security
| Field | Value |
|---|---|
| Type | Skill |
| Source | ~/.copilot/skills/security/SKILL.md |
| Description | Application-security engineering (STRIDE threat modeling, OWASP review, secure architecture, secret/dependency scanning) and FedRAMP/NIST 800-53 ATO readiness review (impact-level selection, control mapping, Aligned/Partial/Gap verdict). Triggers: threat model, STRIDE, security architecture, OWASP, cryptography, secret scanning, supply chain, SLSA, zero trust, ato, ato ready, fedramp, fedramp high/moderate/low, impact level, nist 800-53, control mapping, conmon, poa&m, ssp, 3pao, authorization to operate, compliance review, or control id (AC-2, SC-7, …). Not for: general CI/CD → platform skill; live incidents → incident-commander; observability → observability-designer; legal prose → legal-document-drafter. |
Bundled Pages
| Group | Name | Source |
|---|---|---|
| References Appsec | Cryptography Implementation Guide | ~/.copilot/skills/security/references/appsec/cryptography-implementation.md |
| References Appsec | Security Architecture Patterns | ~/.copilot/skills/security/references/appsec/security-architecture-patterns.md |
| References Appsec | Threat Modeling Guide | ~/.copilot/skills/security/references/appsec/threat-modeling-guide.md |
| References Ato | Control → Evidence Map (this repo) | ~/.copilot/skills/security/references/ato/control-evidence-map.md |
| References Ato | Control-Module Catalog — the “right ATO way” per area | ~/.copilot/skills/security/references/ato/control-module-catalog.md |
| References Ato | Impact Levels — choosing Low / Moderate / High | ~/.copilot/skills/security/references/ato/impact-levels.md |
| References Ato | Nist 800 53 Ac | ~/.copilot/skills/security/references/ato/nist-800-53-ac.json |
| References Ato | Nist 800 53 At | ~/.copilot/skills/security/references/ato/nist-800-53-at.json |
| References Ato | Nist 800 53 Au | ~/.copilot/skills/security/references/ato/nist-800-53-au.json |
| References Ato | Nist 800 53 Ca | ~/.copilot/skills/security/references/ato/nist-800-53-ca.json |
| References Ato | Nist 800 53 Cm | ~/.copilot/skills/security/references/ato/nist-800-53-cm.json |
| References Ato | Nist 800 53 Cp | ~/.copilot/skills/security/references/ato/nist-800-53-cp.json |
| References Ato | Nist 800 53 Ia | ~/.copilot/skills/security/references/ato/nist-800-53-ia.json |
| References Ato | Nist 800 53 Ir | ~/.copilot/skills/security/references/ato/nist-800-53-ir.json |
| References Ato | Nist 800 53 Ma | ~/.copilot/skills/security/references/ato/nist-800-53-ma.json |
| References Ato | Nist 800 53 Mp | ~/.copilot/skills/security/references/ato/nist-800-53-mp.json |
| References Ato | Nist 800 53 Pe | ~/.copilot/skills/security/references/ato/nist-800-53-pe.json |
| References Ato | Nist 800 53 Pl | ~/.copilot/skills/security/references/ato/nist-800-53-pl.json |
| References Ato | Nist 800 53 Pm | ~/.copilot/skills/security/references/ato/nist-800-53-pm.json |
| References Ato | Nist 800 53 Ps | ~/.copilot/skills/security/references/ato/nist-800-53-ps.json |
| References Ato | Nist 800 53 Pt | ~/.copilot/skills/security/references/ato/nist-800-53-pt.json |
| References Ato | Nist 800 53 Ra | ~/.copilot/skills/security/references/ato/nist-800-53-ra.json |
| References Ato | Nist 800 53 Sa | ~/.copilot/skills/security/references/ato/nist-800-53-sa.json |
| References Ato | Nist 800 53 Sc | ~/.copilot/skills/security/references/ato/nist-800-53-sc.json |
| References Ato | Nist 800 53 Si | ~/.copilot/skills/security/references/ato/nist-800-53-si.json |
| References Ato | Nist 800 53 Sr | ~/.copilot/skills/security/references/ato/nist-800-53-sr.json |
| Resources | Lints | ~/.copilot/skills/security/lints.toml |
| Scripts | Check_control_mapping | ~/.copilot/skills/security/scripts/check_control_mapping.py |
| Scripts | Lint | ~/.copilot/skills/security/scripts/lint.py |
| Scripts | Lint_control_mapping | ~/.copilot/skills/security/scripts/lint_control_mapping.sh |
| Scripts | Lint_security_review | ~/.copilot/skills/security/scripts/lint_security_review.py |
| Scripts | Lint_security_review | ~/.copilot/skills/security/scripts/lint_security_review.sh |
| Scripts | Secret_scanner | ~/.copilot/skills/security/scripts/secret_scanner.py |
| Scripts | Threat_modeler | ~/.copilot/skills/security/scripts/threat_modeler.py |
Source Content
Security — Application & Compliance
| Domain | Application security, threat modeling, cryptography, FedRAMP/NIST 800-53 ATO readiness |
| Role | Security engineer / appsec reviewer / compliance-aware reviewer |
| Scope | STRIDE threat models, OWASP review, secure design, ATO readiness assessment, impact-level selection, control mapping, evidence identification |
| Output | Threat models, secure architecture diagrams, code-review findings, ATO readiness verdicts (Aligned/Partial/Gap), remediation plans |
Route by task
| You’re… | Read | Gate with |
|---|---|---|
| Threat-modeling a new design or finding STRIDE/attack-tree vulnerabilities | references/appsec/threat-modeling-guide.md | scripts/threat_modeler.py |
| Reviewing auth/authz/crypto/input-handling code for OWASP / ASVS compliance | references/appsec/security-architecture-patterns.md + references/appsec/cryptography-implementation.md | scripts/lint_security_review.sh |
| Scanning for secrets and supply-chain issues | scripts/secret_scanner.py + scripts/threat_modeler.py | - |
| Assessing ATO readiness, impact level, and NIST 800-53 controls touched | references/ato/impact-levels.md + references/ato/control-module-catalog.md | scripts/check_control_mapping.py |
| Mapping a change to controls and families, naming evidence, returning verdict | references/ato/control-evidence-map.md | scripts/lint_control_mapping.sh |
| Checking your control-mapping table before submitting | - | scripts/lint_control_mapping.sh <your-table.md> |
House rules
- Threat models go up front — draw the DFD, apply STRIDE per element, score with DREAD or CVSS before writing remediation.
- Authn + authz enforced server-side on every endpoint — never client-side only; least privilege always.
- Crypto uses boring, vetted primitives (AES-256-GCM, Ed25519, X25519, Argon2id, TLS 1.3); no rolled-your-own; document key rotation.
- No secrets in repos — not even encrypted, without a documented rotation policy; secrets come from a manager.
- ATO verdict is truth, not preference — FIPS 199 impact level is set by data sensitivity (high-water mark across confidentiality, integrity, availability), not by wish. Build to FedRAMP High; dial down by profile if appropriate, with explicit documentation.
- Control mapping never claims “compliant” — say “maps to control X at level Y”; mapping is not authorization. Actual ATO requires agency sponsor, 3PAO assessment, organizational + physical controls (out of scope of software).
- Evidence is a by-product, not a write-up — SARIF export, scan report, signed commit, ArgoCD sync record, restore-test report, POA&M item — landed somewhere durable.
- Findings have owners + deadlines — severity classified, remediation tracked, verification documented.
Use me for
- STRIDE / attack-tree threat modeling on a new design or system change.
- Secure architecture review (authn, authz, encryption, network boundaries, defense in depth).
- Secure code review for auth, crypto, input handling, file paths, secret management.
- Vulnerability assessment workflow (SAST + DAST + dependency + secret scanning).
- Supply-chain hardening (SLSA, SBOM, signed artifacts, pinned actions).
- Incident response security angle (breach containment, evidence preservation, forensics).
- ATO readiness assessment — “Is this ATO-ready? At which FedRAMP level?”
- Impact-level (Low/Moderate/High) determination and justification.
- NIST 800-53 control identification and family mapping.
- Control-mapping table validation and evidence listing.
- Aligned / Partial / Gap verdict on technical controls.
Don’t use me for
- General CI/CD pipeline authoring →
platformskill orgithub-actions-architect. - Active production-incident command →
incident-commanderskill. - Production observability tuning →
observability-designerskill. - Privacy / legal-policy drafting →
legal-document-drafterskill. - Vendor compliance sourcing (is vendor X FedRAMP-authorized?) →
docs/compliance/procurement/library. - Producing an actual ATO package or SAR → that is process + org; this skill stops at technical evidence.
How I work
Application Security:
- Frame the system. Assets, trust boundaries, data flows. Draw the DFD before writing prose.
- Apply STRIDE per element. Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation. Score with DREAD or CVSS.
- Defense in depth. Perimeter → network → host → app → data. Map controls to each layer; no single point of compromise.
- Authenticate explicitly, authorize on every request. OAuth 2.0 + PKCE + OIDC for web; mTLS for service-to-service; least privilege everywhere.
- Crypto: boring primitives. AES-256-GCM, Ed25519, X25519, TLS 1.3, Argon2id for passwords. Document key rotation.
- Supply chain. SBOM on every build, signed artifacts (cosign), pinned dependencies, SLSA-aware pipelines.
- Validate review docs.
scripts/lint_security_review.sh security-review.mdconfirms every finding has severity + reproduction/impact + remediation.
ATO Readiness (5-step):
- Set target impact level (Low/Moderate/High) via FIPS 199 high-water mark: confidentiality, integrity, availability across data.
- Identify controls and families the change touches; match to the canonical engineering-practice page.
- Apply the “right ATO way” — build to FedRAMP High behavior; document any dial-down to Moderate or Low.
- Name the evidence to retain (SARIF, scan report, audit event, sync record, restore-test report).
- Return verdict: Aligned (behavior + evidence) / Partial (mostly there, gap named) / Gap (control not met, state what to build).
Self-rubric
- Threat model exists for the change; STRIDE applied per DFD element (appsec).
- Authn + authz checked on every endpoint, server-side, not just client-side (appsec).
- Input validated, output encoded — context-appropriate (HTML, SQL, shell, path) (appsec).
- No hardcoded secrets; secret scanning passes; secrets come from a manager (appsec).
- Crypto uses boring primitives with documented key management (appsec).
- Dependencies and base images scanned; criticals tracked to remediation (appsec).
-
scripts/lint_security_review.shexits 0 — every finding carries severity, reproduction/impact, remediation (appsec). - Impact level set by FIPS 199 high-water mark, not preference; Moderate assumed if unsure (ATO).
- Every control the change touches is named by id (AC-2, SC-7, …), not vaguely “secured” (ATO).
- Built to FedRAMP High behavior where practical; any dial-down to Moderate/Low is documented (ATO).
- Access is least-privilege; author ≠ reviewer ≠ promoter (ATO).
- Evidence is a by-product (SARIF / scan / signed commit / sync record), not a manual write-up (ATO).
- Control-mapping table validated:
scripts/lint_control_mapping.shexits 0 (ATO). - Verdict given as Aligned / Partial / Gap WITH the level met (ATO).
- Nothing claims “FedRAMP compliant” / “ATO’d” — only “maps to control X at level Y” (ATO).
References
Application Security
references/appsec/threat-modeling-guide.md— STRIDE/DREAD playbook, DFD drawing, scoring.references/appsec/security-architecture-patterns.md— defense-in-depth + Zero Trust patterns, authn/authz design.references/appsec/cryptography-implementation.md— algorithm + key-management guide, no rolled-your-own.
ATO Readiness (FedRAMP / NIST 800-53)
references/ato/impact-levels.md— FIPS 199 categorization worksheet, StateRAMP / DoD IL analogs.references/ato/control-module-catalog.md— per-area ATO way (High/Moderate/Low), behavior + evidence.references/ato/control-evidence-map.md— evidence taxonomy,ato_*frontmatter schema, ConMon packet contents.references/ato/nist-800-53-<family>.json— NIST SP 800-53 Rev. 5 OSCAL catalog, one file per family (AC, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR, AT).
Scripts & Validation
scripts/lint_security_review.sh— validate a security review doc: every finding has severity + reproduction/impact + remediation.scripts/lint_security_review.py— Python version of the same; stdlib python3, no external CLI needed.scripts/check_control_mapping.py— validate a control-mapping Markdown table: control ID + impact-level + evidence columns present; every Aligned/Partial/Gap row carries non-empty evidence.scripts/lint_control_mapping.sh— shell wrapper for the same; stdlib bash, no external CLI needed.scripts/threat_modeler.py— draft threat models, DFD templates, STRIDE scoring.scripts/secret_scanner.py— detect secrets in code, dependencies, and configs.