<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-architecture-review
description: >-
  Perform structured security architecture reviews using checklists, threat modeling,
  and design pattern analysis to identify security gaps, misconfigurations, and
  architectural weaknesses before deployment.
domain: cybersecurity
subdomain: security-architecture
tags:
  - architecture-review
  - design-review
  - security-checklist
  - risk-assessment
  - compliance-mapping
  - gap-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Architecture Review

## Overview

Security architecture reviews evaluate system designs against security best practices
before deployment. This skill covers conducting structured reviews using standardized
checklists, evaluating trust boundaries, mapping compliance requirements, and producing
actionable finding reports.

Mode: `[MODE: ARCHITECT]` — Security design review.

## Prerequisites

| Requirement | Details |
|---|---|
| System architecture documentation (diagrams, DFDs, design docs) | Required |
| Compliance requirements (SOC 2, PCI-DSS, HIPAA, etc.) | Required |
| Access to infrastructure configuration | Required |
| Python 3.10+ | Required |

## Key Concepts

### Review Domains

```
┌─────────────────────────────────────────────────────────┐
│           SECURITY ARCHITECTURE REVIEW                   │
├──────────┬──────────┬──────────┬──────────┬─────────────┤
│  AuthN   │  AuthZ   │  Data    │ Network  │  Operations │
│          │          │ Protect  │ Security │             │
├──────────┼──────────┼──────────┼──────────┼─────────────┤
│ MFA      │ RBAC     │ Encrypt  │ Segment  │  Logging    │
│ SSO      │ ABAC     │ Classify │ Firewall │  Monitoring │
│ Certs    │ Least    │ DLP      │ mTLS     │  IR Plans   │
│ FIDO2    │ Privilege│ Masking  │ WAF      │  Backups    │
└──────────┴──────────┴──────────┴──────────┴─────────────┘
```

### Security Review Checklist

```yaml
authentication:
  - id: AUTH-001
    check: "Multi-factor authentication enforced for all users"
    severity: critical
    frameworks: ["CIS 6.3", "NIST PR.AC-7"]
  - id: AUTH-002
    check: "Phishing-resistant MFA (FIDO2/WebAuthn) for privileged accounts"
    severity: high
    frameworks: ["CISA ZT Maturity"]
  - id: AUTH-003
    check: "Service accounts use certificate or workload identity"
    severity: high
    frameworks: ["CIS 5.4"]
  - id: AUTH-004
    check: "Session management with appropriate timeouts"
    severity: medium
    frameworks: ["OWASP ASVS 3.3"]

authorization:
  - id: AUTHZ-001
    check: "Least privilege enforced — no standing admin access"
    severity: critical
    frameworks: ["CIS 6.8", "NIST PR.AC-4"]
  - id: AUTHZ-002
    check: "RBAC/ABAC policies defined and reviewed quarterly"
    severity: high
    frameworks: ["CIS 6.1"]
  - id: AUTHZ-003
    check: "Break-glass procedures documented and audited"
    severity: medium
    frameworks: ["SOC 2 CC6.1"]

data_protection:
  - id: DATA-001
    check: "Data classified by sensitivity level"
    severity: high
    frameworks: ["CIS 3.1", "ISO 27001 A.5.12"]
  - id: DATA-002
    check: "Encryption at rest for L3+ data (AES-256)"
    severity: critical
    frameworks: ["CIS 3.11", "PCI-DSS 3.4"]
  - id: DATA-003
    check: "Encryption in transit (TLS 1.2+) for all communications"
    severity: critical
    frameworks: ["CIS 3.10", "PCI-DSS 4.1"]
  - id: DATA-004
    check: "Key management with rotation policy"
    severity: high
    frameworks: ["CIS 3.11", "PCI-DSS 3.5"]

network:
  - id: NET-001
    check: "Network segmentation with deny-by-default"
    severity: critical
    frameworks: ["CIS 12.2", "PCI-DSS 1.1"]
  - id: NET-002
    check: "East-west traffic inspection or microsegmentation"
    severity: high
    frameworks: ["NIST PR.PT-4"]
  - id: NET-003
    check: "No direct internet access from internal workloads"
    severity: high
    frameworks: ["CIS 12.6"]

operations:
  - id: OPS-001
    check: "Centralized logging with SIEM integration"
    severity: critical
    frameworks: ["CIS 8.2"]
  - id: OPS-002
    check: "Incident response plan documented and tested"
    severity: high
    frameworks: ["CIS 17.1", "NIST RS.RP-1"]
  - id: OPS-003
    check: "Backup strategy with tested recovery"
    severity: high
    frameworks: ["CIS 11.1"]
  - id: OPS-004
    check: "Patch management within SLA (critical < 72h)"
    severity: high
    frameworks: ["CIS 7.4"]
```

### Review Scoring Matrix

```
Overall Risk = Σ (unmitigated_findings × severity_weight) / total_checks

Severity Weights:
  Critical: 10
  High:     7
  Medium:   4
  Low:      1

Risk Rating:
  Acceptable:    Score < 15
  Needs Work:    Score 15-40
  High Risk:     Score 40-70
  Unacceptable:  Score > 70
```

## Workflow

### Step 1: Initialize Review

```bash
node scripts/agent.js --action init --system "Payment Service" --compliance pci-dss,soc2
```

### Step 2: Execute Checklist

```bash
node scripts/agent.js --action review --checklist full
```

### Step 3: Score Findings

```bash
node scripts/agent.js --action score --findings findings.json
```

### Step 4: Generate Report

```bash
node scripts/agent.js --action report --findings findings.json --output review-report.json
```

## Verification

- [ ] All review domains assessed (auth, data, network, ops)
- [ ] Findings scored by severity with framework references
- [ ] Compliance requirements mapped to controls
- [ ] Gap analysis produced with remediation recommendations
- [ ] Review report delivered to stakeholders
- [ ] Follow-up review scheduled for open findings

## References

- [OWASP Application Security Verification Standard](https://owasp.org/www-project-application-security-verification-standard/)
- [CIS Controls v8](https://www.cisecurity.org/controls)
- [NIST SP 800-53 Rev 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
