Security Assessment Methodology
Purpose
Provide standardized security assessment frameworks, vulnerability classification systems, and compliance evaluation methodology for use during security scanning and auditing. Tech-agnostic, applies to any language or framework.
OWASP Risk Rating
Calculate risk using these factors:
| Risk Factor |
Score (0-9) |
What to Evaluate |
| Threat Agent |
0-9 |
Skill level, motive, opportunity, size of threat group |
| Attack Vector |
0-9 |
Ease of exploitation (automated=9, requires physical access=1) |
| Security Weakness |
0-9 |
Prevalence × detectability |
| Technical Impact |
0-9 |
Loss of confidentiality, integrity, availability |
| Business Impact |
0-9 |
Financial, reputation, compliance, privacy damage |
Overall Risk = Average of factors, weighted by context.
Security Debt Calculation
| Severity |
Remediation Time per Issue |
Priority |
| Critical |
4 hours |
P0, fix immediately |
| High |
2 hours |
P1, fix this sprint |
| Medium |
1 hour |
P2, fix this quarter |
| Low |
30 minutes |
P3, fix when convenient |
Total Security Debt = Sum of (count × remediation time) per severity level.
Security Maturity Model
| Level |
Name |
Description |
| 0 |
None |
No security measures |
| 1 |
Initial |
Ad-hoc, reactive security |
| 2 |
Managed |
Basic security controls in place |
| 3 |
Defined |
Standardized security processes |
| 4 |
Quantified |
Metrics-driven security decisions |
| 5 |
Optimizing |
Continuous security improvement |
Security Score Breakdown
Rate each dimension 0-10:
| Dimension |
What to Evaluate |
| Authentication & Authorization |
Auth mechanisms, RBAC/ABAC, session management |
| Data Protection |
Encryption at rest/transit, data masking, PII handling |
| Input Validation |
Sanitization, whitelisting, encoding at boundaries |
| Cryptography |
Algorithm strength, key management, randomness |
| Session Management |
Token handling, timeout, fixation prevention |
| Error Handling |
Information leakage, stack traces, debug exposure |
| Dependency Security |
CVE count, update frequency, vulnerable transitive deps |
| Configuration Security |
Default credentials, debug mode, unnecessary services |
Additional Resources
Reference Files
For detailed vulnerability patterns and compliance frameworks, consult:
references/owasp-top10.md: OWASP Top 10 categories with detection patternsreferences/security-patterns.md: Language-agnostic vulnerability patterns to scan forreferences/cwe-cve-reference.md: CWE categories and CVE analysis methodologyreferences/compliance-frameworks.md: PCI DSS, GDPR, HIPAA, SOC 2 gap analysis
1---2name: security-methodology3description: This skill should be used when the user mentions "OWASP", "CWE", "CVE", "security compliance", "security scoring", "security maturity model", "vulnerability classification", "risk rating", or "dependency vulnerability scanning". Provides security assessment frameworks and vulnerability classification methodology.4---56# Security Assessment Methodology78## Purpose910Provide standardized security assessment frameworks, vulnerability classification systems, and compliance evaluation methodology for use during security scanning and auditing. Tech-agnostic, applies to any language or framework.1112## OWASP Risk Rating1314Calculate risk using these factors:1516| Risk Factor | Score (0-9) | What to Evaluate |17|-------------|-------------|------------------|18| Threat Agent | 0-9 | Skill level, motive, opportunity, size of threat group |19| Attack Vector | 0-9 | Ease of exploitation (automated=9, requires physical access=1) |20| Security Weakness | 0-9 | Prevalence × detectability |21| Technical Impact | 0-9 | Loss of confidentiality, integrity, availability |22| Business Impact | 0-9 | Financial, reputation, compliance, privacy damage |2324**Overall Risk** = Average of factors, weighted by context.2526## Security Debt Calculation2728| Severity | Remediation Time per Issue | Priority |29|----------|---------------------------|----------|30| Critical | 4 hours | P0, fix immediately |31| High | 2 hours | P1, fix this sprint |32| Medium | 1 hour | P2, fix this quarter |33| Low | 30 minutes | P3, fix when convenient |3435**Total Security Debt** = Sum of (count × remediation time) per severity level.3637## Security Maturity Model3839| Level | Name | Description |40|-------|------|-------------|41| 0 | None | No security measures |42| 1 | Initial | Ad-hoc, reactive security |43| 2 | Managed | Basic security controls in place |44| 3 | Defined | Standardized security processes |45| 4 | Quantified | Metrics-driven security decisions |46| 5 | Optimizing | Continuous security improvement |4748## Security Score Breakdown4950Rate each dimension 0-10:5152| Dimension | What to Evaluate |53|-----------|-----------------|54| Authentication & Authorization | Auth mechanisms, RBAC/ABAC, session management |55| Data Protection | Encryption at rest/transit, data masking, PII handling |56| Input Validation | Sanitization, whitelisting, encoding at boundaries |57| Cryptography | Algorithm strength, key management, randomness |58| Session Management | Token handling, timeout, fixation prevention |59| Error Handling | Information leakage, stack traces, debug exposure |60| Dependency Security | CVE count, update frequency, vulnerable transitive deps |61| Configuration Security | Default credentials, debug mode, unnecessary services |6263## Additional Resources6465### Reference Files6667For detailed vulnerability patterns and compliance frameworks, consult:68- **`references/owasp-top10.md`**: OWASP Top 10 categories with detection patterns69- **`references/security-patterns.md`**: Language-agnostic vulnerability patterns to scan for70- **`references/cwe-cve-reference.md`**: CWE categories and CVE analysis methodology71- **`references/compliance-frameworks.md`**: PCI DSS, GDPR, HIPAA, SOC 2 gap analysis
sigistry