security-engineering（安全工程）

Security Engineering

Comprehensive security engineering skill covering application security, infrastructure security, compliance, and incident response.

When to Use This Skill

• Designing security architecture
• Implementing authentication and authorization
• Conducting threat modeling
• Security code review
• Implementing compliance controls (SOC2, HIPAA, PCI-DSS)
• Incident response planning
• Security monitoring and alerting

Security Architecture

Defense in Depth

Layer security controls at multiple levels:

Zero Trust Architecture

Core Principles:

1. Never trust, always verify
2. Assume breach mentality
3. Least privilege access
4. Micro-segmentation
5. Continuous verification

Implementation:

• Identity-based access (not network-based)
• Device health verification
• Continuous authentication
• Encrypted communications everywhere
• Detailed logging and monitoring

Authentication Patterns

OAuth 2.0 / OIDC

Grant Types:

Token Best Practices:

• Short-lived access tokens (15 min - 1 hour)
• Secure refresh token storage
• Token rotation on use
• Revocation capabilities

Session Management

• Secure, HttpOnly, SameSite cookies
• Session timeout (idle and absolute)
• Session invalidation on logout
• Concurrent session limits
• Session binding to device/IP

Multi-Factor Authentication

• TOTP (authenticator apps)
• WebAuthn/FIDO2 (hardware keys)
• Push notifications
• SMS (last resort, vulnerable to SIM swap)

Authorization Patterns

RBAC (Role-Based Access Control)

Users → Roles → Permissions

Best for: Well-defined organizational hierarchies

ABAC (Attribute-Based Access Control)

If user.department == "engineering" AND
   resource.classification == "internal" AND
   time.hour BETWEEN 9 AND 17
THEN allow

Best for: Complex, dynamic access requirements

Policy as Code

Use OPA/Rego or Cedar for externalized policy:

• Version controlled policies
• Testable access rules
• Audit trail
• Separation of concerns

Secure Development

OWASP Top 10 Mitigations

Security Testing

SAST (Static Analysis):

• Run on every commit
• Block high-severity findings
• Tools: Semgrep, CodeQL, SonarQube

DAST (Dynamic Analysis):

• Run against staging/dev
• Tools: OWASP ZAP, Burp Suite

Dependency Scanning:

• Check for known vulnerabilities
• Tools: Snyk, Dependabot, npm audit

Secrets Management

Never:

• Commit secrets to git
• Log secrets
• Pass secrets in URLs
• Hardcode secrets

Do:

• Use secret managers (Vault, AWS Secrets Manager)
• Rotate secrets regularly
• Audit secret access
• Use short-lived credentials

Compliance Frameworks

Common Requirements

Key Controls

• Access control and authentication
• Encryption (at rest and in transit)
• Logging and monitoring
• Incident response procedures
• Business continuity planning
• Vendor management
• Employee security training

Incident Response

Response Phases

1. Preparation: Runbooks, tools, training
2. Detection: Monitoring, alerting, triage
3. Containment: Isolate, preserve evidence
4. Eradication: Remove threat, patch vulnerabilities
5. Recovery: Restore services, verify clean
6. Lessons Learned: Post-mortem, improvements

Severity Levels

Reference Files

• references/threat_modeling.md - STRIDE methodology and examples
• references/compliance_controls.md - Framework-specific control mappings

Integration with Other Skills

• cloud-infrastructure - For cloud security
• debugging - For security incident investigation
• testing - For security testing patterns