security-architect
Expert security architecture including threat modeling, authentication, encryption, and compliance
When & Why to Use This Skill
The Security Architect skill provides expert-level guidance for designing and auditing secure system architectures. It streamlines complex security tasks such as STRIDE threat modeling, the implementation of robust authentication (OAuth/MFA) and authorization (RBAC/ABAC) patterns, and ensures data protection through advanced encryption and compliance alignment with global standards like GDPR, SOC 2, and HIPAA.
Use Cases
- Fintech Security Design: Architecting secure payment processing systems with OAuth 2.0, MFA, and field-level encryption for sensitive PII.
- Threat Modeling: Performing STRIDE analysis to identify potential attack vectors and define mitigation strategies for cloud-native microservices.
- Compliance Readiness: Generating comprehensive security checklists and roadmaps for achieving GDPR, SOC 2, or HIPAA certification.
- Access Control Implementation: Designing granular RBAC and ABAC authorization models to enforce the principle of least privilege across enterprise APIs.
- Data Protection Strategy: Developing end-to-end encryption protocols and key management lifecycle policies for data at rest and in transit.
| name | security-architect |
|---|---|
| description | Expert security architecture including threat modeling, authentication, encryption, and compliance |
| version | 1.0.0 |
| author | USER |
| tags | [security, authentication, encryption, compliance, threat-modeling] |
Security Architect
Purpose
Design secure system architectures including threat modeling, authentication/authorization, encryption, and compliance requirements.
Activation Keywords
- security architecture, threat model
- authentication, authorization, OAuth
- encryption, TLS, secrets
- compliance, GDPR, SOC2
- vulnerability, penetration testing
Core Capabilities
1. Threat Modeling
- STRIDE methodology
- Attack surface analysis
- Risk assessment
- Mitigation strategies
- Security controls
2. Authentication
- OAuth 2.0 / OIDC
- JWT best practices
- MFA implementation
- Session management
- API key management
3. Authorization
- RBAC design
- ABAC patterns
- Policy engines (OPA)
- Least privilege
- Zero trust
4. Encryption
- Data at rest
- Data in transit
- Key management
- Certificate management
- Secrets management
5. Compliance
- GDPR requirements
- SOC 2 controls
- PCI-DSS
- HIPAA
- Audit logging
STRIDE Threat Model
| Threat | Description | Mitigation |
|---|---|---|
| Spoofing | Identity falsification | Strong auth, MFA |
| Tampering | Data modification | Integrity checks, signing |
| Repudiation | Deny actions | Audit logging |
| Information Disclosure | Data leaks | Encryption, access control |
| Denial of Service | Availability attack | Rate limiting, WAF |
| Elevation of Privilege | Unauthorized access | Least privilege, RBAC |
Security Checklist
## Authentication
- [ ] Password policy defined
- [ ] MFA available/required
- [ ] Session timeout configured
- [ ] Brute force protection
## Authorization
- [ ] RBAC/ABAC implemented
- [ ] Least privilege enforced
- [ ] Resource-level access control
- [ ] API authorization
## Data Protection
- [ ] Encryption at rest
- [ ] Encryption in transit (TLS 1.3)
- [ ] PII handling defined
- [ ] Data retention policy
## Infrastructure
- [ ] Network segmentation
- [ ] WAF configured
- [ ] DDoS protection
- [ ] Secrets management
## Monitoring
- [ ] Security logging
- [ ] Intrusion detection
- [ ] Vulnerability scanning
- [ ] Incident response plan
Example Usage
User: "Design security architecture for a fintech app"
Security Architect Response:
1. Threat model
- STRIDE analysis
- Attack surface mapping
- Risk prioritization
2. Authentication
- OAuth 2.0 with MFA
- Device fingerprinting
- Session management
3. Data protection
- Field-level encryption for PII
- Key rotation strategy
- Data classification
4. Compliance
- PCI-DSS requirements
- Audit logging
- Data residency
5. Monitoring
- SIEM integration
- Anomaly detection
- Incident response