<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-architecture-debt-assessment
description: >-
  Assess and quantify security architecture debt by identifying outdated patterns,
  missing controls, compliance gaps, and technical risk accumulation that degrades
  an organization's security posture over time.
domain: cybersecurity
subdomain: security-architecture
tags:
  - security-debt
  - risk-assessment
  - architecture-review
  - technical-debt
  - compliance-gaps
  - remediation-planning
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Architecture Debt Assessment

## Overview

Security architecture debt accumulates when systems deviate from security standards,
controls degrade, or designs use outdated patterns. This skill systematically identifies,
quantifies, and prioritizes security debt to drive remediation investment.

Mode: `[MODE: ARCHITECT]` — Security debt identification and remediation planning.

## Prerequisites

- Architecture documentation and system inventory
- Current security control baselines
- Compliance audit results or self-assessment data
- Python 3.10+

## Key Concepts

### Security Debt Categories

| Category | Description | Examples |
|----------|-------------|---------|
| **Pattern Debt** | Outdated architecture patterns | Perimeter-only security, shared credentials |
| **Control Debt** | Missing or degraded controls | Unpatched systems, disabled logging |
| **Compliance Debt** | Framework requirement gaps | Unmet NIST controls, expired certifications |
| **Crypto Debt** | Weak or deprecated cryptography | TLS 1.0, SHA-1 signatures, short keys |
| **Identity Debt** | Access control deficiencies | Stale accounts, excessive permissions |
| **Observability Debt** | Monitoring and logging gaps | No SIEM coverage, missing audit trails |

### Debt Scoring Matrix

```
Debt Score = Impact × Likelihood × (1 + Exposure Duration Factor)

Impact:       1-5 (business consequence of exploitation)
Likelihood:   1-5 (probability of exploitation given current state)
Exposure:     0.0-1.0 (months_exposed / 12, capped at 1.0)

Risk Rating:
  Critical: 20-30    (immediate remediation)
  High:     12-19    (remediate within 30 days)
  Medium:   6-11     (remediate within 90 days)
  Low:      1-5      (remediate within 180 days)
```

### Debt Item Schema

```json
{
  "id": "DEBT-001",
  "category": "crypto",
  "title": "TLS 1.0/1.1 still enabled on external endpoints",
  "description": "Legacy TLS versions allow downgrade attacks",
  "affected_systems": ["api-gateway", "legacy-portal"],
  "impact": 4,
  "likelihood": 3,
  "months_exposed": 18,
  "debt_score": 24.0,
  "risk_rating": "critical",
  "remediation": "Disable TLS < 1.2 on all external endpoints",
  "estimated_effort_hours": 8,
  "compliance_refs": ["NIST SC-8", "PCI DSS 4.1"]
}
```

### Architecture Debt Heatmap

```
System Component      | Pattern | Control | Crypto | Identity | Observ. | Total
─────────────────────┼─────────┼─────────┼────────┼──────────┼─────────┼──────
API Gateway           |    ●    |    ○    |   ●    |    ○     |    ○    |  12
Legacy Portal         |    ●    |    ●    |   ●    |    ●     |    ●    |  28
Internal Services     |    ○    |    ○    |   ○    |    ●     |    ○    |   8
Database Cluster      |    ○    |    ●    |   ○    |    ○     |    ●    |  14

● = Debt present   ○ = Compliant
```

## Workflow

### Step 1: Inventory Systems and Controls

```bash
node scripts/agent.js --action inventory --systems systems.json
```

### Step 2: Assess Security Debt

```bash
node scripts/agent.js --action assess --systems systems.json --baseline nist_800_53
```

### Step 3: Score and Prioritize

```bash
node scripts/agent.js --action score --debts debt-items.json --output scored.json
```

### Step 4: Generate Remediation Plan

```bash
node scripts/agent.js --action remediate --scored scored.json --output plan.json
```

## Verification

- [ ] All systems inventoried with current control state
- [ ] Debt items categorized and scored with impact/likelihood
- [ ] Exposure duration tracked for each debt item
- [ ] Remediation plan prioritized by debt score
- [ ] Effort estimates included for budgeting
- [ ] Compliance mapping shows gap closure per framework
- [ ] Quarterly reassessment scheduled

## References

- [NIST SP 800-53 Rev 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [OWASP SAMM — Security Architecture](https://owaspsamm.org/)
- [CIS Controls v8 Implementation Groups](https://www.cisecurity.org/controls/v8)
