Luminara
Current state of the art security reviews face a number of challenges:
- Manual reviews don't scale
- Changes-only reviews can miss risks introduced by interactions elsewhere in the configuration
- Compliance is difficult to verify consistently
- Complex authentication flows can hide bypasses
- Expert time is spent repeatedly checking parameters instead of investigating and fixing actual issues
Luminara is a machine-assisted security review tool for Airlock IAM, widely used in regulated environments such as Swiss banking.
It continuously reassesses your configuration, identifies deviations and potential vulnerabilities, and presents the results in an interactive report. The findings provide the basis for expert assessment, helping security teams focus their attention where it matters most.
Policy Validation
Validate thousands of Airlock IAM parameters using built-in policies and custom rules tailored to your environment. Luminara applies these checks consistently and highlights violations and unexpected configurations in an interactive report.
Continuous Compliance
Keep your Airlock IAM configuration aligned with internal and regulatory requirements as it evolves. Luminara continuously checks your configuration against defined requirements, helping security teams identify deviations early and maintain compliance over time.
Bypass Detection
Analyze complex authentication flows and uncover bypasses that are difficult to identify manually. Luminara uses model checking to explore possible attacker paths across multiple flows and reveal vulnerabilities that may otherwise remain hidden.
How Luminara Works
Full Configuration Reassessment
A seemingly small change can affect other parts of an IAM configuration. Reviewing only the changes therefore cannot reliably rule out new vulnerabilities. A complete reassessment is required to understand the resulting security posture.
Luminara makes this practical by reassessing the entire configuration, allowing experts to spend their time understanding and addressing the findings, rather than repeatedly checking unchanged parameters.
Multi-Flow Authentication Analysis
Some vulnerabilities only become apparent when an attacker passes through multiple authentication flows in a specific order. The number of possible combinations grows rapidly, making exhaustive manual analysis impractical.
Luminara analyzes these combinations and identifies attacker paths that would otherwise be difficult to discover.
Configuration Model
Luminara reads your Airlock IAM configuration and provides built-in support for standard Airlock features. Customizations can be defined through the UI where required.
For model checking, experts define the target states they want to protect, such as access to a web banking backend. Luminara then analyzes the configuration against these targets.
Custom Extensions and Scriptable Steps
Luminara detects custom properties and prompts experts to define their policies and behavior. This allows both policy validation and model checking to account for custom functionality and avoid overlooking potential risks.
Integration Model
Luminara is a standalone solution and does currently not become part of your deployment pipeline. Airlock IAM configurations can be analyzed on demand or as part of existing review processes without changing your CI/CD setup.
Operational Usage
For continuous security assessment, Luminara should be run before deploying a new configuration and whenever a new version of Luminara becomes available.
This ensures that configurations are reassessed as they evolve and that existing reviews remain valid as Luminara's verification capabilities improve.
Secure Operation
Luminara is available exclusively as an on-premises solution and does not require an active internet connection. It can be run locally with network communication completely disabled.
Luminara uncovers weaknesses in your security configuration. The world does not need to know about them.
Technical Foundations
Luminara is mostly written in Python. Policy checks verify whether configured parameters satisfy defined conditions. For model checking, graph-based algorithms formalize authentication flows, while Z3 by Microsoft Research is used to identify potential bypasses.
The analysis requires no internet connection and no configuration data is shared.
Deterministic by Design
No AI is involved in the analysis. Luminara provides provable and comprehensible security guarantees through deterministic and verifiable analysis.