senior-security

---
name: senior-security
description: Use when the user needs STRIDE threat modeling, DREAD scoring, DFD analysis, quick secret scan, or security request routing to specialist skills.
category: Engineering
version: 1.0.0
tools: []
---

# Threat Modeling + Security Routing

This skill owns STRIDE/DREAD threat modeling and routes other security requests to specialists.

## Routing Table

| Request | Route to | Specialist owns |
|---|---|---|
| Vulnerability assessment, pen-test methodology, OWASP Top 10 | Pen-testing skill | Vulnerability scanner + dependency auditor |
| Incident triage, SEV classification, forensics, containment | Incident-response skill | SEV1–SEV4 taxonomy, NIST SP 800-61 phases |
| Production outage (non-security incidents) | Incident-commander skill | Severity classifier + timeline + postmortem |
| Security monitoring, CVE triage, compliance (SOC 2), security headers | SecOps skill | Security scanner + compliance checker, CVE SLA table |
| Hostile/adversarial code review | Adversarial-reviewer skill | 3-persona review: BLOCK/CONCERNS/CLEAN |
| Secure code review (general code review context) | Code-reviewer skill | Language dispatch + regression fixtures |
| Cloud IAM escalation, S3 exposure, security groups | Cloud-security skill | Cloud posture check with per-check exit codes |
| Threat hunting, IOC sweeps, anomaly detection | Threat-detection skill | Z-score anomaly + IOC staleness tooling |
| Red-team engagement planning, ATT&CK kill chains | Red-team skill | Engagement planner with authorization gate |
| LLM/AI attack surface (prompt injection, poisoning) | AI-security skill | ATLAS-mapped threat scanner |

When a request spans lanes (e.g., "secure this new architecture"), do the threat model here first.

## STRIDE/DREAD Threat Modeling

**STRIDE categories:**
- **S** = Spoofing (authentication)
- **T** = Tampering (integrity)
- **R** = Repudiation (audit logs)
- **I** = Info Disclosure (encryption/access control)
- **D** = DoS (rate limiting/redundancy)
- **E** = Elevation (least privilege)

**DREAD scoring (each threat scored 1–10 per dimension):**
- Damage: impact severity
- Reproducibility: reliably exploitable?
- Exploitability: how easily exploited?
- Affected users: how many impacted?
- Discoverability: easily found by attackers?

**Workflow:**
1. Scope: assets to protect, trust boundaries, data flows (external entities, processes, data stores, flows)
2. Apply STRIDE matrix per DFD element to generate threats
3. Score each threat using DREAD (1–10 per dimension, average across all)
4. Sort by DREAD average descending; prioritize threats ≥7
5. Every threat ≥7 average gets a named mitigation owner before design ships
6. Quick secret sweep: search codebase for patterns (AWS keys, GitHub tokens, private keys, generic credentials; 20+ patterns detectable)

**Verification gate:**
- Every DFD element has ≥1 STRIDE row considered
- Every threat with DREAD ≥7 has an owner + mitigation
- Secret scan exits with zero high/critical findings
- Re-run both after mitigations land (re-run signals completion)

## STRIDE per DFD Element Matrix

| DFD Element | S | T | R | I | D | E |
|-------------|---|---|---|---|---|---|
| External Entity | X | | X | | | |
| Process | X | X | X | X | X | X |
| Data Store | | X | X | X | X | |
| Data Flow | | X | | X | X | |