AI Skill Report Card
Engineering Security Architecture
Quick Start14 / 15
Given a system/architecture description, produce five deliverables in order:
- Threat Map — actors, assets, entry points, threat vectors
- Attack Surface — enumerated exposed components and interfaces
- Security Controls — Zero Trust controls mapped to each risk
- Mitigation Plan — prioritized remediation with owners/timelines
- Audit Checklist — verifiable pass/fail items for compliance
Example trigger: "Review the security posture of our microservices API gateway with JWT auth."
Recommendation▾
Add a second example with a different system type (e.g., data pipeline or mobile app) to show adaptability beyond API gateway scenarios
Workflow14 / 15
Progress:
- Step 1: Gather system context (architecture, data flows, trust boundaries, identities)
- Step 2: Build Threat Map (STRIDE-based: Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege)
- Step 3: Enumerate Attack Surface (network, API, IAM, supply chain, runtime)
- Step 4: Map Security Controls using Zero Trust pillars (Identity, Device, Network, Application, Data)
- Step 5: Draft Mitigation Plan (severity-ranked, actionable, assigned)
- Step 6: Produce Audit Checklist (testable, binary outcomes)
Step 1: Gather Context
Identify: assets (data, services), trust boundaries, identity providers, network topology, third-party dependencies. If context is incomplete, state explicit assumptions rather than halting.
Step 2: Threat Map
For each asset, list: threat actor → attack vector → STRIDE category → impact (Low/Med/High/Critical) → likelihood.
Step 3: Attack Surface
Categorize exposure:
- External: public APIs, ingress points, exposed ports
- Internal: service-to-service calls, internal admin panels
- IAM: privileged roles, service accounts, token lifetimes
- Runtime: containers, orchestrators, sidecars, secrets at runtime
- Supply Chain: dependencies, CI/CD, third-party integrations
Step 4: Security Controls (Zero Trust)
Map each attack surface item to control:
- Identity: MFA, short-lived tokens, least privilege
- Device: posture checks, endpoint attestation
- Network: microsegmentation, mTLS, no implicit trust
- Application: input validation, WAF, secure SDLC
- Data: encryption at rest/in transit, DLP, classification
Step 5: Mitigation Plan
Format: [Severity] Issue → Recommended Fix → Owner → ETA → Verification Method
Rank Critical > High > Medium > Low. Critical items must have compensating controls if immediate fix isn't feasible.
Step 6: Audit Checklist
Each item must be binary (Pass/Fail), traceable to a control, and testable (manual or automated).
Recommendation▾
Include a 'bad output' example illustrating a poorly-formed mitigation plan (untriaged, vague) to contrast with the good one
Examples17 / 20
Example 1:
Input: "API gateway with JWT auth, no mTLS between services, admin panel exposed to VPN only, secrets stored in env vars."
Output:
Threat Map
| Asset | Actor | Vector | STRIDE | Impact | Likelihood |
|---|---|---|---|---|---|
| JWT tokens | External attacker | Token theft/replay | Spoofing | High | Medium |
| Inter-service traffic | Insider/compromised pod | Unencrypted sniffing | Info Disclosure | High | Medium |
| Env var secrets | Compromised container | Memory/process dump | Info Disclosure | Critical | Medium |
| Admin panel | VPN-compromised actor | Lateral movement | Elevation of Privilege | Critical | Low |
Attack Surface
- External: public gateway endpoints, JWT validation logic
- Internal: unencrypted service mesh traffic
- IAM: JWT signing keys, token TTL/refresh flow
- Runtime: secrets in env vars (visible via
/proc, container inspect) - Supply Chain: not assessed (no dependency data provided)
Security Controls
- Identity: rotate JWT signing keys, enforce short TTL (≤15min) + refresh tokens
- Network: enforce mTLS mesh-wide (e.g., Istio/Linkerd)
- Data: migrate secrets to vault (e.g., HashiCorp Vault/K8s Secrets + encryption)
- Application: rate-limit gateway, validate JWT
aud/issclaims strictly
Mitigation Plan
- [Critical] Secrets in env vars → Migrate to secrets manager → Platform Team → 1 week → Verify via container inspection
- [High] No mTLS → Deploy service mesh mTLS → Infra Team → 2 weeks → Verify via traffic capture
- [Medium] Long JWT TTL → Reduce to 15min + refresh flow → Backend Team → 3 days → Verify via token decode test
Audit Checklist
- Secrets not present in plaintext env vars (Pass/Fail)
- All inter-service traffic encrypted via mTLS (Pass/Fail)
- JWT TTL ≤ 15 minutes (Pass/Fail)
- Admin panel requires MFA in addition to VPN (Pass/Fail)
Recommendation▾
Rename skill to gerund form more explicitly aligned with action, e.g. 'architecting-security-controls' for stronger naming consistency
Best Practices
- Always assume breach (Zero Trust core tenet) — no implicit trust for internal traffic.
- Quantify severity/likelihood consistently; avoid vague labels without justification.
- Tie every control back to a specific threat, not generic best practice.
- Prefer compensating controls over blocking delivery when fixes take time.
- Make audit checklist items independently verifiable by someone without full context.
Common Pitfalls
- Don't produce a Mitigation Plan without a preceding Threat Map — recommendations must trace to identified risks.
- Don't treat perimeter security as sufficient; internal/lateral threats must be modeled.
- Don't leave severity/priority unranked — untriaged lists are not actionable.
- Don't recommend controls that are unverifiable (must map to a checklist item).
- Don't ignore identity/runtime attack surface in favor of only network-layer analysis.