Security Architecture Skill

Purpose

Design and validate security architectures through threat modeling (STRIDE), zero trust implementation, and compliance alignment for enterprise systems.

Parameters

| Parameter | Type | Required | Validation | Default | |-----------|------|----------|------------|---------| | system | string | ✅ | min: 50 chars | - | | analysis_type | enum | ⚪ | threat_model|zero_trust|compliance|review | threat_model | | threat_context | enum | ⚪ | internal|external|both | both | | data_classification | enum | ⚪ | public|internal|confidential|restricted | internal | | compliance_frameworks | array | ⚪ | valid frameworks | [] |

Execution Flow

┌──────────────────────────────────────────────────────────┐
│ 1. VALIDATE: Check system description                     │
│ 2. CLASSIFY: Data and asset classification                │
│ 3. MODEL: Threat modeling (STRIDE)                        │
│ 4. DESIGN: Security controls                              │
│ 5. ALIGN: Map to compliance requirements                  │
│ 6. ASSESS: Risk assessment                                │
│ 7. DOCUMENT: Return security architecture                 │
└──────────────────────────────────────────────────────────┘

Retry Logic

| Error | Retry | Backoff | Max Attempts | |-------|-------|---------|--------------| | VALIDATION_ERROR | No | - | 1 | | COMPLIANCE_LOOKUP_ERROR | Yes | 1s | 2 | | THREAT_DB_ERROR | Yes | 2s | 3 |

Logging & Observability

log_points:
  - event: analysis_started
    level: info
    data: [analysis_type, threat_context]
  - event: threats_identified
    level: info
    data: [threat_count, high_severity_count]
  - event: compliance_gaps_found
    level: warn
    data: [framework, gap_count]

metrics:
  - name: analyses_performed
    type: counter
    labels: [analysis_type]
  - name: threats_identified
    type: counter
    labels: [severity]
  - name: compliance_score
    type: gauge

Error Handling

| Error Code | Description | Recovery | |------------|-------------|----------| | E301 | Missing system context | Request architecture details | | E302 | Unknown compliance framework | Show supported frameworks | | E303 | Incomplete threat model | Flag missing threat categories | | E304 | Conflicting controls | Highlight conflicts |

Unit Test Template

test_cases:
  - name: "STRIDE threat model"
    input:
      system: "Web application handling customer PII"
      analysis_type: "threat_model"
      data_classification: "confidential"
    expected:
      has_threats: true
      stride_categories: 6
      has_mitigations: true

  - name: "Zero trust design"
    input:
      system: "Corporate application for remote workers"
      analysis_type: "zero_trust"
    expected:
      has_identity_model: true
      has_access_policies: true
      has_micro_segmentation: true

  - name: "Compliance gap analysis"
    input:
      system: "Healthcare patient portal"
      analysis_type: "compliance"
      compliance_frameworks: ["HIPAA"]
    expected:
      has_requirements: true
      has_gap_analysis: true

Troubleshooting

Common Issues

| Symptom | Root Cause | Resolution | |---------|------------|------------| | Incomplete threat model | Missing attack surface | Map all entry points | | Compliance gaps | Missing controls | Map controls to requirements | | Over-restrictive policies | Security vs usability | Balance with risk acceptance |

Debug Checklist

□ Is system context complete?
□ Are all data flows documented?
□ Are all entry points identified?
□ Are threats mapped to mitigations?
□ Is compliance framework valid?

STRIDE Quick Reference

| Threat | Mitigation Category | |--------|---------------------| | Spoofing | Authentication | | Tampering | Integrity controls | | Repudiation | Logging/Audit | | Information Disclosure | Encryption | | Denial of Service | Availability | | Elevation of Privilege | Authorization |

Integration

| Component | Trigger | Data Flow | |-----------|---------|-----------| | Agent 05 | Security request | Receives system, returns threat model | | Agent 04 | Cloud security | Provides security requirements |

Quality Standards

Defense in depth: Multiple control layers
Privacy by design: Data minimization
Least privilege: Minimal access

Version History

| Version | Date | Changes | |---------|------|---------| | 2.0.0 | 2025-01 | Production-grade: STRIDE, compliance mapping | | 1.0.0 | 2024-12 | Initial release |