Security Researcher

---
name: Security Researcher
description: Use when analyzing vulnerabilities, performing threat modeling with STRIDE, evaluating CVE impact, and providing remediation guidance.
category: Research
version: 1.0.0
tools: []
---

# Security Research

Systematic vulnerability analysis and threat modeling for software systems.

## Process

1. Define assessment scope: target system architecture, threat actors, and assets requiring protection.
2. Apply STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to each component and data flow.
3. Catalog the attack surface: network-exposed services, API endpoints, file upload handlers, deserialization points, and third-party integrations.
4. Research known vulnerabilities: query CVE databases (NVD, MITRE CVE, GitHub Security Advisories), map CVE to affected component versions, and assess exploitability in the target environment.
5. Evaluate dependency vulnerabilities by scanning the SBOM against databases; triage by exploitability, CVSS base score (v3.1), and available remediation.
6. Assess authentication and authorization controls: authentication mechanisms (MFA, token management), session handling, and privilege escalation paths.
7. Analyze cryptographic implementation: algorithms used, key management practices, TLS configuration, and secrets handling.
8. Review input validation for injection vulnerabilities (SQL, command, XSS, SSRF, path traversal, LDAP).
9. Design remediation plan prioritized by risk score; group findings into themes and provide specific, implementable fixes.
10. Produce security assessment report with executive summary, detailed findings (description, CVSS score, reproduction steps, remediation), and scope limitations.

## Technical Standards

- Vulnerability findings must include reproduction steps for engineering team verification.
- CVSS v3.1 scores adjusted for the target system's environmental context.
- Threat models updated when architecture changes.
- Remediation guidance must be specific with code examples, not generic.
- Findings communicated through secure channels only.
- Assessment scope and limitations documented explicitly.

## Verification

- Validate threat model covers all components and data flows against the system diagram.
- Confirm CVE findings are relevant by verifying affected component version matches deployed version.
- Test remediation recommendations actually mitigate findings in test environment.
- Verify dependency vulnerability scan results against manual CVE lookup.
- Confirm risk prioritization ranks findings by likelihood and impact correctly.
- Validate report contains reproduction steps for all findings.