senior-security（高级保安）

Senior Security Engineer

The agent performs STRIDE threat analysis with DREAD risk scoring, designs defense-in-depth security architectures with Zero Trust principles, conducts secure code reviews against OWASP Top 10, and scans codebases for hardcoded secrets across 20+ credential patterns.

Table of Contents

• Threat Modeling Workflow
• Security Architecture Workflow
• Vulnerability Assessment Workflow
• Secure Code Review Workflow
• Incident Response Workflow
• Security Tools Reference
• Tools and References

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model

1. Define system scope and boundaries:

- Identify assets to protect - Map trust boundaries - Document data flows

1. Create data flow diagram:

- External entities (users, services) - Processes (application components) - Data stores (databases, caches) - Data flows (APIs, network connections)

1. Apply STRIDE to each DFD element:

- Spoofing: Can identity be faked? - Tampering: Can data be modified? - Repudiation: Can actions be denied? - Information Disclosure: Can data leak? - Denial of Service: Can availability be affected? - Elevation of Privilege: Can access be escalated?

1. Score risks using DREAD:

- Damage potential (1-10) - Reproducibility (1-10) - Exploitability (1-10) - Affected users (1-10) - Discoverability (1-10)

1. Prioritize threats by risk score
2. Define mitigations for each threat
3. Document in threat model report
4. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

STRIDE Threat Categories

STRIDE per Element Matrix

See: references/threat-modeling-guide.md

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture

1. Define security requirements:

- Compliance requirements (GDPR, HIPAA, PCI-DSS) - Data classification (public, internal, confidential, restricted) - Threat model inputs

1. Apply defense-in-depth layers:

- Perimeter: WAF, DDoS protection, rate limiting - Network: Segmentation, IDS/IPS, mTLS - Host: Patching, EDR, hardening - Application: Input validation, authentication, secure coding - Data: Encryption at rest and in transit

1. Implement Zero Trust principles:

- Verify explicitly (every request) - Least privilege access (JIT/JEA) - Assume breach (segment, monitor)

1. Configure authentication and authorization:

- Identity provider selection - MFA requirements - RBAC/ABAC model

1. Design encryption strategy:

- Key management approach - Algorithm selection - Certificate lifecycle

1. Plan security monitoring:

- Log aggregation - SIEM integration - Alerting rules

1. Document architecture decisions
2. Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned

Defense-in-Depth Layers

Layer 1: PERIMETER
  WAF, DDoS mitigation, DNS filtering, rate limiting

Layer 2: NETWORK
  Segmentation, IDS/IPS, network monitoring, VPN, mTLS

Layer 3: HOST
  Endpoint protection, OS hardening, patching, logging

Layer 4: APPLICATION
  Input validation, authentication, secure coding, SAST

Layer 5: DATA
  Encryption at rest/transit, access controls, DLP, backup

Authentication Pattern Selection

See: references/security-architecture-patterns.md

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment

1. Define assessment scope:

- In-scope systems and applications - Testing methodology (black box, gray box, white box) - Rules of engagement

1. Gather information:

- Technology stack inventory - Architecture documentation - Previous vulnerability reports

1. Perform automated scanning:

- SAST (static analysis) - DAST (dynamic analysis) - Dependency scanning - Secret detection

1. Conduct manual testing:

- Business logic flaws - Authentication bypass - Authorization issues - Injection vulnerabilities

1. Classify findings by severity:

- Critical: Immediate exploitation risk - High: Significant impact, easier to exploit - Medium: Moderate impact or difficulty - Low: Minor impact

1. Develop remediation plan:

- Prioritize by risk - Assign owners - Set deadlines

1. Verify fixes and document
2. Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

OWASP Top 10 Mapping

Vulnerability Severity Matrix

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review

1. Establish review scope:

- Changed files and functions - Security-sensitive areas (auth, crypto, input handling) - Third-party integrations

1. Run automated analysis:

- SAST tools (Semgrep, CodeQL, Bandit) - Secret scanning - Dependency vulnerability check

1. Review authentication code:

- Password handling (hashing, storage) - Session management - Token validation

1. Review authorization code:

- Access control checks - RBAC implementation - Privilege boundaries

1. Review data handling:

- Input validation - Output encoding - SQL query construction - File path handling

1. Review cryptographic code:

- Algorithm selection - Key management - Random number generation

1. Document findings with severity
2. Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented

Security Code Review Checklist

Secure vs Insecure Patterns

Incident Response Workflow

Respond to and contain security incidents.

Workflow: Handle Security Incident

1. Identify and triage:

- Validate incident is genuine - Assess initial scope and severity - Activate incident response team

1. Contain the threat:

- Isolate affected systems - Block malicious IPs/accounts - Disable compromised credentials

1. Eradicate root cause:

- Remove malware/backdoors - Patch vulnerabilities - Update configurations

1. Recover operations:

- Restore from clean backups - Verify system integrity - Monitor for recurrence

1. Conduct post-mortem:

- Timeline reconstruction - Root cause analysis - Lessons learned

1. Implement improvements:

- Update detection rules - Enhance controls - Update runbooks

1. Document and report
2. Validation: Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented

Incident Severity Levels

Incident Response Checklist

Security Tools Reference

Recommended Security Tools

Cryptographic Algorithm Selection

See: references/cryptography-implementation.md

Tools and References

Scripts

Threat Modeler Features:

• STRIDE analysis for any system component
• DREAD risk scoring
• Mitigation recommendations
• JSON and text output formats
• Interactive mode for guided analysis

Secret Scanner Features:

• Detects AWS, GCP, Azure credentials
• Finds API keys and tokens (GitHub, Slack, Stripe)
• Identifies private keys and passwords
• Supports 20+ secret patterns
• CI/CD integration ready

References

Security Standards Reference

Compliance Frameworks

Security Headers Checklist

Related Skills

Anti-Patterns

• Security by obscurity -- hiding endpoints or using non-standard ports is not a control; implement authentication, authorization, and encryption
• MD5/SHA1 for password hashing -- both are broken for this purpose; use Argon2id or bcrypt with cost factor >= 12
• Math.random for tokens -- predictable values allow session hijacking; use crypto.getRandomValues() or secrets.token_hex()
• Shell=True in subprocess -- enables command injection; use argument lists with subprocess.run(["cmd", "arg"])
• Threat model without data flow diagram -- STRIDE analysis requires DFD elements to be systematic; skip the DFD and you miss entire attack surfaces
• Accepted risks without review cadence -- DREAD scores drift as systems evolve; re-validate accepted risks every 90 days

Troubleshooting

Success Criteria

• Zero critical- or high-severity secrets detected by secret_scanner.py across the entire codebase before every release.
• Threat model coverage above 90%: every component in the data flow diagram has a completed STRIDE analysis with documented mitigations.
• All OWASP Top 10 vulnerability categories addressed in the security architecture with at least one compensating control per category.
• Mean time to remediate critical vulnerabilities under 48 hours from discovery to verified fix.
• 100% of authentication and authorization code paths reviewed with the Secure Code Review Checklist before merge.
• Incident response exercises (tabletop or simulated) conducted at least quarterly with post-mortem documentation.
• DREAD risk scores for all remaining accepted risks reviewed and re-validated every 90 days.

Scope & Limitations

This skill covers:

• Application-level security: threat modeling, secure code review, secret detection, and vulnerability assessment for web applications and APIs.
• Security architecture design: defense-in-depth layering, Zero Trust patterns, authentication/authorization model selection, and encryption strategy.
• Incident response planning: severity classification, containment procedures, post-mortem frameworks, and runbook creation.
• Compliance mapping: OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, and SOC 2 alignment at the application layer.

This skill does NOT cover:

• Infrastructure and cloud security hardening (see senior-devops and aws-solution-architect).
• Runtime security monitoring, SIEM rule authoring, and SOC operations (see senior-secops).
• Full regulatory compliance programs, audit evidence collection, and certification processes (see ra-qm-team).
• Network penetration testing tooling, red team operations, and physical security assessments.

Integration Points

Tool Reference

threat_modeler.py

Purpose: Performs STRIDE threat analysis on system components with DREAD risk scoring, mitigation recommendations, and structured reporting.

Usage:

python threat_modeler.py --component "User Authentication"
python threat_modeler.py --component "API Gateway" --assets "user_data,tokens" --json
python threat_modeler.py --component "Database" --output report.txt
python threat_modeler.py --interactive
python threat_modeler.py --list-threats

Flags:

Example:

$ python threat_modeler.py --component "API Gateway" --json --output api-threats.json
Report written to api-threats.json

Output Formats:

• Text (default): Structured report grouped by STRIDE category with risk scores, DREAD ratings, attack vectors, and mitigations.
• JSON (--json): Machine-readable object containing component, analysis_date, summary (counts by risk level), and threats array with full DREAD breakdown per threat.

secret_scanner.py

Purpose: Detects hardcoded secrets, API keys, credentials, and private keys in source code. Supports 20+ secret patterns across cloud providers (AWS, GCP, Azure), authentication tokens (GitHub, GitLab, Slack, Stripe, Twilio, SendGrid), cryptographic keys, and generic credential patterns. Exits with code 1 when critical or high findings are present, making it CI/CD-ready.

Usage:

python secret_scanner.py /path/to/project
python secret_scanner.py /path/to/file.py
python secret_scanner.py /path/to/project --format json --output report.json
python secret_scanner.py /path/to/project --severity critical
python secret_scanner.py --list-patterns

Flags:

Example:

$ python secret_scanner.py ./src --severity high --format json
{
  "target": "./src",
  "scan_date": "2026-03-21T10:30:00",
  "summary": { "total": 2, "by_severity": { "critical": 1, "high": 1, "medium": 0, "low": 0 } },
  "findings": [ ... ]
}

Output Formats:

• Text (default): Severity-grouped report showing pattern ID, file path with line number, masked match text, and remediation recommendation.
• JSON (--format json): Machine-readable object with target, scan_date, summary (counts by severity), and findings array. Each finding includes pattern_id, name, severity, file_path, line_number, matched_text (masked), and recommendation.