senior-security

Senior Security Engineer

The agent performs STRIDE threat analysis with DREAD risk scoring, designs defense-in-depth security architectures with Zero Trust principles, conducts secure code reviews against OWASP Top 10, and scans codebases for hardcoded secrets across 20+ credential patterns.

Table of Contents

• [Threat Modeling Workflow](#threat-modeling-workflow)
• [Security Architecture Workflow](#security-architecture-workflow)
• [Vulnerability Assessment Workflow](#vulnerability-assessment-workflow)
• [Secure Code Review Workflow](#secure-code-review-workflow)
• [Incident Response Workflow](#incident-response-workflow)
• [Security Tools Reference](#security-tools-reference)
• [Tools and References](#tools-and-references)

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model

1. Define system scope and boundaries:
2. Identify assets to protect
3. Map trust boundaries
4. Document data flows
5. Create data flow diagram:
6. External entities (users, services)
7. Processes (application components)
8. Data stores (databases, caches)
9. Data flows (APIs, network connections)
10. Apply STRIDE to each DFD element:
11. Spoofing: Can identity be faked?
12. Tampering: Can data be modified?
13. Repudiation: Can actions be denied?
14. Information Disclosure: Can data leak?
15. Denial of Service: Can availability be affected?
16. Elevation of Privilege: Can access be escalated?
17. Score risks using DREAD:
18. Damage potential (1-10)
19. Reproducibility (1-10)
20. Exploitability (1-10)
21. Affected users (1-10)
22. Discoverability (1-10)
23. Prioritize threats by risk score
24. Define mitigations for each threat
25. Document in threat model report
26. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

STRIDE Threat Categories

| Category | Description | Security Property | Mitigation Focus | |----------|-------------|-------------------|------------------| | Spoofing | Impersonating users or systems | Authentication | MFA, certificates, strong auth | | Tampering | Modifying data or code | Integrity | Signing, checksums, validation | | Repudiation | Denying actions | Non-repudiation | Audit logs, digital signatures | | Information Disclosure | Exposing data | Confidentiality | Encryption, access controls | | Denial of Service | Disrupting availability | Availability | Rate limiting, redundancy | | Elevation of Privilege | Gaining unauthorized access | Authorization | RBAC, least privilege |

STRIDE per Element Matrix

| DFD Element | S | T | R | I | D | E | |-------------|---|---|---|---|---|---| | External Entity | X | | X | | | | | Process | X | X | X | X | X | X | | Data Store | | X | X | X | X | | | Data Flow | | X | | X | X | |

See: [references/threat-modeling-guide.md](references/threat-modeling-guide.md)

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture

1. Define security requirements:
2. Compliance requirements (GDPR, HIPAA, PCI-DSS)
3. Data classification (public, internal, confidential, restricted)
4. Threat model inputs
5. Apply defense-in-depth layers:
6. Perimeter: WAF, DDoS protection, rate limiting
7. Network: Segmentation, IDS/IPS, mTLS
8. Host: Patching, EDR, hardening
9. Application: Input validation, authentication, secure coding
10. Data: Encryption at rest and in transit
11. Implement Zero Trust principles:
12. Verify explicitly (every request)
13. Least privilege access (JIT/JEA)
14. Assume breach (segment, monitor)
15. Configure authentication and authorization:
16. Identity provider selection
17. MFA requirements
18. RBAC/ABAC model
19. Design encryption strategy:
20. Key management approach
21. Algorithm selection
22. Certificate lifecycle
23. Plan security monitoring:
24. Log aggregation
25. SIEM integration
26. Alerting rules
27. Document architecture decisions
28. Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned

Defense-in-Depth Layers

Layer 1: PERIMETER
  WAF, DDoS mitigation, DNS filtering, rate limiting

Layer 2: NETWORK
  Segmentation, IDS/IPS, network monitoring, VPN, mTLS

Layer 3: HOST
  Endpoint protection, OS hardening, patching, logging

Layer 4: APPLICATION
  Input validation, authentication, secure coding, SAST

Layer 5: DATA
  Encryption at rest/transit, access controls, DLP, backup

Authentication Pattern Selection

| Use Case | Recommended Pattern | |----------|---------------------| | Web application | OAuth 2.0 + PKCE with OIDC | | API authentication | JWT with short expiration + refresh tokens | | Service-to-service | mTLS with certificate rotation | | CLI/Automation | API keys with IP allowlisting | | High security | FIDO2/WebAuthn hardware keys |

See: [references/security-architecture-patterns.md](references/security-architecture-patterns.md)

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment

1. Define assessment scope:
2. In-scope systems and applications
3. Testing methodology (black box, gray box, white box)
4. Rules of engagement
5. Gather information:
6. Technology stack inventory
7. Architecture documentation
8. Previous vulnerability reports
9. Perform automated scanning:
10. SAST (static analysis)
11. DAST (dynamic analysis)
12. Dependency scanning
13. Secret detection
14. Conduct manual testing:
15. Business logic flaws
16. Authentication bypass
17. Authorization issues
18. Injection vulnerabilities
19. Classify findings by severity:
20. Critical: Immediate exploitation risk
21. High: Significant impact, easier to exploit
22. Medium: Moderate impact or difficulty
23. Low: Minor impact
24. Develop remediation plan:
25. Prioritize by risk
26. Assign owners
27. Set deadlines
28. Verify fixes and document
29. Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

OWASP Top 10 Mapping

| Rank | Vulnerability | Testing Approach | |------|---------------|------------------| | A01 | Broken Access Control | Manual IDOR testing, authorization checks | | A02 | Cryptographic Failures | Algorithm review, key management audit | | A03 | Injection | SAST + manual payload testing | | A04 | Insecure Design | Threat modeling, architecture review | | A05 | Security Misconfiguration | Configuration audit, CIS benchmarks | | A06 | Vulnerable Components | Dependency scanning, CVE monitoring | | A07 | Authentication Failures | Password policy, session management review | | A08 | Software/Data Integrity | CI/CD security, code signing verification | | A09 | Logging Failures | Log review, SIEM configuration check | | A10 | SSRF | Manual URL manipulation testing |

Vulnerability Severity Matrix

| Impact / Exploitability | Easy | Moderate | Difficult | |-------------------------|------|----------|-----------| | Critical | Critical | Critical | High | | High | Critical | High | Medium | | Medium | High | Medium | Low | | Low | Medium | Low | Low |

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review

1. Establish review scope:
2. Changed files and functions
3. Security-sensitive areas (auth, crypto, input handling)
4. Third-party integrations
5. Run automated analysis:
6. SAST tools (Semgrep, CodeQL, Bandit)
7. Secret scanning
8. Dependency vulnerability check
9. Review authentication code:
10. Password handling (hashing, storage)
11. Session management
12. Token validation
13. Review authorization code:
14. Access control checks
15. RBAC implementation
16. Privilege boundaries
17. Review data handling:
18. Input validation
19. Output encoding
20. SQL query construction