security-architecture

# Security Architecture Skill ## Purpose This skill defines requirements for security architecture documentation following Hack23 ISMS policies. It ensures that security controls, threat models, and defense-in-depth strategies are properly documented and maintained for all systems. ## Rules ### Required Documentation **MUST CREATE:** - `SECURITY_ARCHITECTURE.md` - Current security controls and architecture - `FUTURE_SECURITY_ARCHITECTURE.md` - Planned security improvements - `THREAT_MODEL.md` - Threat analysis and mitigations - Security section in main `README.md` - Security policy (`.github/SECURITY.md`) ### SECURITY_ARCHITECTURE.md Requirements **MUST INCLUDE:** 1. **Overview** - System security posture summary 2. **Security Controls** - Implemented controls mapped to frameworks (ISO 27001, NIST CSF, CIS Controls) 3. **Authentication & Authorization** - Identity management approach 4. **Data Protection** - Encryption at rest and in transit 5. **Network Security** - Firewall rules, network segmentation, DMZ architecture 6. **Monitoring & Logging** - Security event logging and SIEM integration 7. **Incident Response** - Security incident handling procedures 8. **Compliance Mapping** - How architecture meets compliance requirements 9. **Security Diagrams** - C4 diagrams showing trust boundaries and security zones **MUST NOT:** - Expose sensitive security details (specific firewall rules, vulnerability details) - Include credentials or secrets - Document security through obscurity approaches ### FUTURE_SECURITY_ARCHITECTURE.md Requirements **MUST INCLUDE:** 1. **Security Roadmap** - Planned security enhancements with timeline 2. **Gap Analysis** - Current vs. desired state 3. **Security Initiatives** - Planned projects to improve security 4. **Technology Evolution** - Future security technologies to adopt 5. **Risk Mitigation Plans** - How future changes will reduce risks 6. **Compliance Improvements** - Plans to meet future compliance requirements ### THREAT_MODEL.md Requirements **MUST INCLUDE:** 1. **System Overview** - What is being protected 2. **Assets** - Critical data and systems 3. **Threat Actors** - Who might attack and their motivations 4. **Attack Vectors** - How attacks might occur 5. **Threats** - Specific threats using STRIDE or similar methodology: - **S**poofing - **T**ampering - **R**epudiation - **I**nformation Disclosure - **D**enial of Service - **E**levation of Privilege 6. **Risk Assessment** - Likelihood and impact of each threat 7. **Mitigations** - Controls to prevent or reduce each threat 8. **Residual Risks** - Accepted risks after mitigations **Threat Prioritization:** - **Critical**: Immediate action required - **High**: Remediate within 30 days - **Medium**: Remediate within 90 days - **Low**: Accept or remediate opportunistically ### Defense-in-Depth Layers **MUST IMPLEMENT:** 1. **Perimeter Security** - Web Application Firewall (WAF) - DDoS protection - Rate limiting - Geo-blocking (if applicable) 2. **Network Security** - Network segmentation (DMZ, application tier, data tier) - VPN for remote access - Zero-trust networking - Private subnets for sensitive resources 3. **Application Security** - Input validation - Output encoding - Authentication & authorization - Session management - CSRF protection - Secure headers (CSP, HSTS, X-Frame-Options) 4. **Data Security** - Encryption at rest (AES-256) - Encryption in transit (TLS 1.2+) - Data classification and handling - Secure key management - Database access controls 5. **Monitoring & Detection** - Security event logging - Intrusion detection/prevention (IDS/IPS) - Anomaly detection - Security alerts and incident response - Audit logging 6. **Physical Security** - Secure data center (for on-premise) - Access controls - Environmental controls - Asset management ### Security Control Categories **Preventive Controls:** - Access controls - Encryption - Input validation - Firewall rules - Secure configuration **Detective Controls:** - Logging - Monitoring - Intrusion detection - Vulnerability scanning - Audit reviews **Corrective Controls:** - Incident response - Patch management - Backup and recovery - Business continuity **Deterrent Controls:** - Security awareness training - Legal agreements (NDAs) - Security policies - Audit reports ### Security Zones **Public Zone (Untrusted):** - Static website content - Public APIs (read-only, rate-limited) - CDN distribution **DMZ (Semi-trusted):** - Web servers - API gateways - Load balancers - WAF **Application Zone (Trusted):** - Application servers - Business logic - Internal APIs - Background workers **Data Zone (Highly Trusted):** - Databases - File storage with sensitive data - Key management systems - Backup systems ## Examples ### Example 1: SECURITY_ARCHITECTURE.md Template ```markdown # Security Architecture - Hack23 Homepage ## Overview The Hack23 Homepage is a static website deployed on AWS S3 with CloudFront CDN. Security is implemented through defense-in-depth with multiple layers of protection. **Security Posture:** Public-facing static website with no user authentication or sensitive data processing. ## Security Controls ### ISO 27001:2022 Controls Implemented | Control | Implementation | Status | |---------|---------------|--------| | A.8.24 Use of cryptography | TLS 1.2+ enforced via CloudFront | ✅ Implemented | | A.8.9 Configuration management | Infrastructure as Code (Terraform) | ✅ Implemented | | A.8.16 Monitoring | CloudWatch logging and alarms | ✅ Implemented | | A.5.7 Threat intelligence | ZAP security scanning in CI/CD | ✅ Implemented | ### NIST Cybersecurity Framework | Function | Category | Implementation | |----------|----------|----------------| | Identify | Asset Management | Repository inventory, dependency tracking | | Protect | Access Control | GitHub branch protection, AWS IAM roles | | Detect | Security Monitoring | GitHub Advanced Security, CloudWatch | | Respond | Incident Response | SECURITY.md vulnerability reporting | | Recover | Backup & Recovery | Git version control, S3 versioning | ## Authentication & Authorization **Public Access:** - No authentication required for website content - All content is PUBLIC classification **Administrative Access:** - GitHub authentication with 2FA required - AWS IAM roles with least privilege - Branch protection rules on main branch ## Data Protection **Data Classification:** - All website content: PUBLIC - No personal data collected - No cookies or tracking (privacy by design) **Encryption:** - **In Transit**: TLS 1.2+ enforced on CloudFront - **At Rest**: S3 server-side encryption (AES-256) **Data Retention:** - Git history retained indefinitely - CloudWatch logs retained 90 days - No user data to retain ## Network Security ### Architecture Diagram ```mermaid C4Container title Security Architecture - Hack23 Homepage Person(visitor, "Visitor", "Public user") System_Boundary(aws, "AWS Cloud") { Container(cloudfront, "CloudFront CDN", "AWS CDN", "TLS termination, caching") Container(waf, "AWS WAF", "Web Application Firewall", "DDoS protection, rate limiting") Container(s3, "S3 Bucket", "Static Storage", "Encrypted website files") } System_Ext(github, "GitHub Actions", "CI/CD", "Automated deployment") Rel(visitor, cloudfront, "HTTPS only", "TLS 1.2+") Rel(cloudfront, waf, "Filtered traffic") Rel(cloudfront, s3, "Fetch content", "HTTPS") Rel(github, s3, "Deploy", "AWS SDK with IAM") ``` ### Security Zones - **Public Zone**: CloudFront CDN (all traffic) - **Storage Zone**: S3 bucket (restricted to CloudFront and GitHub Actions) ### Firewall Rules - CloudFront: Accept HTTPS (443) only, redirect HTTP to HTTPS - S3: Block all public access, allow only CloudFront OAI and GitHub Actions IAM role - WAF: Rate limiting (100 requests/5 minutes per IP), geo-blocking for known threat countries ## Monitoring & Logging **Logging:** - CloudFront access logs → S3 bucket - S3 access logs enabled - GitHub Actions workflow logs - AWS CloudTrail for API activity **Monitoring:** - CloudWatch alarms for: - High error rates (4xx, 5xx) - Unusual traffic patterns - Failed deployments **Security Scanning:** - CodeQL analysis on every commit - Dependency vulnerability scanning (Dependabot) - ZAP security scan before deployment - Lighthouse security audit ## Incident Response **Security Incident Handling:** 1. **Detection**: Automated alerts, manual reports via SECURITY.md 2. **Assessment**: Triage severity (Critical/High/Medium/Low) 3. **Containment**: Roll back deployment if needed, block malicious IPs in WAF 4. **Eradication**: Fix vulnerability, patch systems 5. **Recovery**: Deploy fixed version, verify integrity 6. **Lessons Learned**: Update security controls, document in post-mortem **Contact:** security@hack23.com ## Compliance Mapping ### ISO 27001:2022 - A.8.24: TLS 1.2+ encryption - A.8.9: Infrastructure as Code - A.8.16: CloudWatch monitoring - A.5.7: Automated security scanning ### GDPR - No personal data collected (Article 4) - Privacy by design (Article 25) - No cookies, no tracking ### WCAG 2.1 AA - Accessibility statement published - Regular accessibility audits via Lighthouse ## Security Metrics | Metric | Target | Current | |--------|--------|---------| | Critical vulnerabilities | 0 | 0 | | High vulnerabilities | < 5 | 2 | | Lighthouse Security Score | 100 | 100 | | TLS Score (SSL Labs) | A+ | A+ | | Security Headers Score | A+ | A | ## Risk Register See [THREAT_MODEL.md](THREAT_MODEL.md) for detailed threat analysis. ## Security Improvements See [FUTURE_SECURITY_ARCHITECTURE.md](FUTURE_SECURITY_ARCHITECTURE.md) for planned enhancements. ``` ### Example 2: THREAT_MODEL.md Template ```markdown # Threat Model - Hack23 Homepage ## System Overview Static corporate website hosted on AWS S3 with CloudFront CDN. No user authentication, no sensitive data processing, no backend application logic. ## Assets | Asset | Classification | Value | |-------|---------------|-------| | Website content | PUBLIC | Low (reputational impact) | | GitHub repository | INTERNAL | Medium (intellectual property) | | AWS infrastructure | CONFIDENTIAL | High (cost, availability) | | Domain reputation | N/A | High (business impact) | ## Threat Actors | Actor | Motivation | Capability | |-------|-----------|-----------| | Script kiddies | Vandalism, bragging rights | Low | | Competitors | Reputation damage | Medium | | Hacktivists | Political statement | Medium | | Nation-states | Espionage, disruption | High | ## Attack Vectors 1. **Web Application Attacks** - XSS injection via compromised supply chain - Content injection via compromised build pipeline - DDoS attacks 2. **Supply Chain Attacks** - Compromised dependencies - Malicious GitHub Actions - Compromised build tools 3. **Infrastructure Attacks** - AWS credential compromise - S3 bucket misconfiguration - CloudFront compromise 4. **Social Engineering** - GitHub account takeover - Phishing for AWS credentials ## Threats (STRIDE Analysis) ### Spoofing | Threat | Likelihood | Impact | Risk | Mitigation | Status | |--------|-----------|--------|------|-----------|--------| | Attacker impersonates Hack23 website | Low | High | Medium | HTTPS with HSTS, valid SSL cert | ✅ Mitigated | | GitHub account takeover | Medium | High | High | 2FA required, strong passwords | ✅ Mitigated | | AWS credential compromise | Low | Critical | High | IAM roles, no long-lived keys, AWS MFA | ✅ Mitigated | ### Tampering | Threat | Likelihood | Impact | Risk | Mitigation | Status | |--------|-----------|--------|------|-----------|--------| | Malicious code injection in build | Low | High | Medium | Code review, branch protection, CodeQL | ✅ Mitigated | | S3 content modification | Low | High | Medium | S3 versioning, access logging, IAM restrictions | ✅ Mitigated | | Dependency substitution | Medium | High | High | Package lock files, Dependabot alerts | ⚠️ Partial | ### Repudiation | Threat | Likelihood | Impact | Risk | Mitigation | Status | |--------|-----------|--------|------|-----------|--------| | Unauthorized changes without audit trail | Low | Medium | Low | Git history, GitHub audit log, CloudTrail | ✅ Mitigated | ### Information Disclosure | Threat | Likelihood | Impact | Risk | Mitigation | Status |