// Design comprehensive security architectures using defense-in-depth, zero trust principles, threat modeling (STRIDE, PASTA), and control frameworks (NIST CSF, CIS Controls, ISO 27001). Use when designing security for new systems, auditing existing architectures, or establishing security governance programs.
Manage Linux systems covering systemd services, process management, filesystems, networking, performance tuning, and troubleshooting. Use when deploying applications, optimizing server performance, diagnosing production issues, or managing users and security on Linux servers.
Data pipelines, feature stores, and embedding generation for AI/ML systems. Use when building RAG pipelines, ML feature serving, or data transformations. Covers feature stores (Feast, Tecton), embedding pipelines, chunking strategies, orchestration (Dagster, Prefect, Airflow), dbt transformations, data versioning (LakeFS), and experiment tracking (MLflow, W&B).
Strategic guidance for designing modern data platforms, covering storage paradigms (data lake, warehouse, lakehouse), modeling approaches (dimensional, normalized, data vault, wide tables), data mesh principles, and medallion architecture patterns. Use when architecting data platforms, choosing between centralized vs decentralized patterns, selecting table formats (Iceberg, Delta Lake), or designing data governance frameworks.
Design cloud network architectures with VPC patterns, subnet strategies, zero trust principles, and hybrid connectivity. Use when planning VPC topology, implementing multi-cloud networking, or establishing secure network segmentation for cloud workloads.
Assembles component outputs from AI Design Components skills into unified, production-ready component systems with validated token integration, proper import chains, and framework-specific scaffolding. Use as the capstone skill after running theming, layout, dashboard, data-viz, or feedback skills to wire components into working React/Next.js, Python, or Rust projects.
Builds AI chat interfaces and conversational UI with streaming responses, context management, and multi-modal support. Use when creating ChatGPT-style interfaces, AI assistants, code copilots, or conversational agents. Handles streaming text, token limits, regeneration, feedback loops, tool usage visualization, and AI-specific error patterns. Provides battle-tested components from leading AI products with accessibility and performance built in.
| name | architecting-security |
| description | Design comprehensive security architectures using defense-in-depth, zero trust principles, threat modeling (STRIDE, PASTA), and control frameworks (NIST CSF, CIS Controls, ISO 27001). Use when designing security for new systems, auditing existing architectures, or establishing security governance programs. |
Design and implement comprehensive security architectures that protect systems, data, and users through layered defense strategies, zero trust principles, and risk-based security controls.
Security architecture provides the strategic foundation for building resilient, compliant, and trustworthy systems. This skill guides the design of defense-in-depth layers, zero trust implementations, threat modeling methodologies, and mapping to control frameworks (NIST CSF, CIS Controls, ISO 27001).
Unlike tactical security skills (configuring firewalls, implementing authentication, scanning vulnerabilities), security architecture focuses on strategic planning, comprehensive defense strategies, and governance frameworks.
Use security architecture when:
Implement multiple independent layers of security controls so that if one layer fails, others continue to protect critical assets.
9 Defense Layers (2025 Model):
Key Principle: Each layer provides independent protection. Failure of one layer does not compromise the entire system.
For detailed layer-by-layer implementation patterns, see references/defense-in-depth.md.
Implement "never trust, always verify" principles where every access request is authenticated, authorized, and continuously validated.
Core Zero Trust Principles:
Zero Trust Architecture Components:
For zero trust implementation roadmap and reference architecture, see references/zero-trust-architecture.md.
Systematically identify, prioritize, and mitigate security threats through structured methodologies.
Primary Methodologies:
| Methodology | Purpose | Complexity | Best For |
|---|---|---|---|
| STRIDE | Threat identification | Low | Development teams, quick threat analysis |
| PASTA | Risk-centric analysis | High | Enterprise risk management |
| DREAD | Risk scoring | Low | Prioritizing existing threats |
| Attack Trees | Visual threat analysis | Medium | Security architecture reviews |
STRIDE Threat Categories:
STRIDE Application Process:
For detailed threat modeling methodologies, PASTA process, DREAD scoring, and attack trees, see references/threat-modeling.md. For threat modeling examples, see examples/threat-models/.
Map security controls to industry frameworks to ensure comprehensive coverage and compliance.
6 Core Functions:
Usage: Map security controls to NIST CSF categories to ensure coverage of all security functions. Provides risk-based, flexible framework for security programs.
For detailed NIST CSF category mapping and subcategories, see references/nist-csf-mapping.md.
18 Controls organized in 3 Implementation Groups:
Top Priority Controls (IG1):
Usage: CIS Controls provide prescriptive, measurable security baseline. Start with IG1, progress to IG2/IG3 as security maturity increases.
For detailed CIS Controls implementation guidance, see references/cis-controls.md.
Map OWASP Top 10 application security risks to architectural controls:
| OWASP Risk | Primary Control | Framework Mapping |
|---|---|---|
| Injection | Parameterized queries, input validation | NIST PR.DS, CIS 16 |
| Broken Authentication | MFA, secure session management | NIST PR.AC, CIS 5, 6 |
| Sensitive Data Exposure | Encryption, key management | NIST PR.DS, CIS 3 |
| XXE | Disable external entities, use JSON | NIST PR.DS, CIS 16 |
| Broken Access Control | Authorization checks, RBAC | NIST PR.AC, CIS 6 |
| Security Misconfiguration | Hardening, minimal configs | NIST PR.IP, CIS 4 |
| XSS | Output encoding, CSP | NIST PR.DS, CIS 16 |
| Insecure Deserialization | Validate objects, safe formats | NIST PR.DS, CIS 16 |
| Known Vulnerabilities | Patch management, SBOM | NIST ID.RA, CIS 7 |
| Logging & Monitoring | SIEM, centralized logging | NIST DE.CM, CIS 8 |
For detailed OWASP Top 10 mitigation strategies and code examples, see references/owasp-top10-mitigation.md.
Select appropriate security architecture approach based on system characteristics:
Greenfield (New System):
Brownfield (Existing System):
Compliance-Driven:
Cloud-Native:
Hybrid/Multi-Cloud:
For detailed architecture selection decision trees, see references/defense-in-depth.md and references/zero-trust-architecture.md.
Protect software supply chain from tampering, backdoors, and compromised dependencies.
Supply-chain Levels for Software Artifacts (4 levels):
Implementation: Start with Level 1 provenance generation, progress to Level 2 (GitHub Actions), then Level 3 (hardened CI/CD with audit logs).
Generate and maintain inventory of software components and dependencies.
SBOM Standards:
SBOM Use Cases:
Dependency Management Best Practices:
For SLSA implementation guide, SBOM generation examples, and dependency scanning automation, see references/supply-chain-security.md.
Well-Architected Framework - Security Pillar Principles:
Key AWS Security Services:
Multi-Account Strategy: Use AWS Organizations with Security OU (Security Account, Logging Account, Audit Account) and Workload OUs (Production, Non-Production). Apply Service Control Policies (SCPs) for guardrails.
For AWS reference architectures and multi-account security setup, see references/aws-security-architecture.md and examples/architectures/aws-multi-account-security.md.
Key GCP Security Services:
Organization Hierarchy: Structure with Organization → Folders (Production, Non-Production, Security) → Projects. Apply IAM policies at folder level for inheritance.
For GCP security architecture patterns and organization setup, see references/gcp-security-architecture.md and examples/architectures/gcp-security-hierarchy.md.
Key Azure Security Services:
Hub-Spoke Landing Zone: Implement hub VNet (shared services: firewall, VPN, Azure Bastion) with spoke VNets (workloads). Use Management Groups for policy hierarchy.
For Azure security architecture and hub-spoke design, see references/azure-security-architecture.md and examples/architectures/azure-landing-zone.md.
Multi-Factor Authentication (MFA):
Single Sign-On (SSO):
Role-Based Access Control (RBAC):
Attribute-Based Access Control (ABAC):
Policy-Based Access Control (PBAC):
Just-in-Time (JIT) Access:
Credential Vaulting:
For detailed IAM implementation patterns, MFA configuration, and PAM setup, see references/iam-patterns.md.
Centralize log aggregation, correlation, and alerting for security events.
Leading SIEM Platforms:
SIEM Architecture:
Automate incident response workflows to reduce mean time to respond (MTTR).
SOAR Capabilities:
Leading SOAR Platforms:
UEBA (User & Entity Behavior Analytics):
Threat Intelligence:
For SIEM architecture, SOAR playbook examples, and detection strategies, see references/security-operations.md.
Use this table to map risks to appropriate control frameworks:
| Risk/Requirement | Framework | Key Controls |
|---|---|---|
| General security program | NIST CSF 2.0 | All 6 functions (GV, ID, PR, DE, RS, RC) |
| Compliance baseline | CIS Controls v8 | IG1: Controls 1-18 (56 safeguards) |
| ISO certification | ISO 27001/27002 | 114 controls across 14 domains |
| Application security | OWASP ASVS | 286 security requirements (3 levels) |
| Cloud security (AWS) | AWS Well-Architected | Security Pillar: 10 design principles |
| Cloud security (GCP) | GCP Security Best Practices | Security Command Center architecture |
| Cloud security (Azure) | Azure Security Benchmark | Defender for Cloud controls |
| Supply chain security | SLSA + SBOM | Level 2+ SLSA, CycloneDX SBOM |
| Zero trust architecture | NIST SP 800-207 | ZTA tenets, deployment models |
| Privacy/GDPR | NIST Privacy Framework | Privacy engineering objectives |
Security architecture provides the strategic foundation for tactical security implementations:
infrastructure-as-code: Implement security architecture as code (secure defaults, hardening)kubernetes-operations: Apply K8s security architecture (RBAC, Pod Security, Network Policies)secret-management: Architect secrets management (KMS, Vault, rotation strategies)building-ci-pipelines: Secure CI/CD architecture (SAST/DAST integration, artifact signing)configuring-firewalls: Implement network perimeter layer of defense-in-depthvulnerability-management: Integrate vulnerability scanning into security architectureauth-security: Implement IAM layer details (MFA, RBAC/ABAC, session management)siem-logging: Implement security monitoring architecture (SIEM, log aggregation)compliance-frameworks: Map security architecture to compliance requirementsReplace VPN with identity-based access to applications.
Architecture:
Benefits: Eliminates lateral movement, reduces attack surface, improves user experience
Layer multiple security controls for web application protection.
Layers:
Continuously monitor and enforce security configurations across cloud environments.
Architecture:
Leading CSPM Tools: Wiz, Orca Security, Prisma Cloud, Microsoft Defender for Cloud
Defense in Depth:
references/defense-in-depth.md - 9-layer defense model, implementation patterns, failure impact analysisZero Trust Architecture:
references/zero-trust-architecture.md - ZTA principles, reference architecture, implementation roadmapThreat Modeling:
references/threat-modeling.md - STRIDE, PASTA, DREAD, Attack Trees methodologiesexamples/threat-models/web-app-stride.md - Web application STRIDE analysis exampleexamples/threat-models/api-threat-model.md - REST API threat model exampleexamples/threat-models/microservices-threat-model.md - Microservices threat model exampleControl Frameworks:
references/nist-csf-mapping.md - NIST CSF 2.0 functions, categories, subcategoriesreferences/cis-controls.md - CIS Controls v8, implementation groups, safeguardsreferences/owasp-top10-mitigation.md - OWASP Top 10 risks and mitigation strategiesSupply Chain Security:
references/supply-chain-security.md - SLSA framework, SBOM generation, dependency scanningCloud Security:
references/aws-security-architecture.md - AWS Well-Architected Security Pillar, services, patternsreferences/gcp-security-architecture.md - GCP Security Best Practices, services, organization designreferences/azure-security-architecture.md - Azure Security Benchmark, Defender for Cloud, landing zonesIAM & Operations:
references/iam-patterns.md - Authentication, authorization, MFA, RBAC/ABAC, PAMreferences/security-operations.md - SIEM, SOAR, UEBA, threat intelligence, incident responseArchitecture Examples:
examples/architectures/aws-multi-account-security.md - AWS Organizations security setupexamples/architectures/gcp-security-hierarchy.md - GCP folder/project security hierarchyexamples/architectures/azure-landing-zone.md - Azure hub-spoke landing zoneexamples/architectures/zero-trust-network.md - Zero trust network designScripts:
scripts/threat-model-template.py - Generate STRIDE threat model templatesscripts/control-gap-analysis.sh - Compare current controls against frameworksscripts/sbom-generate.sh - Generate SBOM in CycloneDX formatscripts/security-checklist.sh - Automated security architecture checklistSecurity architecture requires strategic planning across multiple layers, from physical security to security operations. Implement defense-in-depth for comprehensive protection, adopt zero trust principles for modern cloud environments, use threat modeling to identify risks proactively, and map controls to frameworks for compliance and completeness.
Start with risk assessment to understand threats, select appropriate architecture approach (zero trust for greenfield, hybrid for brownfield), implement layered controls, and continuously monitor and improve security posture.