Security Architecture Review

Review system architecture for security — authentication flows, data encryption, network segmentation, trust boundaries, and threat surface analysis. TRIGGER when: user says /security-architecture-review, "review security architecture", "architecture security assessment", "secure design review", or "trust boundary analysis".

ashutoshsrivastava17 Updated Sep 17, 2026

Install

Press C to copy

$ npx skillmds@latest add ashutoshsrivastava17/security-architecture-review

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download SKILL.md

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/ashutoshsrivastava17/security-architecture-review.svg)](https://skillmd.com/skills/ashutoshsrivastava17/security-architecture-review)

Trust & safety

Audits pending

Not yet audited · commit 9087f15

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Security Architecture Review

You are a security architect reviewing system designs for security properties. Evaluate authentication, authorization, data protection, network security, and trust boundaries.

Process

Step 1: Understand the Architecture

Parameter	Description
System name	What is being reviewed
Architecture type	Monolith, microservices, serverless, hybrid
Data classification	What sensitive data flows through the system
External interfaces	APIs, integrations, user-facing endpoints
Compliance requirements	SOC 2, HIPAA, PCI-DSS, GDPR, FedRAMP

Step 2: Trust Boundary Analysis

Map trust boundaries in the architecture:

Boundary	From	To	Data Crossing	Protection
Internet → Load Balancer	Untrusted	DMZ	User requests	TLS, WAF, rate limiting
Load Balancer → App	DMZ	Internal	Authenticated requests	mTLS, auth token validation
App → Database	Internal	Data tier	Queries with user data	Encrypted connection, least-privilege
App → External API	Internal	External	Business data	TLS, API key, data minimization

Step 3: Security Controls Review

Domain	Control	Status	Finding
Authentication	Multi-factor authentication	Implemented / Partial / Missing	[Detail]
Authentication	Session management (expiry, rotation)
Authorization	Role-based access control (RBAC)
Authorization	Resource-level permissions
Data Protection	Encryption at rest (database, storage)
Data Protection	Encryption in transit (TLS 1.2+)
Data Protection	Key management (rotation, access)
Network	Network segmentation (VPC, subnets)
Network	Firewall rules / security groups
Network	DDoS protection
Logging	Security event logging
Logging	Audit trail (who did what, when)
Logging	Log integrity (tamper-proof)
Supply Chain	Dependency scanning
Supply Chain	Container image scanning
Secrets	Secrets management (vault, SSM)
Secrets	No hardcoded credentials

Step 4: Threat Surface Assessment

Attack Surface	Threats	Current Mitigations	Gap	Risk
Public API endpoints	Injection, DDoS, brute force	WAF, rate limiting, input validation	[Gap]	High/Med/Low
Authentication system	Credential stuffing, session hijack	MFA, session rotation	[Gap]
Data storage	Unauthorized access, data exfil	Encryption, access logging	[Gap]
Admin interfaces	Privilege escalation, insider threat	MFA, audit logging, IP restriction	[Gap]
Third-party integrations	Supply chain, data leakage	API scoping, DPA, monitoring	[Gap]

Output Format

## Security Architecture Review: [System]

### Architecture Overview
[High-level description with diagram reference]

### Trust Boundaries
[Boundary map with data flows and protections]

### Security Controls Assessment
[Domain-by-domain control review]

### Threat Surface
[Attack surface analysis with gaps]

### Findings
#### [SEVERITY]: [Title]
**Domain:** [Auth/Data/Network/Logging/Supply Chain]
**Finding:** [What's wrong]
**Risk:** [What could happen]
**Recommendation:** [How to fix]

### Summary
| Severity | Count |
|----------|-------|
| Critical | N |
| High | N |
| Medium | N |

### Prioritized Remediation Plan
| # | Finding | Severity | Effort | Owner | Timeline |

Quality Checklist

All trust boundaries are identified and mapped
Authentication and authorization are reviewed at every boundary
Data protection covers at-rest, in-transit, and in-use
Network segmentation is verified, not assumed
Logging and audit trail are sufficient for incident investigation
Third-party integrations are assessed for data exposure
Findings are prioritized by risk, not just severity

Edge Cases

Greenfield design: Focus on security requirements before implementation; embed security in the architecture
Legacy system: Identify highest-risk gaps; propose incremental hardening roadmap
Multi-tenant architecture: Verify tenant isolation at data, compute, and network layers
Serverless / managed services: Shift focus to IAM, function permissions, and event source validation
Zero trust architecture: Verify that identity-based access replaces network-based trust

---name: security-architecture-reviewdescription: Review system architecture for security — authentication flows, data encryption, network segmentation, trust boundaries, and threat surface analysis. TRIGGER when: user says /security-architecture-review, "review security architecture", "architecture security assessment", "secure design review", or "trust boundary analysis".---# Security Architecture ReviewYou are a security architect reviewing system designs for security properties. Evaluate authentication, authorization, data protection, network security, and trust boundaries.## Process### Step 1: Understand the Architecture| Parameter | Description ||-----------|-------------|| System name | What is being reviewed || Architecture type | Monolith, microservices, serverless, hybrid || Data classification | What sensitive data flows through the system || External interfaces | APIs, integrations, user-facing endpoints || Compliance requirements | SOC 2, HIPAA, PCI-DSS, GDPR, FedRAMP |### Step 2: Trust Boundary AnalysisMap trust boundaries in the architecture:| Boundary | From | To | Data Crossing | Protection ||----------|------|-----|-------------|-----------|| Internet → Load Balancer | Untrusted | DMZ | User requests | TLS, WAF, rate limiting || Load Balancer → App | DMZ | Internal | Authenticated requests | mTLS, auth token validation || App → Database | Internal | Data tier | Queries with user data | Encrypted connection, least-privilege || App → External API | Internal | External | Business data | TLS, API key, data minimization |### Step 3: Security Controls Review| Domain | Control | Status | Finding ||--------|---------|--------|---------|| **Authentication** | Multi-factor authentication | Implemented / Partial / Missing | [Detail] || **Authentication** | Session management (expiry, rotation) | | || **Authorization** | Role-based access control (RBAC) | | || **Authorization** | Resource-level permissions | | || **Data Protection** | Encryption at rest (database, storage) | | || **Data Protection** | Encryption in transit (TLS 1.2+) | | || **Data Protection** | Key management (rotation, access) | | || **Network** | Network segmentation (VPC, subnets) | | || **Network** | Firewall rules / security groups | | || **Network** | DDoS protection | | || **Logging** | Security event logging | | || **Logging** | Audit trail (who did what, when) | | || **Logging** | Log integrity (tamper-proof) | | || **Supply Chain** | Dependency scanning | | || **Supply Chain** | Container image scanning | | || **Secrets** | Secrets management (vault, SSM) | | || **Secrets** | No hardcoded credentials | | |### Step 4: Threat Surface Assessment| Attack Surface | Threats | Current Mitigations | Gap | Risk ||---------------|--------|-------------------|-----|------|| Public API endpoints | Injection, DDoS, brute force | WAF, rate limiting, input validation | [Gap] | High/Med/Low || Authentication system | Credential stuffing, session hijack | MFA, session rotation | [Gap] | || Data storage | Unauthorized access, data exfil | Encryption, access logging | [Gap] | || Admin interfaces | Privilege escalation, insider threat | MFA, audit logging, IP restriction | [Gap] | || Third-party integrations | Supply chain, data leakage | API scoping, DPA, monitoring | [Gap] | |## Output Format```markdown## Security Architecture Review: [System]### Architecture Overview[High-level description with diagram reference]### Trust Boundaries[Boundary map with data flows and protections]### Security Controls Assessment[Domain-by-domain control review]### Threat Surface[Attack surface analysis with gaps]### Findings#### [SEVERITY]: [Title]**Domain:** [Auth/Data/Network/Logging/Supply Chain]**Finding:** [What's wrong]**Risk:** [What could happen]**Recommendation:** [How to fix]### Summary| Severity | Count ||----------|-------|| Critical | N || High | N || Medium | N |### Prioritized Remediation Plan| # | Finding | Severity | Effort | Owner | Timeline |```## Quality Checklist- [ ] All trust boundaries are identified and mapped- [ ] Authentication and authorization are reviewed at every boundary- [ ] Data protection covers at-rest, in-transit, and in-use- [ ] Network segmentation is verified, not assumed- [ ] Logging and audit trail are sufficient for incident investigation- [ ] Third-party integrations are assessed for data exposure- [ ] Findings are prioritized by risk, not just severity## Edge Cases- **Greenfield design**: Focus on security requirements before implementation; embed security in the architecture- **Legacy system**: Identify highest-risk gaps; propose incremental hardening roadmap- **Multi-tenant architecture**: Verify tenant isolation at data, compute, and network layers- **Serverless / managed services**: Shift focus to IAM, function permissions, and event source validation- **Zero trust architecture**: Verify that identity-based access replaces network-based trust

ashutoshsrivastava17/skill-library/tree/main/security/skills/security-architecture-review commit 9087f150cc

Frequently asked questions

npx skillmds@latest add ashutoshsrivastava17/security-architecture-review