security-analysis-skills

# Security Analysis Skills **Purpose**: Universal security knowledge framework for threat modeling, vulnerability assessment, risk scoring, and secure coding. Designed to be applied by ALL development agents (security-agent, developer-agent, devops-agent, rust-expert, python-ml-expert) to ensure security-first development practices. **Created**: 2025-11-08 --- ## When to Use Security Analysis Skills **✅ Use this skill when:** - Conducting threat modeling for new features/systems - Performing security code review - Assessing vulnerabilities and scoring risk - Implementing authentication/authorization - Handling sensitive data (PII, credentials, payment info) - Deploying to production (security checklist) - Investigating security incidents - Designing secure architectures **❌ NOT required for:** - Pure documentation tasks with no code - Read-only data analysis with public data - Internal tools with no network exposure (but still recommended) **Target Audience**: Security specialists AND general developers integrating security into daily work --- ## Core Security Frameworks ### 1. STRIDE Threat Modeling **Purpose**: Systematic identification of threats by category **STRIDE Categories**: 1. **S - Spoofing Identity** - Definition: Attacker pretends to be someone else - Examples: Stolen credentials, session hijacking, JWT forgery - Mitigations: MFA, certificate pinning, signed tokens 2. **T - Tampering with Data** - Definition: Unauthorized modification of data - Examples: Man-in-the-middle, SQL injection, XSS - Mitigations: HTTPS/TLS, input validation, integrity checks (HMAC) 3. **R - Repudiation** - Definition: User denies performing an action - Examples: Missing audit logs, unsigned transactions - Mitigations: Audit logging, digital signatures, timestamps 4. **I - Information Disclosure** - Definition: Exposure of confidential information - Examples: Directory traversal, verbose errors, unencrypted data - Mitigations: Encryption at rest/transit, least privilege, sanitized errors 5. **D - Denial of Service** - Definition: Service becomes unavailable - Examples: Resource exhaustion, infinite loops, DDoS attacks - Mitigations: Rate limiting, resource quotas, circuit breakers 6. **E - Elevation of Privilege** - Definition: Unauthorized permission escalation - Examples: Privilege escalation bugs, insecure defaults - Mitigations: Principle of least privilege, role-based access control **How to Apply STRIDE**: 1. For each component/feature, ask: "What STRIDE threats apply?" 2. Fill out threat modeling worksheet (see reference section) 3. Prioritize threats by impact × likelihood 4. Document mitigations for each identified threat --- ### 2. OWASP Top 10 (2021 Edition) **Purpose**: Most critical web application security risks #### A01: Broken Access Control **Description**: Users can act outside their intended permissions **Examples**: - Direct object references: `/user/1234/profile` → change to `/user/5678/profile` - Missing function-level access control: Regular user accesses `/admin/delete` - IDOR (Insecure Direct Object Reference): Manipulating IDs in URLs/APIs **Secure Patterns**: ```python # ❌ VULNERABLE: No ownership check @app.route('/document/<doc_id>') def get_document(doc_id): doc = Document.query.get(doc_id) return render_template('doc.html', doc=doc) # ✅ SECURE: Verify ownership @app.route('/document/<doc_id>') @login_required def get_document(doc_id): doc = Document.query.get(doc_id) if not doc or doc.owner_id != current_user.id: abort(403) # Forbidden return render_template('doc.html', doc=doc) ``` **Checklist**: - [ ] All endpoints verify user permissions - [ ] Object ownership validated before access - [ ] Default deny (whitelist not blacklist) - [ ] Disable directory listing - [ ] Invalidate sessions on logout --- #### A02: Cryptographic Failures **Description**: Sensitive data exposed due to weak/missing encryption **Examples**: - Storing passwords in plaintext - Using weak algorithms (MD5, SHA1 for passwords) - Transmitting sensitive data over HTTP - Hardcoded encryption keys **Secure Patterns**: ```python # ❌ VULNERABLE: Weak hashing import hashlib password_hash = hashlib.md5(password.encode()).hexdigest() # ✅ SECURE: Proper password hashing import bcrypt password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt()) # ❌ VULNERABLE: Hardcoded key AES_KEY = "mysecretkey12345" # ✅ SECURE: Environment variable import os AES_KEY = os.environ['AES_ENCRYPTION_KEY'] ``` **Checklist**: - [ ] Use TLS 1.2+ for all data in transit - [ ] Hash passwords with bcrypt/Argon2 (not MD5/SHA1) - [ ] Never hardcode secrets (use env vars/vaults) - [ ] Encrypt sensitive data at rest - [ ] Use strong key generation (crypto.randomBytes, secrets module) --- #### A03: Injection **Description**: Untrusted data sent to interpreter as command/query **Types**: SQL Injection, NoSQL Injection, Command Injection, LDAP Injection, XPath Injection **SQL Injection Example**: ```python # ❌ VULNERABLE: String concatenation username = request.form['username'] query = f"SELECT * FROM users WHERE username = '{username}'" # Attacker inputs: ' OR '1'='1' -- # Result: SELECT * FROM users WHERE username = '' OR '1'='1' --' # ✅ SECURE: Parameterized query username = request.form['username'] query = "SELECT * FROM users WHERE username = ?" cursor.execute(query, (username,)) ``` **Command Injection Example**: ```python # ❌ VULNERABLE: Shell injection filename = request.form['filename'] os.system(f"cat {filename}") # Attacker: "; rm -rf /" # ✅ SECURE: Avoid shell, use safe APIs import subprocess subprocess.run(['cat', filename], check=True, capture_output=True) ``` **Checklist**: - [ ] Use parameterized queries (prepared statements) - [ ] Avoid dynamic query construction with string concat - [ ] Validate input against whitelist (not blacklist) - [ ] Escape special characters for context - [ ] Use ORM frameworks (with parameterization) --- #### A04: Insecure Design **Description**: Missing or ineffective security controls in design phase **Examples**: - No rate limiting on login (brute force) - Password reset without identity verification - Predictable session IDs - No transaction verification (CSRF) **Secure Design Patterns**: - Defense in depth (multiple security layers) - Principle of least privilege - Fail securely (default deny) - Separation of duties - Security by default (opt-in for risky features) **Checklist**: - [ ] Threat model created during design - [ ] Rate limiting on authentication/sensitive endpoints - [ ] CSRF tokens for state-changing operations - [ ] Cryptographically secure random IDs (not sequential) - [ ] Security requirements defined before coding --- #### A05: Security Misconfiguration **Description**: Insecure default configurations, incomplete setups, exposed admin interfaces **Examples**: - Default admin credentials (admin/admin) - Verbose error messages revealing stack traces - Unnecessary features enabled (debug mode in production) - Missing security headers - Outdated software versions **Secure Configuration**: ```python # ❌ VULNERABLE: Debug mode in production app = Flask(__name__) app.config['DEBUG'] = True # Exposes code, allows RCE # ✅ SECURE: Environment-based config import os app.config['DEBUG'] = os.environ.get('FLASK_ENV') == 'development' # ✅ SECURE: Security headers @app.after_request def set_security_headers(response): response.headers['X-Content-Type-Options'] = 'nosniff' response.headers['X-Frame-Options'] = 'DENY' response.headers['X-XSS-Protection'] = '1; mode=block' response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains' return response ``` **Checklist**: - [ ] Change all default credentials - [ ] Disable debug mode in production - [ ] Remove unnecessary features/services - [ ] Configure security headers (CSP, HSTS, X-Frame-Options) - [ ] Regular security updates applied --- #### A06: Vulnerable and Outdated Components **Description**: Using libraries/frameworks with known vulnerabilities **Examples**: - Unmaintained dependencies (no security patches) - Using deprecated crypto libraries - Outdated frameworks (old Rails, Django, Spring) **Secure Practices**: ```bash # Check for vulnerabilities npm audit # Node.js pip-audit # Python bundle audit # Ruby cargo audit # Rust # Update dependencies npm update pip install --upgrade -r requirements.txt cargo update ``` **Checklist**: - [ ] Dependency scanning in CI/CD - [ ] Regular updates (monthly for deps, immediate for critical CVEs) - [ ] Remove unused dependencies - [ ] Pin versions (avoid wildcards like *) - [ ] Monitor CVE databases (NVD, GitHub Security Advisories) --- #### A07: Identification and Authentication Failures **Description**: Weak authentication allows attackers to compromise accounts **Examples**: - Weak password policy (no complexity requirements) - Session fixation - Missing MFA - Predictable session tokens - No account lockout on brute force **Secure Authentication**: ```python # Password Policy MIN_LENGTH = 12 REQUIRE_UPPERCASE = True REQUIRE_DIGIT = True REQUIRE_SPECIAL = True # Session Management from secrets import token_urlsafe session_id = token_urlsafe(32) # Cryptographically secure # Rate Limiting from flask_limiter import Limiter limiter = Limiter(app, default_limits=["5 per minute"]) @app.route('/login', methods=['POST']) @limiter.limit("5 per minute") def login(): # Login logic with rate limiting pass ``` **Checklist**: - [ ] Strong password policy enforced - [ ] MFA available (TOTP, WebAuthn) - [ ] Account lockout after N failed attempts - [ ] Session timeout configured - [ ] Secure session cookie flags (HttpOnly, Secure, SameSite) --- #### A08: Software and Data Integrity Failures **Description**: Code/infrastructure relies on untrusted sources without integrity verification **Examples**: - Downloading dependencies without checksum verification - Auto-update without signature validation - Insecure CI/CD pipeline - Deserialization of untrusted data **Secure Practices**: ```python # ❌ VULNERABLE: Deserialize untrusted data import pickle data = pickle.loads(request.data) # RCE risk! # ✅ SECURE: Use safe serialization import json data = json.loads(request.data) # Only deserializes JSON primitives # Verify package integrity pip install --require-hashes -r requirements.txt ``` **Checklist**: - [ ] Use signed commits (GPG) - [ ] Verify package checksums/signatures - [ ] Secure CI/CD pipeline (no secrets in logs) - [ ] Avoid insecure deserialization (pickle, YAML.unsafe_load) - [ ] Implement software bill of materials (SBOM) --- #### A09: Security Logging and Monitoring Failures **Description**: Insufficient logging prevents detection of breaches **Examples**: - No logging of authentication events - Logs not reviewed/alerted - Sensitive data in logs (passwords, tokens) - No integrity protection (logs can be tampered) **Secure Logging**: ```python import logging import hashlib # ✅ SECURE: Log security events logger = logging.getLogger('security') @app.route('/login', methods=['POST']) def login(): username = request.form['username'] password = request.form['password'] if authenticate(username, password): logger.info(f"Successful login: user={username}, ip={request.remote_addr}") return "Success" else: logger.warning(f"Failed login: user={username}, ip={request.remote_addr}") return "Invalid credentials", 401 # ❌ VULNERABLE: Log sensitive data logger.info(f"User {username} logged in with password {password}") # DON'T! # ✅ SECURE: Redact sensitive data logger.info(f"User {username} logged in") ``` **Checklist**: - [ ] Log all authentication events (success/failure) - [ ] Log authorization failures - [ ] Log input validation failures - [ ] Never log passwords, tokens, PII - [ ] Centralized logging with alerting - [ ] Tamper-evident logs (write-once storage) --- #### A10: Server-Side Request Forgery (SSRF) **Description**: Web app fetches remote resource without validating user-supplied URL **Examples**: - Fetching arbitrary URLs from user input - Accessing internal services (localhost, 169.254.169.254) - Port scanning via web app **SSRF Example**: ```python # ❌ VULNERABLE: Fetch arbitrary URL import requests url = request.args.get('url') response = requests.get(url) # Attacker: http://localhost:6379/ # ✅ SECURE: Whitelist domains ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com'] from urllib.parse import urlparse url = request.args.get('url') parsed = urlparse(url) if parsed.hostname not in ALLOWED_DOMAINS: abort(400, "Invalid domain") response = requests.get(url) ``` **Checklist**: - [ ] Whitelist allowed domains/IPs - [ ] Block private IP ranges (10.0.0.0/8, 192.168.0.0/16, 127.0.0.1) - [ ] Disable URL redirects or validate redirect targets - [ ] Use network segmentation (no internet access from app servers) --- ### 3. Risk Scoring (CVSS v3.1) **Purpose**: Quantify vulnerability severity for prioritization **CVSS Formula**: Base Score (0-10) = f(Impact, Exploitability) **Severity Levels**: - **Critical (9.0-10.0)**: Immediate action required, exploit in the wild - **High (7.0-8.9)**: High priority, exploitable remotely