Corstorphine Building Society / BB-Demo – Security Review
Callcompleted
Corstorphine Building Society · 2026-10-01 16:45
Security review on 1 Oct 2026: Euan Rattray is minded to accept the just-in-time access design as evidenced, but keeps the post-incident finding open until both actions are complete, due by the end of December.
What was said
What this says
Current to 13 Oct 26Security review on 1 Oct 2026: Euan Rattray is minded to accept the just-in-time access design as evidenced, but keeps the post-incident finding open until both actions are complete, due by the end of December.
What happened: Euan Rattray, Head of Information Security, went through his open findings with Hannah Lowe and Tobias Renwick. Tobias showed just-in-time access and the grant log in a sandbox account, not a live customer.
Customer view: Euan is minded to treat the access design as evidenced, subject to a failed-revoke test. He keeps the finding on the post-incident actions open until both are complete, and wants controls, not policies, as evidence.
Commercial: Euan said price is for the people who sign, so the call carries no commercial signal. The evidence does not show the contract or tier.
Watch: The failed-revoke test must run cleanly in the sandbox. Tobias committed both post-incident actions to the end of December.
Themes
Current to 9 Oct 26Theme
Security review, access finding
Importance
neutral
Sentiment
mixed
Voice
unknown
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Hannah Lowe sends the failed-revoke test output unedited, with the configuration reference and connector credential scoping, first.
- Tobias Renwick updates the finding tracker with a date against each post-incident action and sends evidence for the first action as soon as it is ready.
- Hannah Lowe answers the pending questionnaire sections after checking two with Tobias.
Risks
Current to 9 Oct 26- The finding on the two post-incident actions stays open until both are complete and evidenced, due by the end of December.
- The access design is accepted only subject to the failed-revoke test running cleanly in the sandbox.
- Connector service identities are not just-in-time and the questionnaire still has pending sections, so Euan may press further.
Opportunities
Current to 9 Oct 26- Euan treats the just-in-time access design as evidenced, which moves the security review towards closure.
Transcript
Hannah Lowe NoneHello, can you hear me all right? I've got the recording indicator, so we should be live.
Euan Rattray NoneGood afternoon, Hannah. Yes, clear, thank you.
Tobias Renwick NoneAfternoon both. Apologies, I'm just waiting for my camera to behave. There we are.- Hannah Lowe NoneGood. Euan, before we start, what do you most need out of today? I'd rather aim at that than walk you through slides you've already seen.
- Euan Rattray NoneThat's fair. I'll go through my open findings, if I may, because that is how I report them to the risk committee. It keeps the record tidy on my side.
- Tobias Renwick NonePlease do. That's the order I'd prefer as well.
- Euan Rattray NoneThank you. So, as I have it, we closed the questions on where the data sits and on the sub-processor list at the last session. Those are closed with evidence, and I've noted them as such. What remains is the access finding, which is the one I care most about, and then the finding on the post-incident actions. Is that your understanding?
- Hannah Lowe NoneYes, that matches my notes. Two open, and the access one is really the reason Tobias is here today rather than me. To be precise, I can describe the access model, but he designed it, and I'd rather you heard it from him.
- Tobias Renwick NoneRight. Euan, can I state the assumption first, because the conclusion only makes sense with it? The assumption is that BB-Demo runs inside your Snowflake account, not alongside it. So the question is never whether we hold your data. We don't. The question is what our engineers can do inside your account, and for how long.
- Euan Rattray NoneUnderstood. And my question has been the same since the first session. Who has standing access?
- Tobias Renwick NoneThe honest answer is that nobody at BB-Demo has standing access to your account. None. What we have is just-in-time access, and I'd like to evidence that rather than describe it, if you're happy for me to share my screen.
- Euan Rattray NonePlease. Evidence rather than assurance.
- Tobias Renwick NoneGive me a moment. I'm pulling up the sandbox account we use to demonstrate this, so I'm not showing you anything from a live customer. Hannah, shout if the sharing doesn't come through.
- Hannah Lowe NoneI can see a role list. Euan, can you?
- Euan Rattray NoneI can. It's a little small, but legible.
- Tobias Renwick NoneI'll enlarge it. So, the list you can see is every role in the account that carries any BB-Demo engineering privilege. In the resting state, no named person is granted any of them. The roles exist, they are empty, and they are owned by your administrators, not by us.
- Euan Rattray NoneOwned by whom, specifically? In our case I'd want that to be a role within my own function or the platform team, not a generic administrator.
- Tobias Renwick NoneThat's your decision, and it should be. In the design, the approver is a role you nominate. Many customers choose the security team plus a platform lead, so that two roles can approve and neither can approve their own request.
- Euan Rattray NoneTwo approvers, separate from the requester. Noted. Carry on.
- Tobias Renwick NoneSo here is the flow. An engineer raises a request that names the ticket, the reason, and the role they need. It goes to your approver. If it's approved, the grant is time-bound. The default is a short window, and it can be shortened further by you, but it cannot be extended by us. When the window ends the grant is revoked by the platform, not by a person remembering to do it.
- Euan Rattray NoneNot by a person remembering. Good. But what stops an engineer extending the window by raising a second request immediately?
- Tobias Renwick NoneNothing stops them raising it, and that is deliberate. What happens is that the second request goes to your approver as a fresh request, with the first one visible alongside it. So the extension is a decision somebody on your side makes, with the history in front of them.
- Hannah Lowe NoneIf I can add one thing from the connector side. We've seen customers worry about exactly that pattern, so on the approval screen the previous grant for the same engineer is shown by default. It isn't something the approver has to go looking for.
- Euan Rattray NoneRight. Now, show me the log. I don't want to hear that it's logged. I want to see what a grant looks like after the fact.
- Tobias Renwick NoneOf course. Let me find a grant from the rehearsal we ran earlier this week. One moment.
- Tobias Renwick NoneHere. This is the record in the account's own history. You can see the requester, the approver, the role, the time the grant was issued, the time it was revoked, and the statements the engineer ran in between. These are written into your Snowflake account history, so they sit in your retention, not ours.
- Euan Rattray NoneCan you scroll? I want to see whether the revocation is a separate event or just a field on the grant.
- Tobias Renwick NoneSeparate event. There, the revoke is its own line with its own timestamp, and it's attributed to the system, not a person.
- Euan Rattray NoneMm. And if the revoke fails?
- Tobias Renwick NoneThe short version is that it raises an alert to your side as well as ours. I should be careful here, though. Hannah, I'd like you to put the exact alert behaviour in writing, because I don't want to paraphrase a control from memory in front of Euan.
- Hannah Lowe NoneI'll put that in writing, with the configuration reference, so you can check it against what's actually deployed. I'll also say that I'd rather it came with a test, so you can trigger a failed revoke in the sandbox and watch what happens.
- Euan Rattray NoneA test would be better than a document. I'd accept the test result as evidence.
- Hannah Lowe NoneThen that's what you'll get. Tobias, would the sandbox run it cleanly?
- Tobias Renwick NoneIt should. I'd rather confirm that than promise it. Let's say Hannah runs it before she sends it, and the output goes to you unedited.
- Euan Rattray NoneUnedited. Good.
- Euan Rattray NoneLet me press on one more point on access, then. Emergencies. Suppose something is wrong on a Sunday night and your approver on our side isn't reachable. Is there a break-glass route that bypasses the approval?
- Tobias Renwick NoneNo. That is the trade-off, and I'll state it plainly. There is no route that bypasses your approver. The cost is that out of hours, a fix can wait until someone on your side approves. The benefit is that I can tell you, without qualification, that nobody can get in without a person at Corstorphine saying yes.
- Euan Rattray NoneThat is a better answer than I expected. Most suppliers have a break-glass account and describe it as exceptional.
- Tobias Renwick NoneWe had one, in a much earlier version, and we removed it. It's part of the story I'd like to come to, because it relates to your second finding.
- Euan Rattray NonePlease do. What's the incident history? That's the question I have to be able to answer to the committee.
- Tobias Renwick NoneI'll be careful and exact. You have the incident review we shared in the last session. It was a blameless review, and the point of that is that it names what the system allowed, not who touched it. It led to two actions. Both are about making the access model I've just shown you harder to get wrong, and both are still in progress.
- Euan Rattray NoneIn progress is not complete. I'm not being difficult, but my finding stays open until they're complete and evidenced.
- Tobias Renwick NoneI agree, and I'd rather you kept it open than closed it on my word. The first action is further along than the second. The second depends on work that needs a proper test window, and I'd rather not compress that to give you a tidier date.
- Euan Rattray NoneSo give me the date, not the reassurance. When will both be done?
- Tobias Renwick NoneBoth actions are due to be complete by the end of December. That's the commitment, and I'll put it in the finding tracker against each action, not just against the pair. I'd rather not offer you an earlier date and miss it.
- Euan Rattray NoneEnd of December. The last day of the year, in effect?
- Tobias Renwick NoneYes. The last day of the year is the due date. If the first action lands earlier, I'll send you the evidence for it as soon as it does, so you aren't waiting for the pair.
- Hannah Lowe NoneAnd to be clear for the tracker, Euan, we'd expect to send you evidence for each, not a summary. For the first, that's the configuration as deployed plus a before and after. For the second, the test output.
- Euan Rattray NoneThat's acceptable. What I won't accept is a reference to a policy in place of the control itself. If the evidence is a policy document, I'll treat it as not evidenced.
- Hannah Lowe NoneUnderstood. Controls, not policies.
- Euan Rattray NoneThen let me record where we are. The access finding: I've seen the just-in-time model evidenced today, I've seen the history sitting in our own account, and I've heard that there's no bypass. I'm minded to treat the design as evidenced. But I'm leaving the finding open, formally, because it is linked to the two post-incident actions and they aren't done.
- Tobias Renwick NoneThat seems entirely right to me.
- Euan Rattray NoneGood. I do have some smaller questions, if there's time. Hannah, this one's for you. Service accounts used by the connectors. Are they covered by the same approach?
- Hannah Lowe NoneThe short answer is no, and the longer answer is why. Connectors need to run unattended every night, so they use service identities, and those are scoped to the sources they read from. They don't have engineer privileges, and they can't be used to log in interactively. But they're not just-in-time, so I wouldn't want you to hear that they were.
- Euan Rattray NoneThank you for saying so. That is the sort of distinction I'm looking for. Who owns the credentials?
- Hannah Lowe NoneIn your deployment they'd be created in your account by your administrators, under your naming standard, and rotated on your schedule. We never hold the secret. I'll include that in the writing, with the scoping for each connector you've asked about.
- Euan Rattray NonePlease do. And what should I expect for the questionnaire on the remaining sections? There were several areas still marked as pending.
- Hannah Lowe NoneI have those open as well. I'd like to answer them right the first time, so I'll check two with Tobias before I send, rather than give you something I'd have to amend.
- Tobias Renwick NoneI'm happy to be the checker. Euan, if any of them touch the architecture, I'd rather they came back with a diagram. One page, so your committee can follow it without us in the room.
- Euan Rattray NoneOne page is welcome. The committee reads on paper and has little patience.
- Tobias Renwick NoneThat I can respect. A design that can't be explained on one page is usually a design with something wrong in it.
- Euan Rattray NoneQuite. One last matter, and it's more about process than control. Who at BB-Demo should I write to if I'm not satisfied with an answer? I don't want it to disappear into a general inbox.
- Hannah Lowe NoneWrite to me for anything technical, and copy Tobias. For commercial matters, that's Tom Ashdown, though I gather you don't tend to discuss those.
- Euan Rattray NoneI don't. Price is for the people who sign. My concern is whether the controls are real.
- Tobias Renwick NoneUnderstood. And I'd add that if a finding stays open because we're late, I'd rather you told the committee that than had us hide it. We'd prefer an honest open finding to a closed one nobody believes.
- Euan Rattray NoneThat's the right attitude, and I'll note it. Let me read back what I'm taking away, then, so that we agree.
- Euan Rattray NoneOne. Just-in-time access has been evidenced in this session, and the design is accepted, subject to the failed-revoke test. Two. Hannah sends the test output unedited, with the configuration reference and the connector credential scoping. Three. The finding on the post-incident actions stays open until both are complete and evidenced, due by the end of December. Four. Evidence for the first action comes as soon as it's ready, and not held back for the pair. Is that fair?
- Tobias Renwick NoneThat's exactly my understanding. I'd only add that I'll update the tracker today, so the dates are written down on our side as well as yours.
- Hannah Lowe NoneAnd mine. I'll send the written summary of today, including the access model as described, so you can compare it with what you heard. Thanks, Euan, I know that you push hard on these, and it makes the answers better.
- Euan Rattray NoneThat's the job. Thank you both. I'll expect the test output first, then the questionnaire sections.
- Tobias Renwick NoneThank you, Euan. Best to your committee.
- Euan Rattray NoneGoodbye.
- Hannah Lowe NoneBye both. Speak soon.
Callsmade from