security-architecture-validation（安全架构验证）

Security Architecture Validation Skill

Purpose

This skill provides structured guidance for validating the security architecture of the Citizen Intelligence Agency platform. It covers architecture reviews, control validation, penetration testing coordination, and compliance verification against ISMS requirements.

When to Use This Skill

Apply this skill when:

• ✅ Reviewing architecture changes for security impact
• ✅ Validating security controls are properly implemented
• ✅ Planning or reviewing penetration test results
• ✅ Preparing for compliance audits (ISO 27001, SOC 2)
• ✅ Assessing new integration points (APIs, data sources)
• ✅ Evaluating infrastructure changes (CloudFormation, AWS)
• ✅ Conducting periodic security architecture reviews

Do NOT use for:

• ❌ Line-by-line code review (use secure-code-review)
• ❌ Day-to-day coding practices (use secure-development-policy)
• ❌ Incident handling (use incident-response)

Architecture Review Framework

CIA Platform Security Layers

┌─────────────────────────────────────────┐
│           WAF / CloudFront              │  Layer 1: Edge Security
├─────────────────────────────────────────┤
│         Load Balancer (ALB)             │  Layer 2: Network
├─────────────────────────────────────────┤
│    Spring Security Filter Chain         │  Layer 3: Application Auth
├─────────────────────────────────────────┤
│   Vaadin UI + Service Layer             │  Layer 4: Business Logic
├─────────────────────────────────────────┤
│   JPA/Hibernate + PostgreSQL            │  Layer 5: Data Access
├─────────────────────────────────────────┤
│   AWS VPC + Security Groups             │  Layer 6: Infrastructure
└─────────────────────────────────────────┘

Architecture Review Checklist

Authentication & Authorization:

□ Spring Security configured with secure defaults
□ Session management uses secure cookies (HttpOnly, Secure, SameSite)
□ Password storage uses bcrypt or Argon2
□ Role-based access control enforced at service layer
□ Admin endpoints protected with additional authentication
□ API authentication uses token-based mechanism
□ Session timeout configured appropriately

Network Security:

□ TLS 1.2+ enforced for all connections
□ HSTS header configured
□ Security groups follow least privilege
□ Database not publicly accessible
□ VPC subnets properly segmented
□ Outbound traffic restricted to required destinations

Data Protection:

□ Data at rest encrypted (RDS, EBS, S3)
□ Data in transit encrypted (TLS)
□ Sensitive fields encrypted at application level
□ Database credentials managed via AWS Secrets Manager
□ No PII in application logs
□ Backup encryption enabled

Control Validation Matrix

Penetration Testing Guidance

Scope Definition

In Scope:

• Web application (Vaadin UI + REST APIs)
• Authentication and session management
• Authorization boundaries between roles
• Input validation across all entry points
• External API integrations (Riksdag, World Bank)
• CloudFormation-deployed infrastructure

Out of Scope:

• Third-party services (GitHub, AWS managed services)
• Physical security
• Social engineering
• Denial of service attacks

Test Categories

Penetration Test Report Template

## Finding: [Title]
- **Severity:** Critical / High / Medium / Low
- **CVSS Score:** X.X
- **OWASP Category:** AXX:2021
- **Affected Component:** [Component name]
- **Description:** [What was found]
- **Impact:** [Business impact]
- **Reproduction Steps:** [Step-by-step]
- **Remediation:** [How to fix]
- **ISO 27001 Control:** [Relevant control]
- **Status:** Open / In Progress / Resolved

Compliance Verification

ISO 27001:2022 Architecture Controls

Validation Frequency

Decision Framework

Architecture Change Proposed
    │
    ├─→ Does it change authentication/authorization?
    │   └─→ YES → Full security architecture review required
    │
    ├─→ Does it add new external integrations?
    │   └─→ YES → Threat model update + data flow review
    │
    ├─→ Does it change data storage or processing?
    │   └─→ YES → Data classification review + encryption check
    │
    ├─→ Does it modify infrastructure (CloudFormation)?
    │   └─→ YES → Infrastructure security review
    │
    └─→ Does it change network boundaries?
        └─→ YES → Network security review + firewall rules

References

• OWASP Application Security Verification Standard
• NIST SP 800-53 Security Controls
• CIA SECURITY_ARCHITECTURE.md
• CIA THREAT_MODEL.md