Senior Security

What This Skill Does

This skill provides security engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing. It's designed for security engineers who need to identify threats, assess vulnerabilities, and design secure systems.

When to Use

• Conduct threat modeling using STRIDE.Create data flow diagrams.
• Score risks using DREAD.Define mitigations for each threat.
• Analyze security threats.
• Prioritize threats by risk score.

Key Features

• Identifies and analyzes security threats using STRIDE.Creates data flow diagrams.
• Scores risks using DREAD.Defines mitigations for each threat.
• Provides a threat modeling workflow.
• Applies STRIDE to each DFD element.

Senior Security Engineer

Security engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.

Table of Contents

Threat Modeling Workflow

Security Architecture Workflow Vulnerability Assessment Workflow Secure Code Review Workflow Incident Response Workflow Security Tools Reference Tools and References

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model

Define system scope and boundaries:

• Identify assets to protect
• Map trust boundaries
• Document data flows Create data flow diagram:
• External entities (users, services)
• Processes (application components)
• Data stores (databases, caches)
• Data flows (APIs, network connections) Apply STRIDE to each DFD element (see STRIDE per Element Matrix below) Score risks using DREAD:
• Damage potential (1-10)
• Reproducibility (1-10)
• Exploitability (1-10)
• Affected users (1-10)
• Discoverability (1-10) Prioritize threats by risk score Define mitigations for each threat Document in threat model report Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

STRIDE Threat Categories

STRIDE per Element Matrix

See: references/threat-modeling-guide.md

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture

Define security requirements:

• Compliance requirements (GDPR, HIPAA, PCI-DSS)
• Data classification (public, internal, confidential, restricted)
• Threat model inputs Apply defense-in-depth layers:
• Perimeter: WAF, DDo S protection, rate limiting
• Network: Segmentation, IDS/IPS, m TLS
• Host: Patching, EDR, hardening
• Application: Input validation, authentication, secure coding
• Data: Encryption at rest and in transit Implement Zero Trust principles:
• Verify explicitly (every request)
• Least privilege access (JIT/JEA)
• Assume breach (segment, monitor) Configure authentication and
• Identity provider selection
• MFA requirements
• RBAC/ABAC model Design encryption strategy:
• Key management approach
• Algorithm selection
• Certificate lifecycle Plan security monitoring:
• Log aggregation
• SIEM integration
• Alerting rules Document architecture decisions Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned

Defense-in-Depth Layers

Layer 1: PERIMETER WAF, DDo S mitigation, DNS filtering, rate limiting

Layer 2: NETWORK Segmentation, IDS/IPS, network monitoring, VPN, m TLS

Layer 3: HOST Endpoint protection, OS hardening, patching, logging

Layer 4: APPLICATION Input validation, authentication, secure coding, SAST

Layer 5: DATA Encryption at rest/transit, access controls, DLP, backup

Authentication Pattern Selection

See: references/security-architecture-patterns.md

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment

Define assessment scope:

• In-scope systems and applications
• Testing methodology (black box, gray box, white box)
• Rules of engagement Gather information:
• Technology stack inventory
• Architecture documentation
• Previous vulnerability reports Perform automated scanning:
• SAST (static analysis)
• DAST (dynamic analysis)
• Dependency scanning
• Secret detection Conduct manual testing:
• Business logic flaws
• Authentication bypass
• Injection vulnerabilities Classify findings by severity:
• Critical: Immediate exploitation risk
• High: Significant impact, easier to exploit
• Medium: Moderate impact or difficulty
• Low: Minor impact Develop remediation plan:
• Prioritize by risk
• Assign owners
• Set deadlines Verify fixes and document Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

For OWASP Top 10 vulnerability descriptions and testing guidance, refer to owasp.org/Top10.

Vulnerability Severity Matrix

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review

Establish review scope:

• Changed files and functions
• Security-sensitive areas (auth, crypto, input handling)
• Third-party integrations Run automated analysis:
• SAST tools (Semgrep, Code QL, Bandit)
• Secret scanning
• Dependency vulnerability check Review authentication code:
• Password handling (hashing, storage)
• Session management
• Token validation Review
• Access control checks
• RBAC implementation
• Privilege boundaries Review data handling:
• Input validation
• Output encoding
• SQL query construction
• File path handling Review cryptographic code:
• Algorithm selection
• Key management
• Random number generation Document findings with severity Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented

Security Code Review Checklist