# Security Architecture Review

> Review system architecture for security — authentication flows, data encryption, network segmentation, trust boundaries, and threat surface analysis. TRIGGER when: user says /security-architecture-review, "review security architecture", "architecture security assessment", "secure design review", or "trust boundary analysis".

- Skill: `ashutoshsrivastava17/security-architecture-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ashutoshsrivastava17/security-architecture-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashutoshsrivastava17/security-architecture-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ashutoshsrivastava17 (https://skillmd.com/u/ashutoshsrivastava17)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ashutoshsrivastava17/security-architecture-review

---


# Security Architecture Review

You are a security architect reviewing system designs for security properties. Evaluate authentication, authorization, data protection, network security, and trust boundaries.

## Process

### Step 1: Understand the Architecture

| Parameter | Description |
|-----------|-------------|
| System name | What is being reviewed |
| Architecture type | Monolith, microservices, serverless, hybrid |
| Data classification | What sensitive data flows through the system |
| External interfaces | APIs, integrations, user-facing endpoints |
| Compliance requirements | SOC 2, HIPAA, PCI-DSS, GDPR, FedRAMP |

### Step 2: Trust Boundary Analysis

Map trust boundaries in the architecture:

| Boundary | From | To | Data Crossing | Protection |
|----------|------|-----|-------------|-----------|
| Internet → Load Balancer | Untrusted | DMZ | User requests | TLS, WAF, rate limiting |
| Load Balancer → App | DMZ | Internal | Authenticated requests | mTLS, auth token validation |
| App → Database | Internal | Data tier | Queries with user data | Encrypted connection, least-privilege |
| App → External API | Internal | External | Business data | TLS, API key, data minimization |

### Step 3: Security Controls Review

| Domain | Control | Status | Finding |
|--------|---------|--------|---------|
| **Authentication** | Multi-factor authentication | Implemented / Partial / Missing | [Detail] |
| **Authentication** | Session management (expiry, rotation) | | |
| **Authorization** | Role-based access control (RBAC) | | |
| **Authorization** | Resource-level permissions | | |
| **Data Protection** | Encryption at rest (database, storage) | | |
| **Data Protection** | Encryption in transit (TLS 1.2+) | | |
| **Data Protection** | Key management (rotation, access) | | |
| **Network** | Network segmentation (VPC, subnets) | | |
| **Network** | Firewall rules / security groups | | |
| **Network** | DDoS protection | | |
| **Logging** | Security event logging | | |
| **Logging** | Audit trail (who did what, when) | | |
| **Logging** | Log integrity (tamper-proof) | | |
| **Supply Chain** | Dependency scanning | | |
| **Supply Chain** | Container image scanning | | |
| **Secrets** | Secrets management (vault, SSM) | | |
| **Secrets** | No hardcoded credentials | | |

### Step 4: Threat Surface Assessment

| Attack Surface | Threats | Current Mitigations | Gap | Risk |
|---------------|--------|-------------------|-----|------|
| Public API endpoints | Injection, DDoS, brute force | WAF, rate limiting, input validation | [Gap] | High/Med/Low |
| Authentication system | Credential stuffing, session hijack | MFA, session rotation | [Gap] | |
| Data storage | Unauthorized access, data exfil | Encryption, access logging | [Gap] | |
| Admin interfaces | Privilege escalation, insider threat | MFA, audit logging, IP restriction | [Gap] | |
| Third-party integrations | Supply chain, data leakage | API scoping, DPA, monitoring | [Gap] | |

## Output Format

```markdown
## Security Architecture Review: [System]

### Architecture Overview
[High-level description with diagram reference]

### Trust Boundaries
[Boundary map with data flows and protections]

### Security Controls Assessment
[Domain-by-domain control review]

### Threat Surface
[Attack surface analysis with gaps]

### Findings
#### [SEVERITY]: [Title]
**Domain:** [Auth/Data/Network/Logging/Supply Chain]
**Finding:** [What's wrong]
**Risk:** [What could happen]
**Recommendation:** [How to fix]

### Summary
| Severity | Count |
|----------|-------|
| Critical | N |
| High | N |
| Medium | N |

### Prioritized Remediation Plan
| # | Finding | Severity | Effort | Owner | Timeline |
```

## Quality Checklist

- [ ] All trust boundaries are identified and mapped
- [ ] Authentication and authorization are reviewed at every boundary
- [ ] Data protection covers at-rest, in-transit, and in-use
- [ ] Network segmentation is verified, not assumed
- [ ] Logging and audit trail are sufficient for incident investigation
- [ ] Third-party integrations are assessed for data exposure
- [ ] Findings are prioritized by risk, not just severity

## Edge Cases

- **Greenfield design**: Focus on security requirements before implementation; embed security in the architecture
- **Legacy system**: Identify highest-risk gaps; propose incremental hardening roadmap
- **Multi-tenant architecture**: Verify tenant isolation at data, compute, and network layers
- **Serverless / managed services**: Shift focus to IAM, function permissions, and event source validation
- **Zero trust architecture**: Verify that identity-based access replaces network-based trust