controls, not policies, as evidence.
Commercial: Euan said price is for the people who sign, so the call carries no commercial signal. The evidence does not show the contract or tier.
Watch: The failed-revoke test must run cleanly in the sandbox. Tobias committed both post-incident actions to the end of December.
Themes
As at Fri 9 Oct 2026Theme
Security review, access finding
Importance
neutral
Sentiment
mixed
Voice
unknown
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Hannah Lowe sends the failed-revoke test output unedited, with the configuration reference and connector credential scoping, first.
- Tobias Renwick updates the finding tracker with a date against each post-incident action and sends evidence for the first action as soon as it is ready.
- Hannah Lowe answers the pending questionnaire sections after checking two with Tobias.
Risks
As at Fri 9 Oct 2026- The finding on the two post-incident actions stays open until both are complete and evidenced, due by the end of December.
- The access design is accepted only subject to the failed-revoke test running cleanly in the sandbox.
- Connector service identities are not just-in-time and the questionnaire still has pending sections, so Euan may press further.
Opportunities
As at Fri 9 Oct 2026- Euan treats the just-in-time access design as evidenced, which moves the security review towards closure.
Transcript
Hannah LoweHello, can you hear me all right? I've got the recording indicator, so we should be live.
Euan RattrayGood afternoon, Hannah. Yes, clear, thank you.
Tobias RenwickAfternoon both. Apologies, I'm just waiting for my camera to behave. There we are.- Hannah LoweGood. Euan, before we start, what do you most need out of today? I'd rather aim at that than walk you through slides you've already seen.
- Euan RattrayThat's fair. I'll go through my open findings, if I may, because that is how I report them to the risk committee. It keeps the record tidy on my side.
- Tobias RenwickPlease do. That's the order I'd prefer as well.
- Euan RattrayThank you. So, as I have it, we closed the questions on where the data sits and on the sub-processor list at the last session. Those are closed with evidence, and I've noted them as such. What remains is the access finding, which is the one I care most about, and then the finding on the post-incident actions. Is that your understanding?
- Hannah LoweYes, that matches my notes. Two open, and the access one is really the reason Tobias is here today rather than me. To be precise, I can describe the access model, but he designed it, and I'd rather you heard it from him.
- Tobias RenwickRight. Euan, can I state the assumption first, because the conclusion only makes sense with it? The assumption is that BG-Demo runs inside your Snowflake account, not alongside it. So the question is never whether we hold your data. We don't. The question is what our engineers can do inside your account, and for how long.
- Euan RattrayUnderstood. And my question has been the same since the first session. Who has standing access?
- Tobias RenwickThe honest answer is that nobody at BG-Demo has standing access to your account. None. What we have is just-in-time access, and I'd like to evidence that rather than describe it, if you're happy for me to share my screen.
- Euan RattrayPlease. Evidence rather than assurance.
- Tobias RenwickGive me a moment. I'm pulling up the sandbox account we use to demonstrate this, so I'm not showing you anything from a live customer. Hannah, shout if the sharing doesn't come through.
- Hannah LoweI can see a role list. Euan, can you?
- Euan RattrayI can. It's a little small, but legible.
- Tobias RenwickI'll enlarge it. So, the list you can see is every role in the account that carries any BG-Demo engineering privilege. In the resting state, no named person is granted any of them. The roles exist, they are empty, and they are owned by your administrators, not by us.
- Euan RattrayOwned by whom, specifically? In our case I'd want that to be a role within my own function or the platform team, not a generic administrator.
- Tobias RenwickThat's your decision, and it should be. In the design, the approver is a role you nominate. Many customers choose the security team plus a platform lead, so that two roles can approve and neither can approve their own request.
- Euan RattrayTwo approvers, separate from the requester. Noted. Carry on.
- Tobias RenwickSo here is the flow. An engineer raises a request that names the ticket, the reason, and the role they need. It goes to your approver. If it's approved, the grant is time-bound. The default is a short window, and it can be shortened further by you, but it cannot be extended by us. When the window ends the grant is revoked by the platform, not by a person remembering to do it.
- Euan RattrayNot by a person remembering. Good. But what stops an engineer extending the window by raising a second request immediately?
- Tobias RenwickNothing stops them raising it, and that is deliberate. What happens is that the second request goes to your approver as a fresh request, with the first one visible alongside it. So the extension is a decision somebody on your side makes, with the history in front of them.
- Hannah LoweIf I can add one thing from the connector side. We've seen customers worry about exactly that pattern, so on the approval screen the previous grant for the same engineer is shown by default. It isn't something the approver has to go looking for.
- Euan RattrayRight. Now, show me the log. I don't want to hear that it's logged. I want to see what a grant looks like after the fact.
- Tobias RenwickOf course. Let me find a grant from the rehearsal we ran earlier this week. One moment.
- Tobias RenwickHere. This is the record in the account's own history. You can see the requester, the approver, the role, the time the grant was issued, the time it was revoked, and the statements the engineer ran in between. These are written into your Snowflake account history, so they sit in your retention, not ours.
- Euan RattrayCan you scroll? I want to see whether the revocation is a separate event or just a field on the grant.
- Tobias RenwickSeparate event. There, the revoke is its own line with its own timestamp, and it's attributed to the system, not a person.
- Euan RattrayMm. And if the revoke fails?
- Tobias RenwickThe short version is that it raises an alert to your side as well as ours. I should be careful here, though. Hannah, I'd like you to put the exact alert behaviour in writing, because I don't want to paraphrase a control from memory in front of Euan.
- Hannah LoweI'll put that in writing, with the configuration reference, so you can check it against what's actually deployed. I'll also say that I'd rather it came with a test, so you can trigger a failed revoke in the sandbox and watch what happens.
- Euan RattrayA test would be better than a document. I'd accept the test result as evidence.
- Hannah LoweThen that's what you'll get. Tobias, would the sandbox run it cleanly?
- Tobias RenwickIt should. I'd rather confirm that than promise it. Let's say Hannah runs it before she sends it, and the output goes to you unedited.
- Euan RattrayUnedited. Good.
- Euan RattrayLet me press on one more point on access, then. Emergencies. Suppose something is wrong on a Sunday night and your approver on our side isn't reachable. Is there a break-glass route that bypasses the approval?
- Tobias RenwickNo. That is the trade-off, and I'll state it plainly. There is no route that bypasses your approver. The cost is that out of hours, a fix can wait until someone on your side approves. The benefit is that I can tell you, without qualification, that nobody can get in without a person at Corstorphine saying yes.
- Euan RattrayThat is a better answer than I expected. Most suppliers have a break-glass account and describe it as exceptional.
- Tobias RenwickWe had one, in a much earlier version, and we removed it. It's part of the story I'd like to come to, because it relates to your second finding.
- Euan RattrayPlease do. What's the incident history? That's the question I have to be able to answer to the committee.
- Tobias RenwickI'll be careful and exact. You have the incident review we shared in the last session. It was a blameless review, and the point of that is that it names what the system allowed, not who touched it. It led to two actions. Both are about making the access model I've just shown you harder to get wrong, and both are still in progress.
- Euan RattrayIn progress is not complete. I'm not being difficult, but my finding stays open until they're complete and evidenced.
- Tobias RenwickI agree, and I'd rather you kept it open than closed it on my word. The first action is further along than the second. The second depends on work that needs a proper test window, and I'd rather not compress that to give you a tidier date.
- Euan RattraySo give me the date, not the reassurance. When will both be done?
- Tobias RenwickBoth actions are due to be complete by the end of December. That's the commitment, and I'll put it in the finding tracker against each action, not just against the pair. I'd rather not offer you an earlier date and miss it.
- Euan RattrayEnd of December. The last day of the year, in effect?
- Tobias RenwickYes. The last day of the year is the due date. If the first action lands earlier, I'll send you the evidence for it as soon as it does, so you aren't waiting for the pair.
- Hannah LoweAnd to be clear for the tracker, Euan, we'd expect to send you evidence for each, not a summary. For the first, that's the configuration as deployed plus a before and after. For the second, the test output.
- Euan RattrayThat's acceptable. What I won't accept is a reference to a policy in place of the control itself. If the evidence is a policy document, I'll treat it as not evidenced.
- Hannah LoweUnderstood. Controls, not policies.
- Euan RattrayThen let me record where we are. The access finding: I've seen the just-in-time model evidenced today, I've seen the history sitting in our own account, and I've heard that there's no bypass. I'm minded to treat the design as evidenced. But I'm leaving the finding open, formally, because it is linked to the two post-incident actions and they aren't done.
- Tobias RenwickThat seems entirely right to me.
- Euan RattrayGood. I do have some smaller questions, if there's time. Hannah, this one's for you. Service accounts used by the connectors. Are they covered by the same approach?
- Hannah LoweThe short answer is no, and the longer answer is why. Connectors need to run unattended every night, so they use service identities, and those are scoped to the sources they read from. They don't have engineer privileges, and they can't be used to log in interactively. But they're not just-in-time, so I wouldn't want you to hear that they were.
- Euan RattrayThank you for saying so. That is the sort of distinction I'm looking for. Who owns the credentials?
- Hannah LoweIn your deployment they'd be created in your account by your administrators, under your naming standard, and rotated on your schedule. We never hold the secret. I'll include that in the writing, with the scoping for each connector you've asked about.
- Euan RattrayPlease do. And what should I expect for the questionnaire on the remaining sections? There were several areas still marked as pending.
- Hannah LoweI have those open as well. I'd like to answer them right the first time, so I'll check two with Tobias before I send, rather than give you something I'd have to amend.
- Tobias RenwickI'm happy to be the checker. Euan, if any of them touch the architecture, I'd rather they came back with a diagram. One page, so your committee can follow it without us in the room.
- Euan RattrayOne page is welcome. The committee reads on paper and has little patience.
- Tobias RenwickThat I can respect. A design that can't be explained on one page is usually a design with something wrong in it.
- Euan RattrayQuite. One last matter, and it's more about process than control. Who at BG-Demo should I write to if I'm not satisfied with an answer? I don't want it to disappear into a general inbox.
- Hannah LoweWrite to me for anything technical, and copy Tobias. For commercial matters, that's Tom Ashdown, though I gather you don't tend to discuss those.
- Euan RattrayI don't. Price is for the people who sign. My concern is whether the controls are real.
- Tobias RenwickUnderstood. And I'd add that if a finding stays open because we're late, I'd rather you told the committee that than had us hide it. We'd prefer an honest open finding to a closed one nobody believes.
- Euan RattrayThat's the right attitude, and I'll note it. Let me read back what I'm taking away, then, so that we agree.
- Euan RattrayOne. Just-in-time access has been evidenced in this session, and the design is accepted, subject to the failed-revoke test. Two. Hannah sends the test output unedited, with the configuration reference and the connector credential scoping. Three. The finding on the post-incident actions stays open until both are complete and evidenced, due by the end of December. Four. Evidence for the first action comes as soon as it's ready, and not held back for the pair. Is that fair?
- Tobias RenwickThat's exactly my understanding. I'd only add that I'll update the tracker today, so the dates are written down on our side as well as yours.
- Hannah LoweAnd mine. I'll send the written summary of today, including the access model as described, so you can compare it with what you heard. Thanks, Euan, I know that you push hard on these, and it makes the answers better.
- Euan RattrayThat's the job. Thank you both. I'll expect the test output first, then the questionnaire sections.
- Tobias RenwickThank you, Euan. Best to your committee.
- Euan RattrayGoodbye.
- Hannah LoweBye both. Speak soon.
Callsmade from