senior-security

Senior Security Engineer

Security engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.

Table of Contents

• [Threat Modeling Workflow](#threat-modeling-workflow)
• [Security Architecture Workflow](#security-architecture-workflow)
• [Vulnerability Assessment Workflow](#vulnerability-assessment-workflow)
• [Secure Code Review Workflow](#secure-code-review-workflow)
• [Incident Response Workflow](#incident-response-workflow)
• [Security Tools Reference](#security-tools-reference)
• [Tools and References](#tools-and-references)

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model

1. Define system scope and boundaries:
2. Identify assets to protect
3. Map trust boundaries
4. Document data flows
5. Create data flow diagram:
6. External entities (users, services)
7. Processes (application components)
8. Data stores (databases, caches)
9. Data flows (APIs, network connections)
10. Apply STRIDE to each DFD element (see [STRIDE per Element Matrix](#stride-per-element-matrix) below)
11. Score risks using DREAD:
12. Damage potential (1-10)
13. Reproducibility (1-10)
14. Exploitability (1-10)
15. Affected users (1-10)
16. Discoverability (1-10)
17. Prioritize threats by risk score
18. Define mitigations for each threat
19. Document in threat model report
20. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

STRIDE Threat Categories

| Category | Security Property | Mitigation Focus | |----------|-------------------|------------------| | Spoofing | Authentication | MFA, certificates, strong auth | | Tampering | Integrity | Signing, checksums, validation | | Repudiation | Non-repudiation | Audit logs, digital signatures | | Information Disclosure | Confidentiality | Encryption, access controls | | Denial of Service | Availability | Rate limiting, redundancy | | Elevation of Privilege | Authorization | RBAC, least privilege |

STRIDE per Element Matrix

| DFD Element | S | T | R | I | D | E | |-------------|---|---|---|---|---|---| | External Entity | X | | X | | | | | Process | X | X | X | X | X | X | | Data Store | | X | X | X | X | | | Data Flow | | X | | X | X | |

See: [references/threat-modeling-guide.md](references/threat-modeling-guide.md)

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture

1. Define security requirements:
2. Compliance requirements (GDPR, HIPAA, PCI-DSS)
3. Data classification (public, internal, confidential, restricted)
4. Threat model inputs
5. Apply defense-in-depth layers:
6. Perimeter: WAF, DDoS protection, rate limiting
7. Network: Segmentation, IDS/IPS, mTLS
8. Host: Patching, EDR, hardening
9. Application: Input validation, authentication, secure coding
10. Data: Encryption at rest and in transit
11. Implement Zero Trust principles:
12. Verify explicitly (every request)
13. Least privilege access (JIT/JEA)
14. Assume breach (segment, monitor)
15. Configure authentication and authorization:
16. Identity provider selection
17. MFA requirements
18. RBAC/ABAC model
19. Design encryption strategy:
20. Key management approach
21. Algorithm selection
22. Certificate lifecycle
23. Plan security monitoring:
24. Log aggregation
25. SIEM integration
26. Alerting rules
27. Document architecture decisions
28. Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned

Defense-in-Depth Layers

Layer 1: PERIMETER
  WAF, DDoS mitigation, DNS filtering, rate limiting

Layer 2: NETWORK
  Segmentation, IDS/IPS, network monitoring, VPN, mTLS

Layer 3: HOST
  Endpoint protection, OS hardening, patching, logging

Layer 4: APPLICATION
  Input validation, authentication, secure coding, SAST

Layer 5: DATA
  Encryption at rest/transit, access controls, DLP, backup

Authentication Pattern Selection

| Use Case | Recommended Pattern | |----------|---------------------| | Web application | OAuth 2.0 + PKCE with OIDC | | API authentication | JWT with short expiration + refresh tokens | | Service-to-service | mTLS with certificate rotation | | CLI/Automation | API keys with IP allowlisting | | High security | FIDO2/WebAuthn hardware keys |

See: [references/security-architecture-patterns.md](references/security-architecture-patterns.md)

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment

1. Define assessment scope:
2. In-scope systems and applications
3. Testing methodology (black box, gray box, white box)
4. Rules of engagement
5. Gather information:
6. Technology stack inventory
7. Architecture documentation
8. Previous vulnerability reports
9. Perform automated scanning:
10. SAST (static analysis)
11. DAST (dynamic analysis)
12. Dependency scanning
13. Secret detection
14. Conduct manual testing:
15. Business logic flaws
16. Authentication bypass
17. Authorization issues
18. Injection vulnerabilities
19. Classify findings by severity:
20. Critical: Immediate exploitation risk
21. High: Significant impact, easier to exploit
22. Medium: Moderate impact or difficulty
23. Low: Minor impact
24. Develop remediation plan:
25. Prioritize by risk
26. Assign owners
27. Set deadlines
28. Verify fixes and document
29. Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

For OWASP Top 10 vulnerability descriptions and testing guidance, refer to owasp.org/Top10.

Vulnerability Severity Matrix

| Impact \ Exploitability | Easy | Moderate | Difficult | |-------------------------|------|----------|-----------| | Critical | Critical | Critical | High | | High | Critical | High | Medium | | Medium | High | Medium | Low | | Low | Medium | Low | Low |

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review

1. Establish review scope:
2. Changed files and functions
3. Security-sensitive areas (auth, crypto, input handling)
4. Third-party integrations
5. Run automated analysis:
6. SAST tools (Semgrep, CodeQL, Bandit)
7. Secret scanning
8. Dependency vulnerability check
9. Review authentication code:
10. Password handling (hashing, storage)
11. Session management
12. Token validation
13. Review authorization code:
14. Access control checks
15. RBAC implementation
16. Privilege boundaries
17. Review data handling:
18. Input validation
19. Output encoding
20. SQL query construction
21. File path handling
22. Review cryptographic code:
23. Algorithm selection
24. Key management
25. Random number generation
26. Document findings with severity
27. Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented

Security Code Review Checklist

| Category | Check | Risk | |----------|-------|------| | Input Validation | All user input validated and sanitized | Injection | | Output Encoding | Context-appropriate encoding applied | XSS | | Authentication | Passwords hashed with Argon2/bcrypt | Credential theft | | Session | Secure cookie flags set (HttpOnly, Secure, SameSite) | Session hijacking | | Authorization | Server-side permission checks on all endpoints | Privilege escalation | | SQL | Parameterized queries used exclusively | SQL injection | | File Access | Path traversal sequences rejected | Path traversal | | Secrets | No hardcoded credentials or keys | Information disclosure | | Dependencies | Known vulnerable packages updated | Supply chain | | Logging | Sensitive data not logged | Information disclosure |

Secure vs Insecure Patterns

| Pattern | Issue | Secure Alternative | |---------|------