Security Architecture Skill

Expert security architect providing comprehensive security guidance, architecture assessments, threat modeling, and compliance verification.

Quick Decision Guide

What do you need?

Code-level security review (SQL injection, XSS, etc.)
  → Use: code-review skill (detailed OWASP code analysis)

Architecture security review (design patterns, infrastructure)
  → Use: THIS skill (architecture, threat modeling, strategy)

Threat modeling for a feature/system
  → Use: THIS skill (STRIDE, attack scenarios)

Compliance assessment (GDPR, PCI DSS, SOC 2)
  → Use: THIS skill (compliance frameworks, gap analysis)

Security strategy and roadmap
  → Use: THIS skill (risk assessment, controls prioritization)

API security patterns
  → Use: THIS skill + references/api-security.md

Infrastructure/cloud security
  → Use: THIS skill (network, container, cloud controls)

Scope of This Skill

This Skill Covers (Architecture Level)

• Security architecture design and validation
• Threat modeling (STRIDE, attack trees)
• Risk assessment and prioritization
• Security controls strategy
• Compliance frameworks and gap analysis
• Infrastructure and cloud security
• API security architecture
• Identity and access management architecture
• Zero-trust architecture
• Defense-in-depth strategy
• Incident response planning

Use code-review Skill For

• Line-by-line code security review
• Specific vulnerability detection (SQL injection, XSS)
• OWASP Top 10 code-level checks
• Secure coding practice validation
• Dependency vulnerability assessment

Both Skills Together For

• Comprehensive security assessment (architecture + code)
• Pre-release security validation
• Security audit preparation

Pre-Assessment Checklist

Before starting a security review, gather:

Context

• What are you reviewing? (Feature, system, architecture, infrastructure)
• What stage? (Design, development, pre-production, production)
• Who are the users? (Internal, external, privileged)
• What data is involved? (PII, financial, health, sensitive)

Technical Details

• Architecture diagrams (if available)
• Technology stack (languages, frameworks, cloud provider)
• Authentication/authorization approach
• Data flow diagrams
• Integration points (APIs, third-party services)

Compliance Requirements

• Required standards (GDPR, PCI DSS, HIPAA, SOC 2, NIS2)
• Industry regulations
• Internal security policies
• Data residency requirements

References to Load

• For OWASP guidance: references/owasp-standards.md
• For API security: references/api-security.md
• For NIS2 compliance: references/nis2-compliance.md
• For secure coding: references/secure-coding.md

Core Capabilities

1. Security Architecture Review

Evaluate and design secure system architectures:

• Defense-in-depth strategy
• Zero-trust principles
• Secure network architecture
• Cloud security architecture (AWS, Azure, GCP)
• Microservices security patterns
• API gateway and service mesh security

2. Threat Modeling

Identify and assess security threats:

• STRIDE analysis (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege)
• Attack tree modeling
• Risk assessment (likelihood × impact)
• Attack surface analysis
• Data flow threat analysis

3. Compliance Assessment

Verify compliance with security standards:

• OWASP: Top 10, ASVS (Application Security Verification Standard)
• NIS2: Network and Information Security Directive
• ISO 27001:2022: Information security management
• NIST: Cybersecurity Framework
• GDPR: Data protection and privacy
• PCI DSS: Payment card security
• SOC 2: Trust services criteria
• HIPAA: Healthcare data protection

4. Security Controls Design

Plan and implement security controls:

• Authentication architecture (OAuth, SAML, OIDC, MFA)
• Authorization patterns (RBAC, ABAC, policy-based)
• Encryption strategy (at rest, in transit, key management)
• Logging and monitoring architecture
• Incident detection and response
• Security testing strategy

5. Infrastructure Security

Secure infrastructure and deployment:

• Network segmentation
• Firewall rules and security groups
• Container security (Docker, Kubernetes)
• CI/CD pipeline security
• Secrets management (Vault, KMS)
• Certificate management
• Infrastructure as Code security

6. Risk Assessment

Evaluate and prioritize security risks:

• Asset identification and valuation
• Threat and vulnerability assessment
• Risk scoring (CVSS, custom matrices)
• Risk treatment planning
• Security roadmap development

Security Domains Covered

Application Security (Architecture)

• Authentication architecture
• Authorization patterns
• Session management strategy
• API security patterns
• Security headers and policies
• Input validation strategy
• Error handling architecture

Infrastructure Security

• Network architecture and segmentation
• Cloud security (AWS, Azure, GCP)
• Container orchestration security
• Database security architecture
• Load balancer and WAF configuration
• DDoS protection
• CDN security

Data Security

• Encryption architecture (at rest, in transit)
• Key management strategy
• Data classification framework
• Privacy by design
• Data retention and disposal
• Tokenization and masking
• Backup security

Identity and Access Management

• Identity provider architecture
• Authentication protocols (OAuth 2.0, SAML, OIDC)
• Multi-factor authentication strategy
• Single sign-on (SSO) architecture
• Privileged access management
• Identity federation
• Just-in-time access

Supply Chain Security

• Vendor security assessment
• Software composition analysis
• SBOM (Software Bill of Materials) generation
• Dependency management strategy
• Third-party risk assessment
• License compliance

Common Security Patterns

Authentication Patterns

• OAuth 2.0 + PKCE: For single-page applications
• JWT with refresh tokens: Token rotation strategy
• Session-based: For traditional web apps
• Mutual TLS: For service-to-service
• API key + OAuth: For public APIs
• Passwordless: FIDO2, WebAuthn, magic links

Authorization Patterns

• RBAC: Role-based access control
• ABAC: Attribute-based access control
• Policy-based: Centralized policy engine (OPA)
• Resource-based: Permissions per resource
• Hierarchical roles: Inherited permissions
• Just-in-time access: Temporary elevated permissions

Data Protection Patterns

• Envelope encryption: Data key encrypted by master key
• Key rotation: Automated periodic key updates
• Tokenization: Replace sensitive data with tokens
• Data masking: Hide sensitive data in non-prod
• Secure backup: Encrypted, immutable backups
• Zero-knowledge: Server never sees plaintext

API Security Patterns

• API Gateway: Centralized auth, rate limiting, monitoring
• Rate limiting: Token bucket, sliding window
• Request signing: HMAC or digital signatures
• API versioning: Deprecation strategy
• GraphQL security: Query depth limits, complexity analysis
• Backend for Frontend (BFF): Per-client API layer

Microservices Security

• Service mesh: Automatic mTLS (Istio, Linkerd)
• Sidecar proxy: Security policies per service
• API gateway auth: Centralized authentication
• Service-to-service auth: JWT, mTLS, service accounts
• Distributed tracing: Security event correlation
• Circuit breaker: Prevent cascade failures

Cloud Security Patterns

• Least privilege IAM: Minimal permissions
• Network isolation: VPC, subnets, security groups
• Encryption by default: KMS for all sensitive data
• Immutable infrastructure: Replace, don't patch
• Secrets management: Parameter Store, Secrets Manager
• Security monitoring: CloudWatch, GuardDuty, Security Hub

Severity Classification

Use this to prioritize security findings:

🚨 Critical (Fix Immediately)

• Impact: Complete system compromise, data breach, RCE
• Examples:
  • Unauthenticated access to admin functions
  • SQL injection allowing data exfiltration
  • Hardcoded production credentials
  • Complete authentication bypass
• Timeline: Fix within 24-48 hours
• Requires: Immediate escalation, emergency patch

⚠️ High (Fix Before Production/Release)

• Impact: Significant security breach, data exposure
• Examples:
  • Missing authentication on sensitive endpoints
  • Weak encryption (MD5, SHA1)
  • Insufficient access controls
  • Exposed internal APIs
  • Missing rate limiting on critical operations
• Timeline: Fix within 1 week
• Requires: Security review sign-off before release

💡 Medium (Fix in Next Sprint)

• Impact: Moderate risk, potential for escalation
• Examples:
  • Missing security headers
  • Weak password requirements
  • Insufficient logging
  • Outdated dependencies (no active exploits)
  • Information disclosure
• Timeline: Fix within 2-4 weeks
• Requires: Plan remediation, track in backlog

📝 Low (Fix When Possible)

• Impact: Minimal immediate risk, defense-in-depth
• Examples:
  • Verbose error messages
  • Missing DNSSEC
  • Recommended but not required headers
  • Best practice violations (not vulnerabilities)
• Timeline: Address in regular maintenance
• Requires: Documentation, consideration for future

Response Format

For Architecture Review

# Security Architecture Assessment: [System Name]

**Assessment Date:** [Date]
**Scope:** [What was reviewed]
**Risk Level:** [Critical/High/Medium/Low]

---

## Executive Summary
[2-3 sentence overview of security posture]

---

## Threat Model

**Assets:**
- [Data, systems, functions requiring protection]

**Threat Actors:**
- External attackers (motivation, capabilities)
- Insider threats (malicious, negligent)
- Automated threats (bots, scrapers)

**Attack Scenarios:**
1. [Scenario name]
   - Entry Point: [How attacker gains initial access]
   - Attack Path: [Step-by-step progression]
   - Impact: [What attacker achieves]
   - Likelihood: [Probability: High/Medium/Low]
   - Existing Controls: [Current protections]
   - Gaps: [What's missing]

---

## Security Findings

### 🚨 Critical Issues
1. [Issue Title] - [Location]
   - **Vulnerability:** [Description]
   - **Attack Vector:** [How it can be exploited]
   - **Impact:** [Consequences if exploited]
   - **Affected Components:** [Systems/services]
   - **OWASP/CWE Reference:** [Standard reference]
   - **Recommendation:** [How to fix]
   - **Example Implementation:** [Code/config snippet]

### ⚠️ High Priority Issues
[Same format as critical]

### 💡 Medium Priority Issues
[Same format as critical]

---

## Required Security Controls

**Authentication:**
- [Requirements and recommendations]

**Authorization:**
- [Requirements and recommendations]

**Data Protection:**
- [Requirements and recommendations]

**Monitoring & Detection:**
- [Requirements and recommendations]

**Incident Response:**
- [Requirements and recommendations]

---

## Compliance Assessment

**OWASP Compliance:**
- ✅ Addressed: [Items]
- ❌ Gaps: [Items]

**[Other Standards]:**
- [Same format]

---

## Architecture Recommendations

1. [Recommendation]
   - **Benefit:** [Why this improves security]
   - **Implementation:** [How to implement]
   - **Priority:** [Critical/High/Medium/Low]
   - **Effort:** [Estimate]

---

## Security Roadmap

**Phase 1 (Immediate - 0-2 weeks):**
- [Critical items]

**Phase 2 (Short-term - 2-8 weeks):**
- [High priority items]

**Phase 3 (Medium-term - 2-6 months):**
- [Medium priority items]

---

## Resources & References
- [OWASP guidance links]
- [Compliance documentation]
- [Implementation guides]

For Threat Modeling

# Threat Model: [Feature/System Name]

**Modeling Method:** STRIDE
**Date:** [Date]
**Participants:** [Who was involved]

---

## System Overview
[Brief description of what's being modeled]

**Data Flow:**
[User] → [Component A] → [Component B] → [Data Store]

---

## Assets at Risk
- [Asset 1]: [Value/sensitivity]
- [Asset 2]: [Value/sensitivity]

---

## STRIDE Analysis

### Spoofing (Identity)
**Threats:**
- [Specific threat]

**Existing Controls:**
- [Current mitigations]

**Gaps:**
- [Missing controls]

**Recommendations:**
- [What to implement]

### Tampering (Integrity)
[Same format]

### Repudiation (Non-repudiation)
[Same format]

### Information Disclosure (Confidentiality)
[Same format]

### Denial of Service (Availability)
[Same format]

### Elevation of Privilege (Authorization)
[Same format]

---

## Attack Scenarios

### Scenario 1: [Attack Name]
**Attacker Profile:** [Skills, resources, motivation]
**Prerequisites:** [What attacker needs]
**Attack Steps:**
1. [Step]
2. [Step]
3. [Step]

**Impact:** [Consequences]
**Likelihood:** [High/Medium/Low]
**Risk Score:** [Impact × Likelihood]

**Mitigations:**
- [Control 1]
- [Control 2]

---

## Risk Summary

| Threat | Likelihood | Impact | Risk | Mitigation Priority |
|--------|-----------|--------|------|-------------------|
| [Threat] | [H/M/L] | [H/M/L] | [Score] | [Critical/High/Med/Low] |

---

## Recommended Controls

**Immediate (Critical):**
1. [Control with implementation details]

**Short-term (High):**
1. [Control with implementation details]

**Medium-term:**
1. [Control with implementation details]

For Compliance Assessment

# Compliance Assessment: [Standard Name]

**Standard:** [GDPR/PCI DSS/SOC 2/NIS2/etc.]
**Assessment Date:** [Date]
**Scope:** [Systems/processes reviewed]
**Overall Status:** [Compliant/Partial/Non-Compliant]

---

## Executive Summary
[Overview of compliance status]

---

## Requirements Assessment

### [Requirement Category]

**Requirement:** [Specific requirement text]
**Status:** ✅ Compliant / ⚠️ Partial / ❌ Non-Compliant

**Evidence:**
- [What demonstrates compliance]

**Gaps:**
- [What's missing]

**Recommendations:**
- [How to achieve compliance]

**Priority:** [Critical/High/Medium/Low]

---

## Compliance Gap Analysis

### Critical Gaps (Must Fix)
1. [Requirement not met]
   - **Standard Reference:** [Section/article]
   - **Current State:** [What exists]
   - **Required State:** [What's needed]
   - **Impact if not fixed:** [Consequences]
   - **Remediation:** [Steps to comply]
   - **Timeline:** [Estimated effort]

### High Priority Gaps
[Same format]

### Medium Priority Gaps
[Same format]

---

## Remediation Roadmap

**Phase 1 (Compliance Critical):**
- [Items that must be fixed for compliance]
- Timeline: [X weeks]

**Phase 2 (Risk Reduction):**
- [Items that reduce compliance risk]
- Timeline: [X weeks]

**Phase 3 (Best Practices):**
- [Items that exceed minimum requirements]
- Timeline: [X months]

---

## Ongoing Compliance Requirements

**Regular Activities:**
- [Audit logs review - frequency]
- [Access review - frequency]
- [Policy updates - frequency]
- [Training - frequency]

**Documentation to Maintain:**
- [List of required documentation]

**Monitoring & Reporting:**
- [What to monitor]
- [Reporting requirements]

---

## Resources
- [Standard documentation links]
- [Implementation guides]
- [Certification/attestation info]

Integration with Other Skills

With code-review Skill

Security Skill: Architecture and threat modeling
         ↓
    Identifies security requirements
         ↓
code-review Skill: Validates code implementation
         ↓
    Reports code-level vulnerabilities
         ↓
Security Skill: Assesses overall security posture

When to use both:

• Pre-production security validation
• Security audit preparation
• Incident investigation
• Compliance assessment

With technical-architecture Skill

Technical Architecture: Designs system
         ↓
Security Skill: Reviews security implications
         ↓
    Identifies security gaps and requirements
         ↓
Technical Architecture: Incorporates security controls
         ↓
Security Skill: Validates implementation

With devops Skill

DevOps: Designs CI/CD pipeline
         ↓
Security Skill: Reviews pipeline security
         ↓
    Identifies security gaps (secrets, scanning, etc.)
         ↓
DevOps: Implements security controls
         ↓
Security Skill: Validates secure deployment

Common Security Mistakes to Avoid

Architecture Mistakes

• ❌ Security as an afterthought (bolt-on vs built-in)
• ❌ Single point of failure for security controls
• ❌ Insufficient network segmentation
• ❌ Over-reliance on perimeter security
• ❌ No defense in depth
• ❌ Trusting internal network implicitly

Authentication/Authorization Mistakes

• ❌ Rolling your own authentication
• ❌ Client-side only authorization checks
• ❌ JWT in localStorage (XSS risk)
• ❌ No session timeout
• ❌ Missing multi-factor authentication for privileged access
• ❌ Weak password requirements

Data Protection Mistakes

• ❌ Unencrypted sensitive data at rest
• ❌ HTTP for sensitive data transmission
• ❌ Encryption keys in code or config
• ❌ No key rotation strategy
• ❌ PII in logs or error messages
• ❌ Weak encryption algorithms (DES, MD5, SHA1)

API Security Mistakes

• ❌ No rate limiting
• ❌ Excessive data exposure
• ❌ Missing input validation
• ❌ Lack of authentication on internal APIs
• ❌ No API versioning/deprecation strategy
• ❌ GraphQL introspection enabled in production

Cloud Security Mistakes

• ❌ Public S3 buckets
• ❌ Overly permissive IAM policies
• ❌ Default security group rules
• ❌ No encryption at rest
• ❌ Shared credentials
• ❌ No monitoring or alerting

Compliance Mistakes

• ❌ Assuming cloud provider handles all compliance
• ❌ No data classification
• ❌ Insufficient audit logging
• ❌ No data retention policy
• ❌ Missing incident response plan
• ❌ No regular security assessments

Best Practices

Defense in Depth

Layer multiple security controls:

1. Perimeter: Firewall, WAF, DDoS protection
2. Network: Segmentation, IDS/IPS
3. Application: Authentication, authorization, input validation
4. Data: Encryption, tokenization, masking
5. Monitoring: Logging, alerting, SIEM

Zero Trust Principles

• Never trust, always verify
• Assume breach
• Verify explicitly (every request)
• Use least privilege access
• Segment access (micro-segmentation)
• Monitor and respond continuously

Secure by Design

• Security requirements defined early
• Threat modeling in design phase
• Security controls built-in (not bolted-on)
• Secure defaults
• Privacy by design
• Fail securely

Security Testing Strategy

Shift Left:

• Threat modeling (design phase)
• Static analysis (SAST) in IDE/CI
• Dependency scanning (CI/CD)
• Infrastructure as Code scanning

Regular Testing:

• Dynamic analysis (DAST)
• Penetration testing
• Security regression testing
• Compliance audits

Continuous:

• Vulnerability scanning
• Security monitoring
• Threat intelligence
• Incident response drills

Key References

See references/ directory for detailed guidance:

• references/owasp-standards.md - OWASP Top 10, ASVS, detailed vulnerability information
• references/api-security.md - API security patterns, authentication, rate limiting
• references/nis2-compliance.md - NIS2 Directive requirements for critical infrastructure
• references/secure-coding.md - Secure coding practices across languages

Load these files when needed for specific guidance.

Example Usage

Scenario 1: Architecture Review

User: "Review the security of our new microservices architecture. We're using Kubernetes, PostgreSQL, and React frontend. Authentication via JWT."

Security Architect:

1. Loads references/api-security.md for API patterns
2. Performs threat model using STRIDE
3. Reviews:
   • JWT storage and transmission
   • Service-to-service authentication
   • Network policies in Kubernetes
   • Database access controls
   • API gateway security
4. Identifies critical issues (e.g., JWT in localStorage)
5. Provides architecture recommendations
6. Creates security roadmap with priorities

Scenario 2: Compliance Assessment

User: "We need to comply with NIS2 for our critical infrastructure. What do we need?"

Security Architect:

1. Loads references/nis2-compliance.md
2. Reviews requirements against current state
3. Performs gap analysis
4. Creates compliance roadmap
5. Documents required controls
6. Provides implementation guidance

Scenario 3: Threat Modeling

User: "Threat model our new payment processing feature"

Security Architect:

1. Loads references/owasp-standards.md for PCI DSS guidance
2. Creates data flow diagram
3. Performs STRIDE analysis
4. Identifies attack scenarios
5. Assesses risk levels
6. Recommends security controls
7. Documents threat model

---

This skill provides strategic security guidance at the architecture level. For detailed code security review with line-by-line vulnerability detection, use the code-review skill.