Security Architecture Skill

Name: security-architecture
Rating: 62
Author: Hack23

Purpose

This skill defines requirements for security architecture documentation following Hack23 ISMS policies. It ensures that security controls, threat models, and defense-in-depth strategies are properly documented and maintained for all systems.

Rules

Required Documentation

MUST CREATE:

•SECURITY_ARCHITECTURE.md - Current security controls and architecture
•FUTURE_SECURITY_ARCHITECTURE.md - Planned security improvements
•THREAT_MODEL.md - Threat analysis and mitigations
•Security section in main README.md
•Security policy (.github/SECURITY.md)

SECURITY_ARCHITECTURE.md Requirements

MUST INCLUDE:

•Overview - System security posture summary
•Security Controls - Implemented controls mapped to frameworks (ISO 27001, NIST CSF, CIS Controls)
•Authentication & Authorization - Identity management approach
•Data Protection - Encryption at rest and in transit
•Network Security - Firewall rules, network segmentation, DMZ architecture
•Monitoring & Logging - Security event logging and SIEM integration
•Incident Response - Security incident handling procedures
•Compliance Mapping - How architecture meets compliance requirements
•Security Diagrams - C4 diagrams showing trust boundaries and security zones

MUST NOT:

•Expose sensitive security details (specific firewall rules, vulnerability details)
•Include credentials or secrets
•Document security through obscurity approaches

FUTURE_SECURITY_ARCHITECTURE.md Requirements

MUST INCLUDE:

•Security Roadmap - Planned security enhancements with timeline
•Gap Analysis - Current vs. desired state
•Security Initiatives - Planned projects to improve security
•Technology Evolution - Future security technologies to adopt
•Risk Mitigation Plans - How future changes will reduce risks
•Compliance Improvements - Plans to meet future compliance requirements

THREAT_MODEL.md Requirements

MUST INCLUDE:

•System Overview - What is being protected
•Assets - Critical data and systems
•Threat Actors - Who might attack and their motivations
•Attack Vectors - How attacks might occur
•
Threats - Specific threats using STRIDE or similar methodology:
- •Spoofing
- •Tampering
- •Repudiation
- •Information Disclosure
- •Denial of Service
- •Elevation of Privilege
•Risk Assessment - Likelihood and impact of each threat
•Mitigations - Controls to prevent or reduce each threat
•Residual Risks - Accepted risks after mitigations

Threat Prioritization:

•Critical: Immediate action required
•High: Remediate within 30 days
•Medium: Remediate within 90 days
•Low: Accept or remediate opportunistically

Defense-in-Depth Layers

MUST IMPLEMENT:

•
Perimeter Security
- •Web Application Firewall (WAF)
- •DDoS protection
- •Rate limiting
- •Geo-blocking (if applicable)
•
Network Security
- •Network segmentation (DMZ, application tier, data tier)
- •VPN for remote access
- •Zero-trust networking
- •Private subnets for sensitive resources
•
Application Security
- •Input validation
- •Output encoding
- •Authentication & authorization
- •Session management
- •CSRF protection
- •Secure headers (CSP, HSTS, X-Frame-Options)
•
Data Security
- •Encryption at rest (AES-256)
- •Encryption in transit (TLS 1.2+)
- •Data classification and handling
- •Secure key management
- •Database access controls
•
Monitoring & Detection
- •Security event logging
- •Intrusion detection/prevention (IDS/IPS)
- •Anomaly detection
- •Security alerts and incident response
- •Audit logging
•
Physical Security
- •Secure data center (for on-premise)
- •Access controls
- •Environmental controls
- •Asset management

Security Control Categories

Preventive Controls:

•Access controls
•Encryption
•Input validation
•Firewall rules
•Secure configuration

Detective Controls:

•Logging
•Monitoring
•Intrusion detection
•Vulnerability scanning
•Audit reviews

Corrective Controls:

•Incident response
•Patch management
•Backup and recovery
•Business continuity

Deterrent Controls:

•Security awareness training
•Legal agreements (NDAs)
•Security policies
•Audit reports

Security Zones

Public Zone (Untrusted):

•Static website content
•Public APIs (read-only, rate-limited)
•CDN distribution

DMZ (Semi-trusted):

•Web servers
•API gateways
•Load balancers
•WAF

Application Zone (Trusted):

•Application servers
•Business logic
•Internal APIs
•Background workers

Data Zone (Highly Trusted):

•Databases
•File storage with sensitive data
•Key management systems
•Backup systems

Examples

Example 1: SECURITY_ARCHITECTURE.md Template

markdown

# Security Architecture - Hack23 Homepage

## Overview

The Hack23 Homepage is a static website deployed on AWS S3 with CloudFront CDN. Security is implemented through defense-in-depth with multiple layers of protection.

**Security Posture:** Public-facing static website with no user authentication or sensitive data processing.

## Security Controls

### ISO 27001:2022 Controls Implemented

| Control | Implementation | Status |
|---------|---------------|--------|
| A.8.24 Use of cryptography | TLS 1.2+ enforced via CloudFront | ✅ Implemented |
| A.8.9 Configuration management | Infrastructure as Code (Terraform) | ✅ Implemented |
| A.8.16 Monitoring | CloudWatch logging and alarms | ✅ Implemented |
| A.5.7 Threat intelligence | ZAP security scanning in CI/CD | ✅ Implemented |

### NIST Cybersecurity Framework

| Function | Category | Implementation |
|----------|----------|----------------|
| Identify | Asset Management | Repository inventory, dependency tracking |
| Protect | Access Control | GitHub branch protection, AWS IAM roles |
| Detect | Security Monitoring | GitHub Advanced Security, CloudWatch |
| Respond | Incident Response | SECURITY.md vulnerability reporting |
| Recover | Backup & Recovery | Git version control, S3 versioning |

## Authentication & Authorization

**Public Access:**
- No authentication required for website content
- All content is PUBLIC classification

**Administrative Access:**
- GitHub authentication with 2FA required
- AWS IAM roles with least privilege
- Branch protection rules on main branch

## Data Protection

**Data Classification:**
- All website content: PUBLIC
- No personal data collected
- No cookies or tracking (privacy by design)

**Encryption:**
- **In Transit**: TLS 1.2+ enforced on CloudFront
- **At Rest**: S3 server-side encryption (AES-256)

**Data Retention:**
- Git history retained indefinitely
- CloudWatch logs retained 90 days
- No user data to retain

## Network Security

### Architecture Diagram

```mermaid
C4Container
    title Security Architecture - Hack23 Homepage

    Person(visitor, "Visitor", "Public user")
    
    System_Boundary(aws, "AWS Cloud") {
        Container(cloudfront, "CloudFront CDN", "AWS CDN", "TLS termination, caching")
        Container(waf, "AWS WAF", "Web Application Firewall", "DDoS protection, rate limiting")
        Container(s3, "S3 Bucket", "Static Storage", "Encrypted website files")
    }
    
    System_Ext(github, "GitHub Actions", "CI/CD", "Automated deployment")
    
    Rel(visitor, cloudfront, "HTTPS only", "TLS 1.2+")
    Rel(cloudfront, waf, "Filtered traffic")
    Rel(cloudfront, s3, "Fetch content", "HTTPS")
    Rel(github, s3, "Deploy", "AWS SDK with IAM")

Security Zones

•Public Zone: CloudFront CDN (all traffic)
•Storage Zone: S3 bucket (restricted to CloudFront and GitHub Actions)

Firewall Rules

•CloudFront: Accept HTTPS (443) only, redirect HTTP to HTTPS
•S3: Block all public access, allow only CloudFront OAI and GitHub Actions IAM role
•WAF: Rate limiting (100 requests/5 minutes per IP), geo-blocking for known threat countries

Monitoring & Logging

Logging:

•CloudFront access logs → S3 bucket
•S3 access logs enabled
•GitHub Actions workflow logs
•AWS CloudTrail for API activity

Monitoring:

•
CloudWatch alarms for:
- •High error rates (4xx, 5xx)
- •Unusual traffic patterns
- •Failed deployments

Security Scanning:

•CodeQL analysis on every commit
•Dependency vulnerability scanning (Dependabot)
•ZAP security scan before deployment
•Lighthouse security audit

Incident Response

Security Incident Handling:

•Detection: Automated alerts, manual reports via SECURITY.md
•Assessment: Triage severity (Critical/High/Medium/Low)
•Containment: Roll back deployment if needed, block malicious IPs in WAF
•Eradication: Fix vulnerability, patch systems
•Recovery: Deploy fixed version, verify integrity
•Lessons Learned: Update security controls, document in post-mortem

Contact: security@hack23.com

Compliance Mapping

ISO 27001:2022

•A.8.24: TLS 1.2+ encryption
•A.8.9: Infrastructure as Code
•A.8.16: CloudWatch monitoring
•A.5.7: Automated security scanning

GDPR

•No personal data collected (Article 4)
•Privacy by design (Article 25)
•No cookies, no tracking

WCAG 2.1 AA

•Accessibility statement published
•Regular accessibility audits via Lighthouse

Security Metrics

Metric	Target	Current
Critical vulnerabilities	0	0
High vulnerabilities	< 5	2
Lighthouse Security Score	100	100
TLS Score (SSL Labs)	A+	A+
Security Headers Score	A+	A

Risk Register

See THREAT_MODEL.md for detailed threat analysis.

Security Improvements

See FUTURE_SECURITY_ARCHITECTURE.md for planned enhancements.

code


### Example 2: THREAT_MODEL.md Template

```markdown
# Threat Model - Hack23 Homepage

## System Overview

Static corporate website hosted on AWS S3 with CloudFront CDN. No user authentication, no sensitive data processing, no backend application logic.

## Assets

| Asset | Classification | Value |
|-------|---------------|-------|
| Website content | PUBLIC | Low (reputational impact) |
| GitHub repository | INTERNAL | Medium (intellectual property) |
| AWS infrastructure | CONFIDENTIAL | High (cost, availability) |
| Domain reputation | N/A | High (business impact) |

## Threat Actors

| Actor | Motivation | Capability |
|-------|-----------|-----------|
| Script kiddies | Vandalism, bragging rights | Low |
| Competitors | Reputation damage | Medium |
| Hacktivists | Political statement | Medium |
| Nation-states | Espionage, disruption | High |

## Attack Vectors

1. **Web Application Attacks**
   - XSS injection via compromised supply chain
   - Content injection via compromised build pipeline
   - DDoS attacks

2. **Supply Chain Attacks**
   - Compromised dependencies
   - Malicious GitHub Actions
   - Compromised build tools

3. **Infrastructure Attacks**
   - AWS credential compromise
   - S3 bucket misconfiguration
   - CloudFront compromise

4. **Social Engineering**
   - GitHub account takeover
   - Phishing for AWS credentials

## Threats (STRIDE Analysis)

### Spoofing

| Threat | Likelihood | Impact | Risk | Mitigation | Status |
|--------|-----------|--------|------|-----------|--------|
| Attacker impersonates Hack23 website | Low | High | Medium | HTTPS with HSTS, valid SSL cert | ✅ Mitigated |
| GitHub account takeover | Medium | High | High | 2FA required, strong passwords | ✅ Mitigated |
| AWS credential compromise | Low | Critical | High | IAM roles, no long-lived keys, AWS MFA | ✅ Mitigated |

### Tampering

| Threat | Likelihood | Impact | Risk | Mitigation | Status |
|--------|-----------|--------|------|-----------|--------|
| Malicious code injection in build | Low | High | Medium | Code review, branch protection, CodeQL | ✅ Mitigated |
| S3 content modification | Low | High | Medium | S3 versioning, access logging, IAM restrictions | ✅ Mitigated |
| Dependency substitution | Medium | High | High | Package lock files, Dependabot alerts | ⚠️ Partial |

### Repudiation

| Threat | Likelihood | Impact | Risk | Mitigation | Status |
|--------|-----------|--------|------|-----------|--------|
| Unauthorized changes without audit trail | Low | Medium | Low | Git history, GitHub audit log, CloudTrail | ✅ Mitigated |

### Information Disclosure

| Threat | Likelihood | Impact | Risk | Mitigation | Status |
|--------|-----------|--------|------|-----------|--------|
| Exposure of internal documentation | Low | Low | Low | No sensitive info in public repo, separate ISMS repo | ✅ Mitigated |
| AWS credentials leaked in logs | Low | High | Medium | No secrets in code, secret scanning enabled | ✅ Mitigated |

### Denial of Service

| Threat | Likelihood | Impact | Risk | Mitigation | Status |
|--------|-----------|--------|------|-----------|--------|
| DDoS attack on website | Medium | Medium | Medium | CloudFront DDoS protection, WAF rate limiting | ✅ Mitigated |
| S3 bucket deletion | Low | High | Medium | S3 versioning, MFA delete, backups | ✅ Mitigated |
| GitHub repository deletion | Low | High | Medium | Repository protection rules, backups | ✅ Mitigated |

### Elevation of Privilege

| Threat | Likelihood | Impact | Risk | Mitigation | Status |
|--------|-----------|--------|------|-----------|--------|
| Privilege escalation in GitHub | Low | High | Medium | Least privilege, branch protection, audit logging | ✅ Mitigated |
| AWS IAM privilege escalation | Low | Critical | High | Least privilege IAM policies, AWS Organizations SCPs | ✅ Mitigated |

## Risk Assessment Summary

| Risk Level | Count | Action Required |
|-----------|-------|-----------------|
| Critical | 0 | N/A |
| High | 3 | Monitor and maintain mitigations |
| Medium | 5 | Review quarterly |
| Low | 2 | Accept |

## Residual Risks

### Accepted Risks

1. **Dependency vulnerabilities (Medium)**
   - Justification: Low exploitability for static site, regular updates via Dependabot
   - Mitigation: Quarterly dependency reviews, automated security scans

2. **DDoS attacks (Medium)**
   - Justification: CloudFront provides adequate protection, complete prevention impossible
   - Mitigation: CloudFront DDoS Shield, WAF rate limiting, monitoring

## Security Controls Summary

| Control | Type | Status |
|---------|------|--------|
| HTTPS/TLS 1.2+ | Preventive | ✅ Implemented |
| AWS WAF | Preventive | ✅ Implemented |
| IAM least privilege | Preventive | ✅ Implemented |
| 2FA for GitHub | Preventive | ✅ Implemented |
| Code review | Preventive | ✅ Implemented |
| Branch protection | Preventive | ✅ Implemented |
| CodeQL scanning | Detective | ✅ Implemented |
| Dependabot alerts | Detective | ✅ Implemented |
| CloudWatch monitoring | Detective | ✅ Implemented |
| S3 versioning | Corrective | ✅ Implemented |
| Incident response plan | Corrective | ✅ Implemented |

## Review Schedule

- **Threat model review**: Annually or after significant changes
- **Risk assessment**: Quarterly
- **Control effectiveness**: Monthly (automated), Quarterly (manual)

**Last Reviewed:** 2025-01-24
**Next Review:** 2026-01-24

Related ISMS Policies

•Information Security Policy - Overall security framework
•Risk Assessment Policy - Risk management approach
•Incident Response Policy - Security incident handling
•Security Monitoring Policy - Logging and monitoring requirements

Compliance Mapping

ISO 27001:2022

•A.5.7 Threat intelligence
•A.5.24 Security event logging
•A.5.28 Collection of evidence
•A.8.8 Management of technical vulnerabilities
•A.8.16 Monitoring activities

NIST Cybersecurity Framework

•ID.RA-1: Asset vulnerabilities are identified
•ID.RA-2: Cyber threat intelligence is received
•ID.RA-3: Threats are identified and documented
•PR.IP-12: A vulnerability management plan is developed

Security Architecture Skill

Purpose

Rules

Required Documentation

SECURITY_ARCHITECTURE.md Requirements

FUTURE_SECURITY_ARCHITECTURE.md Requirements

THREAT_MODEL.md Requirements

Defense-in-Depth Layers

Security Control Categories

Security Zones

Examples

Example 1: SECURITY_ARCHITECTURE.md Template

Security Zones

Firewall Rules

Monitoring & Logging

Incident Response

Compliance Mapping

ISO 27001:2022

GDPR

WCAG 2.1 AA

Security Metrics

Risk Register

Security Improvements

Related ISMS Policies

Related Documentation

Compliance Mapping

ISO 27001:2022

NIST Cybersecurity Framework