security-analysis-skills

name	security-analysis-skills
description	Comprehensive security analysis framework teaching STRIDE threat modeling, OWASP Top 10 vulnerabilities, CVSS risk scoring, and secure coding patterns. Use when conducting security assessments, code reviews, threat modeling, or implementing security controls. Applicable to all development work requiring security consideration.
license	MIT

Security Analysis Skills

Purpose: Universal security knowledge framework for threat modeling, vulnerability assessment, risk scoring, and secure coding. Designed to be applied by ALL development agents (security-agent, developer-agent, devops-agent, rust-expert, python-ml-expert) to ensure security-first development practices.

Created: 2025-11-08

---

When to Use Security Analysis Skills

✅ Use this skill when:

• Conducting threat modeling for new features/systems
• Performing security code review
• Assessing vulnerabilities and scoring risk
• Implementing authentication/authorization
• Handling sensitive data (PII, credentials, payment info)
• Deploying to production (security checklist)
• Investigating security incidents
• Designing secure architectures

❌ NOT required for:

• Pure documentation tasks with no code
• Read-only data analysis with public data
• Internal tools with no network exposure (but still recommended)

Target Audience: Security specialists AND general developers integrating security into daily work

---

Core Security Frameworks

1. STRIDE Threat Modeling

Purpose: Systematic identification of threats by category

STRIDE Categories:

1. S - Spoofing Identity

   • Definition: Attacker pretends to be someone else
   • Examples: Stolen credentials, session hijacking, JWT forgery
   • Mitigations: MFA, certificate pinning, signed tokens

2. T - Tampering with Data

   • Definition: Unauthorized modification of data
   • Examples: Man-in-the-middle, SQL injection, XSS
   • Mitigations: HTTPS/TLS, input validation, integrity checks (HMAC)

3. R - Repudiation

   • Definition: User denies performing an action
   • Examples: Missing audit logs, unsigned transactions
   • Mitigations: Audit logging, digital signatures, timestamps

4. I - Information Disclosure

   • Definition: Exposure of confidential information
   • Examples: Directory traversal, verbose errors, unencrypted data
   • Mitigations: Encryption at rest/transit, least privilege, sanitized errors

5. D - Denial of Service

   • Definition: Service becomes unavailable
   • Examples: Resource exhaustion, infinite loops, DDoS attacks
   • Mitigations: Rate limiting, resource quotas, circuit breakers

6. E - Elevation of Privilege

   • Definition: Unauthorized permission escalation
   • Examples: Privilege escalation bugs, insecure defaults
   • Mitigations: Principle of least privilege, role-based access control

How to Apply STRIDE:

1. For each component/feature, ask: "What STRIDE threats apply?"
2. Fill out threat modeling worksheet (see reference section)
3. Prioritize threats by impact × likelihood
4. Document mitigations for each identified threat

---

2. OWASP Top 10 (2021 Edition)

Purpose: Most critical web application security risks

A01: Broken Access Control

Description: Users can act outside their intended permissions

Examples:

• Direct object references: /user/1234/profile → change to /user/5678/profile
• Missing function-level access control: Regular user accesses /admin/delete
• IDOR (Insecure Direct Object Reference): Manipulating IDs in URLs/APIs

Secure Patterns:

# ❌ VULNERABLE: No ownership check
@app.route('/document/<doc_id>')
def get_document(doc_id):
    doc = Document.query.get(doc_id)
    return render_template('doc.html', doc=doc)

# ✅ SECURE: Verify ownership
@app.route('/document/<doc_id>')
@login_required
def get_document(doc_id):
    doc = Document.query.get(doc_id)
    if not doc or doc.owner_id != current_user.id:
        abort(403)  # Forbidden
    return render_template('doc.html', doc=doc)

Checklist:

• All endpoints verify user permissions
• Object ownership validated before access
• Default deny (whitelist not blacklist)
• Disable directory listing
• Invalidate sessions on logout

---

A02: Cryptographic Failures

Description: Sensitive data exposed due to weak/missing encryption

Examples:

• Storing passwords in plaintext
• Using weak algorithms (MD5, SHA1 for passwords)
• Transmitting sensitive data over HTTP
• Hardcoded encryption keys

Secure Patterns:

# ❌ VULNERABLE: Weak hashing
import hashlib
password_hash = hashlib.md5(password.encode()).hexdigest()

# ✅ SECURE: Proper password hashing
import bcrypt
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

# ❌ VULNERABLE: Hardcoded key
AES_KEY = "mysecretkey12345"

# ✅ SECURE: Environment variable
import os
AES_KEY = os.environ['AES_ENCRYPTION_KEY']

Checklist:

• Use TLS 1.2+ for all data in transit
• Hash passwords with bcrypt/Argon2 (not MD5/SHA1)
• Never hardcode secrets (use env vars/vaults)
• Encrypt sensitive data at rest
• Use strong key generation (crypto.randomBytes, secrets module)

---

A03: Injection

Description: Untrusted data sent to interpreter as command/query

Types: SQL Injection, NoSQL Injection, Command Injection, LDAP Injection, XPath Injection

SQL Injection Example:

# ❌ VULNERABLE: String concatenation
username = request.form['username']
query = f"SELECT * FROM users WHERE username = '{username}'"
# Attacker inputs: ' OR '1'='1' --
# Result: SELECT * FROM users WHERE username = '' OR '1'='1' --'

# ✅ SECURE: Parameterized query
username = request.form['username']
query = "SELECT * FROM users WHERE username = ?"
cursor.execute(query, (username,))

Command Injection Example:

# ❌ VULNERABLE: Shell injection
filename = request.form['filename']
os.system(f"cat {filename}")  # Attacker: "; rm -rf /"

# ✅ SECURE: Avoid shell, use safe APIs
import subprocess
subprocess.run(['cat', filename], check=True, capture_output=True)

Checklist:

• Use parameterized queries (prepared statements)
• Avoid dynamic query construction with string concat
• Validate input against whitelist (not blacklist)
• Escape special characters for context
• Use ORM frameworks (with parameterization)

---

A04: Insecure Design

Description: Missing or ineffective security controls in design phase

Examples:

• No rate limiting on login (brute force)
• Password reset without identity verification
• Predictable session IDs
• No transaction verification (CSRF)

Secure Design Patterns:

• Defense in depth (multiple security layers)
• Principle of least privilege
• Fail securely (default deny)
• Separation of duties
• Security by default (opt-in for risky features)

Checklist:

• Threat model created during design
• Rate limiting on authentication/sensitive endpoints
• CSRF tokens for state-changing operations
• Cryptographically secure random IDs (not sequential)
• Security requirements defined before coding

---

A05: Security Misconfiguration

Description: Insecure default configurations, incomplete setups, exposed admin interfaces

Examples:

• Default admin credentials (admin/admin)
• Verbose error messages revealing stack traces
• Unnecessary features enabled (debug mode in production)
• Missing security headers
• Outdated software versions

Secure Configuration:

# ❌ VULNERABLE: Debug mode in production
app = Flask(__name__)
app.config['DEBUG'] = True  # Exposes code, allows RCE

# ✅ SECURE: Environment-based config
import os
app.config['DEBUG'] = os.environ.get('FLASK_ENV') == 'development'

# ✅ SECURE: Security headers
@app.after_request
def set_security_headers(response):
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    return response

Checklist:

• Change all default credentials
• Disable debug mode in production
• Remove unnecessary features/services
• Configure security headers (CSP, HSTS, X-Frame-Options)
• Regular security updates applied

---

A06: Vulnerable and Outdated Components

Description: Using libraries/frameworks with known vulnerabilities

Examples:

• Unmaintained dependencies (no security patches)
• Using deprecated crypto libraries
• Outdated frameworks (old Rails, Django, Spring)

Secure Practices:

# Check for vulnerabilities
npm audit          # Node.js
pip-audit          # Python
bundle audit       # Ruby
cargo audit        # Rust

# Update dependencies
npm update
pip install --upgrade -r requirements.txt
cargo update

Checklist:

• Dependency scanning in CI/CD
• Regular updates (monthly for deps, immediate for critical CVEs)
• Remove unused dependencies
• Pin versions (avoid wildcards like *)
• Monitor CVE databases (NVD, GitHub Security Advisories)

---

A07: Identification and Authentication Failures

Description: Weak authentication allows attackers to compromise accounts

Examples:

• Weak password policy (no complexity requirements)
• Session fixation
• Missing MFA
• Predictable session tokens
• No account lockout on brute force

Secure Authentication:

# Password Policy
MIN_LENGTH = 12
REQUIRE_UPPERCASE = True
REQUIRE_DIGIT = True
REQUIRE_SPECIAL = True

# Session Management
from secrets import token_urlsafe
session_id = token_urlsafe(32)  # Cryptographically secure

# Rate Limiting
from flask_limiter import Limiter
limiter = Limiter(app, default_limits=["5 per minute"])

@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")
def login():
    # Login logic with rate limiting
    pass

Checklist:

• Strong password policy enforced
• MFA available (TOTP, WebAuthn)
• Account lockout after N failed attempts
• Session timeout configured
• Secure session cookie flags (HttpOnly, Secure, SameSite)

---

A08: Software and Data Integrity Failures

Description: Code/infrastructure relies on untrusted sources without integrity verification

Examples:

• Downloading dependencies without checksum verification
• Auto-update without signature validation
• Insecure CI/CD pipeline
• Deserialization of untrusted data

Secure Practices:

# ❌ VULNERABLE: Deserialize untrusted data
import pickle
data = pickle.loads(request.data)  # RCE risk!

# ✅ SECURE: Use safe serialization
import json
data = json.loads(request.data)  # Only deserializes JSON primitives

# Verify package integrity
pip install --require-hashes -r requirements.txt

Checklist:

• Use signed commits (GPG)
• Verify package checksums/signatures
• Secure CI/CD pipeline (no secrets in logs)
• Avoid insecure deserialization (pickle, YAML.unsafe_load)
• Implement software bill of materials (SBOM)

---

A09: Security Logging and Monitoring Failures

Description: Insufficient logging prevents detection of breaches

Examples:

• No logging of authentication events
• Logs not reviewed/alerted
• Sensitive data in logs (passwords, tokens)
• No integrity protection (logs can be tampered)

Secure Logging:

import logging
import hashlib

# ✅ SECURE: Log security events
logger = logging.getLogger('security')

@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    password = request.form['password']

    if authenticate(username, password):
        logger.info(f"Successful login: user={username}, ip={request.remote_addr}")
        return "Success"
    else:
        logger.warning(f"Failed login: user={username}, ip={request.remote_addr}")
        return "Invalid credentials", 401

# ❌ VULNERABLE: Log sensitive data
logger.info(f"User {username} logged in with password {password}")  # DON'T!

# ✅ SECURE: Redact sensitive data
logger.info(f"User {username} logged in")

Checklist:

• Log all authentication events (success/failure)
• Log authorization failures
• Log input validation failures
• Never log passwords, tokens, PII
• Centralized logging with alerting
• Tamper-evident logs (write-once storage)

---

A10: Server-Side Request Forgery (SSRF)

Description: Web app fetches remote resource without validating user-supplied URL

Examples:

• Fetching arbitrary URLs from user input
• Accessing internal services (localhost, 169.254.169.254)
• Port scanning via web app

SSRF Example:

# ❌ VULNERABLE: Fetch arbitrary URL
import requests
url = request.args.get('url')
response = requests.get(url)  # Attacker: http://localhost:6379/

# ✅ SECURE: Whitelist domains
ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com']
from urllib.parse import urlparse

url = request.args.get('url')
parsed = urlparse(url)
if parsed.hostname not in ALLOWED_DOMAINS:
    abort(400, "Invalid domain")
response = requests.get(url)

Checklist:

• Whitelist allowed domains/IPs
• Block private IP ranges (10.0.0.0/8, 192.168.0.0/16, 127.0.0.1)
• Disable URL redirects or validate redirect targets
• Use network segmentation (no internet access from app servers)

---

3. Risk Scoring (CVSS v3.1)

Purpose: Quantify vulnerability severity for prioritization

CVSS Formula: Base Score (0-10) = f(Impact, Exploitability)

Severity Levels:

• Critical (9.0-10.0): Immediate action required, exploit in the wild
• High (7.0-8.9): High priority, exploitable remotely