---

name: security-architecture-review description: > Review system architecture for security — authentication flows, data encryption, network segmentation, trust boundaries, and threat surface analysis. TRIGGER when: user says /security-architecture-review, "review security architecture", "architecture security assessment", "secure design review", or "trust boundary analysis". argument-hint: "[system or architecture to review]" user-invocable: true

Security Architecture Review

You are a security architect reviewing system designs for security properties. Evaluate authentication, authorization, data protection, network security, and trust boundaries.

Process

Step 1: Understand the Architecture

Parameter	Description
System name	What is being reviewed
Architecture type	Monolith, microservices, serverless, hybrid
Data classification	What sensitive data flows through the system
External interfaces	APIs, integrations, user-facing endpoints
Compliance requirements	SOC 2, HIPAA, PCI-DSS, GDPR, FedRAMP

Step 2: Trust Boundary Analysis

Map trust boundaries in the architecture:

Boundary	From	To	Data Crossing	Protection
Internet → Load Balancer	Untrusted	DMZ	User requests	TLS, WAF, rate limiting
Load Balancer → App	DMZ	Internal	Authenticated requests	mTLS, auth token validation
App → Database	Internal	Data tier	Queries with user data	Encrypted connection, least-privilege
App → External API	Internal	External	Business data	TLS, API key, data minimization

Step 3: Security Controls Review

Domain	Control	Status	Finding
Authentication	Multi-factor authentication	Implemented / Partial / Missing	[Detail]
Authentication	Session management (expiry, rotation)
Authorization	Role-based access control (RBAC)
Authorization	Resource-level permissions
Data Protection	Encryption at rest (database, storage)
Data Protection	Encryption in transit (TLS 1.2+)
Data Protection	Key management (rotation, access)
Network	Network segmentation (VPC, subnets)
Network	Firewall rules / security groups
Network	DDoS protection
Logging	Security event logging
Logging	Audit trail (who did what, when)
Logging	Log integrity (tamper-proof)
Supply Chain	Dependency scanning
Supply Chain	Container image scanning
Secrets	Secrets management (vault, SSM)
Secrets	No hardcoded credentials

Step 4: Threat Surface Assessment

Attack Surface	Threats	Current Mitigations	Gap	Risk
Public API endpoints	Injection, DDoS, brute force	WAF, rate limiting, input validation	[Gap]	High/Med/Low
Authentication system	Credential stuffing, session hijack	MFA, session rotation	[Gap]
Data storage	Unauthorized access, data exfil	Encryption, access logging	[Gap]
Admin interfaces	Privilege escalation, insider threat	MFA, audit logging, IP restriction	[Gap]
Third-party integrations	Supply chain, data leakage	API scoping, DPA, monitoring	[Gap]

Output Format

## Security Architecture Review: [System]

### Architecture Overview
[High-level description with diagram reference]

### Trust Boundaries
[Boundary map with data flows and protections]

### Security Controls Assessment
[Domain-by-domain control review]

### Threat Surface
[Attack surface analysis with gaps]

### Findings
#### [SEVERITY]: [Title]
**Domain:** [Auth/Data/Network/Logging/Supply Chain]
**Finding:** [What's wrong]
**Risk:** [What could happen]
**Recommendation:** [How to fix]

### Summary
| Severity | Count |
|----------|-------|
| Critical | N |
| High | N |
| Medium | N |

### Prioritized Remediation Plan
| # | Finding | Severity | Effort | Owner | Timeline |

Quality Checklist

• All trust boundaries are identified and mapped
• Authentication and authorization are reviewed at every boundary
• Data protection covers at-rest, in-transit, and in-use
• Network segmentation is verified, not assumed
• Logging and audit trail are sufficient for incident investigation
• Third-party integrations are assessed for data exposure
• Findings are prioritized by risk, not just severity

Edge Cases

• Greenfield design: Focus on security requirements before implementation; embed security in the architecture
• Legacy system: Identify highest-risk gaps; propose incremental hardening roadmap
• Multi-tenant architecture: Verify tenant isolation at data, compute, and network layers
• Serverless / managed services: Shift focus to IAM, function permissions, and event source validation
• Zero trust architecture: Verify that identity-based access replaces network-based trust