Security Analysis

STRIDE Threat Modeling

Risk Scoring

Risk = Impact x Likelihood (each 1-4)

Score >= 12: Critical (immediate remediation)
Score >= 6:  High (sprint priority)
Score >= 3:  Medium (backlog)
Score < 3:   Low (accept or defer)

Attack Tree Patterns

• OR nodes: any child path achieves the goal (attacker picks easiest)
• AND nodes: all children required (harder to execute)
• Prioritize: unmitigated leaf nodes with LOW difficulty
• Key insight: OR nodes at the root mean you must mitigate ALL paths; AND nodes mean disrupting one path is sufficient

STRIDE-to-Requirements Mapping

Controls Library (Preferred Defaults)

SAST Tool Selection

Default stack: Semgrep (all languages) + language-specific linter (Bandit/ESLint security plugin).

SAST Rule Strategy

Start Narrow, Expand Gradually

1. Begin with p/security-audit + p/owasp-top-ten rulesets
2. Block CI only on ERROR severity -- WARNING as informational
3. After team adapts (~2 weeks), add language-specific rules
4. Custom rules only for org-specific patterns

High-Value Rules (Always Enable)

• Injection: SQL via string formatting, command injection via shell=True, XSS via innerHTML
• Secrets: hardcoded API keys, AWS credentials (AKIA...), JWT secrets in source
• Insecure patterns: pickle.loads(), yaml.load() with untrusted data, random for security ops

CI Integration

Pipeline Placement

PR opened -> lint -> unit tests -> SAST scan -> build -> integration tests

Run SAST early (before build) for fast feedback. Gate on errors only, not warnings.

GitHub Actions

- name: Run Semgrep
  uses: returntocorp/semgrep-action@v1
  with:
    config: >-
      p/security-audit
      p/owasp-top-ten

False Positive Management

• # nosemgrep: rule-id with mandatory comment explaining why
• Exclude tests/, vendor/, node_modules/, generated/
• Review suppressions quarterly -- code changes may invalidate them

Custom Semgrep Rules

rules:
  - id: no-raw-sql
    pattern: cursor.execute("... %s ..." % $VAR)
    message: "Use parameterized queries, not string formatting"
    severity: ERROR
    languages: [python]
    metadata:
      cwe: "CWE-89"

  - id: no-innerHTML-user-input
    pattern: $ELEM.innerHTML = $VAR
    message: "Use textContent or DOMPurify.sanitize()"
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      cwe: "CWE-79"

Vulnerability Quick Reference

Threat Model Document Structure

1. System Overview - data flow diagram + trust boundaries
2. Assets - sensitivity classification per asset
3. STRIDE Analysis - table per category with impact/likelihood
4. Attack Trees - mermaid diagrams for top 3 scenarios
5. Mitigation Plan - threat/control/status/coverage matrix
6. Recommendations - tiered: immediate (critical), 30-day (high), 90-day (improvements)

Requirement Traceability

Every security requirement must link back to:

• Threat ID it mitigates
• Compliance control it satisfies (PCI-DSS, HIPAA, GDPR, SOC2, OWASP)
• Acceptance criteria (testable, specific)
• Priority derived from risk score (not gut feel)

Compliance Framework Quick Reference

Agent Team Mode

For comprehensive threat modeling of complex systems with multiple trust boundaries and compliance requirements.

Team Configuration

team:
  recommended_size: 4
  agent_roles:
    - name: stride-analyst
      type: Explore
      focus: "STRIDE category analysis per component and trust boundary"
      skills_loaded: ["security:security-analysis"]
    - name: attack-tree-builder
      type: Explore
      focus: "Attack tree construction from STRIDE findings, path prioritization"
      skills_loaded: ["security:security-analysis"]
    - name: sast-scanner
      type: general-purpose
      focus: "SAST rule execution, custom Semgrep rule generation, false positive triage"
      skills_loaded: ["security:security-analysis"]
    - name: compliance-mapper
      type: Explore
      focus: "Map findings to PCI-DSS, HIPAA, GDPR, OWASP ASVS controls"
      skills_loaded: ["security:compliance-and-data-privacy"]
  file_ownership: "shared-read-only"
  lead_mode: "hands-on"

Team Workflow

1. Lead defines system boundaries, assets, and trust boundaries
2. stride-analyst and attack-tree-builder work in parallel (attack-tree-builder uses STRIDE findings as they arrive)
3. sast-scanner runs automated scans concurrently
4. compliance-mapper maps all discovered threats to compliance controls
5. Lead synthesizes into Threat Model Document (system overview, STRIDE table, attack trees, mitigation plan, recommendations)

Single-Agent Fallback

Without team mode, execute all phases sequentially (default behavior). Team mode is an optional enhancement.

Gotchas

• OR-node attack trees need ALL paths mitigated; missing one leaves the goal achievable
• Risk scores should drive requirement priority -- don't let stakeholder politics override
• Detective controls (logging) are necessary but insufficient alone; pair with preventive
• Error messages are an info disclosure vector -- generic errors externally, detailed internally
• Session management is often the weakest STRIDE link; model it explicitly
• Compliance mapping gaps surface best through automated traceability matrices, not manual review