# Security Architecture

> System-level security architecture: threat modeling, secure-by-design, defense-in-depth, zero-trust, trust boundaries, TEE/confidential computing, and secure boot / chain of trust. Architect-level — designing the security of a system, not app-level OWASP bug fixing. USE WHEN: designing a system's security architecture, "threat model", "zero-trust", "defense in depth", "trust boundary", "TEE", "enclave", "confidential computing", "secure boot", "attack surface", security design review. DO NOT USE FOR: fixing app vulnerabilities / OWASP code issues (use the security agent/skills); auth library wiring (use authentication skills).

- Skill: `claude-dev-suite/security-architecture` (Agent Skill)
- Install (CLI): `npx skillmds@latest add claude-dev-suite/security-architecture`
- Raw SKILL.md: https://api.skillmd.com/api/skills/claude-dev-suite/security-architecture/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: claude-dev-suite (https://skillmd.com/u/claude-dev-suite)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/claude-dev-suite/security-architecture

---

# Security Architecture

Design security into the system shape — not bolt it on after.

## Start with a threat model
1. **What are we protecting?** (assets, data classifications)
2. **From whom?** (threat actors, capabilities)
3. **Trust boundaries** — draw them: where does data/control cross between
   differently-trusted components? Each crossing is where to authenticate,
   authorize, validate, and encrypt.
4. **Enumerate threats** (STRIDE: Spoofing, Tampering, Repudiation, Info
   disclosure, DoS, Elevation) per boundary; rank by risk; design mitigations.

## Architectural principles
- **Defense in depth**: independent layers so one failure isn't catastrophic.
- **Least privilege** + **least authority**: minimal scope per component;
  capability-based over ambient authority where possible.
- **Minimize attack surface & TCB**: fewer entry points, smaller trusted base
  (favors microkernel/microVM isolation — see `os-kernel-architecture`,
  `virtualization`).
- **Fail securely**: deny by default; errors don't open access.
- **Secure by design/default**: safe defaults, secrets never in code, encryption
  in transit + at rest.

## Zero-trust
Drop implicit network trust. Authenticate + authorize **every** request
(identity, device posture, policy) regardless of network location;
micro-segment; assume breach. Replaces the "hard perimeter, soft interior" model.

## Hardware / platform security
- **TEE / enclaves** (SGX, TrustZone, SEV-SNP, TDX): run/seal sensitive
  computation isolated from the OS/host — for untrusted-host or
  confidential-computing scenarios.
- **Secure boot / chain of trust**: each stage verifies the next from a hardware
  root of trust; measured boot + attestation for remote trust.
- **Key management**: HSM/KMS, rotation, envelope encryption; never hand-roll crypto.

## When to invoke this
- New system/platform design, multi-tenant or untrusted-input systems,
  regulated data, anything internet-facing or handling secrets/PII. Produce a
  threat model + trust-boundary diagram + mitigations as part of the ADR.