vamfi/vamfi-plugins/security-architecture-review

Security Architecture Review

Embed security thinking at every stage of the SDLC. Produce threat models, security controls checklists, and compliance gap analyses that identify risks before they reach production.

Overview

Security architecture review is not a final gate — it is a continuous practice applied at design, implementation, test, and release stages. This skill is callable from any pipeline stage. The earlier a security concern is found, the cheaper it is to fix.

Shift-Left Security Activities by Stage

STRIDE Threat Modelling

For each trust boundary in the system:

Identify Threats

STRIDE categories:

• Spoofing Identity
• Tampering with Data
• Repudiation
• Information Disclosure
• Denial of Service
• Elevation of Privilege

Risk = Likelihood × Impact. HIGH risk requires a documented control before architecture sign-off.

Security Controls Checklist

Assess against the following controls:

Authentication and Identity

• [ ] Multi-factor authentication for sensitive operations
• [ ] Secure session management (token rotation, expiry)
• [ ] OAuth 2.0 / OIDC for third-party auth
• [ ] Password policy enforcement

Authorisation

• [ ] Role-based or attribute-based access control implemented
• [ ] Principle of least privilege applied
• [ ] IDOR prevention (object-level access checks)
• [ ] API endpoint authorisation (not just authentication)

Input Validation and Output Encoding

• [ ] Server-side input validation on all endpoints
• [ ] Parameterised queries / ORM for database access
• [ ] Output encoding to prevent XSS
• [ ] File upload validation (type, size, content)

Secrets and Configuration

• [ ] No hardcoded credentials in source code
• [ ] Secrets managed in a vault (not environment variables in plain text)
• [ ] Secret rotation schedule defined
• [ ] Production configs separated from code

Data Protection

• [ ] TLS 1.2+ for all data in transit
• [ ] Encryption at rest for sensitive data
• [ ] Data classification applied and documented
• [ ] Data retention and deletion policy defined

Dependency Security

• [ ] Automated dependency vulnerability scanning in CI
• [ ] SBOM (Software Bill of Materials) generated
• [ ] Licence compliance checked
• [ ] Unpinned dependencies flagged

Pre-Production Security Gate

Binary PASS / FAIL assessment:

Result: PASS (proceed) / FAIL (list of blocking items to resolve first)

Additional Resources

• `references/owasp-top10-mapping.md` — OWASP Top 10 2025 with controls
• `references/compliance-frameworks.md` — GDPR, SOC 2, ISO 27001, PCI-DSS, HIPAA mappings
• `assets/security-review-template.md` — Blank threat model + controls template