ldy26098
/
BMAD-METHOD
mirror of https://github.com/bmad-code-org/BMAD-METHOD.git
1
0
Fork 0
Code Packages Projects Releases Wiki Activity
BMAD-METHOD/bmad-agent/checklists/security-integration-specia...

10 KiB
Raw Blame History

Security Integration Specialist Quality Checklist

Checklist Overview

Checklist Name: Security Integration Specialist Quality Validation
Version: 1.0
Purpose: Ensure comprehensive security analysis and implementation quality
Scope: Cross-platform security assessment and remediation
Review Type: Security Quality Assurance

Section 1: Security Architecture Assessment (Weight: 20%)

1.1 Threat Modeling Completeness

  • Comprehensive Asset Identification (Score: ___/10)

    • All system assets identified and catalogued
    • Data flow diagrams created and validated
    • Trust boundaries clearly defined
    • Entry points and attack vectors mapped
    • Threat actors and motivations identified

  • Attack Vector Analysis (Score: ___/10)

    • STRIDE methodology applied comprehensively
    • Attack trees developed for critical assets
    • Risk likelihood and impact assessed
    • Mitigation strategies identified for each threat

  • Security Control Mapping (Score: ___/10)

    • Existing security controls documented
    • Control effectiveness evaluated
    • Security gaps identified and prioritized
    • Defense-in-depth strategy validated

1.2 Architecture Security Design

  • Authentication Architecture (Score: ___/10)

    • Multi-factor authentication strategy defined
    • Identity provider integration assessed
    • Session management security validated
    • Password policy and enforcement reviewed

  • Authorization Framework (Score: ___/10)

    • Role-based access control (RBAC) implemented
    • Attribute-based access control (ABAC) considered
    • Principle of least privilege applied
    • Access control matrix validated

  • Data Protection Strategy (Score: ___/10)

    • Data classification scheme implemented
    • Encryption at rest and in transit validated
    • Key management strategy defined
    • Data retention and disposal policies established

Section 2: Vulnerability Assessment Quality (Weight: 25%)

2.1 Static Code Analysis

  • Automated Scanning Coverage (Score: ___/10)

    • All code repositories scanned
    • Multiple SAST tools utilized
    • Custom security rules implemented
    • False positive analysis completed

  • Manual Code Review (Score: ___/10)

    • Security-focused code review conducted
    • Business logic vulnerabilities identified
    • Framework-specific security issues assessed
    • Code quality and security patterns validated

  • Dependency Analysis (Score: ___/10)

    • All dependencies scanned for vulnerabilities
    • Transitive dependencies analyzed
    • License compliance verified
    • Update strategy for vulnerable components defined

2.2 Dynamic Security Testing

  • Penetration Testing (Score: ___/10)

    • Comprehensive penetration testing performed
    • OWASP Top 10 vulnerabilities tested
    • Business logic testing included
    • Social engineering vectors assessed

  • API Security Testing (Score: ___/10)

    • All API endpoints tested
    • Authentication and authorization tested
    • Input validation and sanitization verified
    • Rate limiting and abuse prevention tested

  • Infrastructure Testing (Score: ___/10)

    • Network security configuration tested
    • Server hardening validated
    • Cloud security posture assessed
    • Container and orchestration security verified

Section 3: Technology-Specific Security Implementation (Weight: 20%)

3.1 Frontend Security (React/TypeScript)

  • XSS Prevention (Score: ___/10)

    • Content Security Policy (CSP) implemented
    • Input sanitization using DOMPurify
    • Template injection prevention validated
    • DOM manipulation security verified

  • Authentication Security (Score: ___/10)

    • Secure token storage (httpOnly cookies)
    • JWT implementation security validated
    • Session management security verified
    • OAuth 2.0 implementation assessed

  • Client-Side Data Protection (Score: ___/10)

    • Sensitive data handling validated
    • Local storage security assessed
    • Form validation and sanitization implemented
    • HTTPS enforcement verified

3.2 Backend Security (Node.js/Python/.NET)

  • Input Validation (Score: ___/10)

    • SQL injection prevention implemented
    • NoSQL injection prevention validated
    • Command injection prevention verified
    • Path traversal prevention implemented

  • Authentication & Authorization (Score: ___/10)

    • Secure password hashing (bcrypt, scrypt)
    • JWT token security implementation
    • Role-based access control implemented
    • Session security validated

  • Security Headers & Middleware (Score: ___/10)

    • Helmet.js or equivalent implemented
    • CORS configuration security validated
    • Rate limiting middleware implemented
    • Security logging and monitoring enabled

3.3 Database Security

  • Access Control (Score: ___/10)

    • Database user privileges minimized
    • Connection security (SSL/TLS) enabled
    • Database firewall rules implemented
    • Audit logging enabled

  • Data Protection (Score: ___/10)

    • Sensitive data encryption at rest
    • Backup encryption implemented
    • Data masking for non-production environments
    • Secure key management implemented

Section 4: Compliance and Risk Management (Weight: 15%)

4.1 Regulatory Compliance

  • GDPR Compliance (Score: ___/10)

    • Data protection impact assessment completed
    • Privacy by design principles implemented
    • Data subject rights mechanisms implemented
    • Consent management system validated

  • Industry Standards Compliance (Score: ___/10)

    • OWASP guidelines followed
    • NIST framework alignment verified
    • SOC 2 controls implemented (if applicable)
    • PCI DSS compliance verified (if applicable)

4.2 Risk Assessment

  • Risk Quantification (Score: ___/10)

    • Business impact analysis completed
    • Risk likelihood assessment performed
    • Risk scoring methodology applied
    • Risk tolerance alignment verified

  • Risk Mitigation Strategy (Score: ___/10)

    • Mitigation controls identified
    • Residual risk assessment completed
    • Risk acceptance documentation prepared
    • Continuous monitoring plan established

Section 5: Security Testing and Validation (Weight: 10%)

5.1 Security Test Coverage

  • Unit Security Tests (Score: ___/10)

    • Authentication function tests implemented
    • Authorization logic tests created
    • Input validation tests comprehensive
    • Cryptographic function tests validated

  • Integration Security Tests (Score: ___/10)

    • End-to-end security flow tests
    • Cross-component security tests
    • Third-party integration security tests
    • API security integration tests

5.2 Continuous Security Monitoring

  • Security Monitoring Implementation (Score: ___/10)

    • SIEM system integration completed
    • Security event correlation rules defined
    • Alerting and notification system configured
    • Incident response procedures documented

  • Security Metrics and Reporting (Score: ___/10)

    • Security KPIs defined and tracked
    • Regular security reporting implemented
    • Trend analysis and forecasting enabled
    • Executive dashboard created

Section 6: Documentation and Communication (Weight: 10%)

6.1 Security Documentation

  • Security Architecture Documentation (Score: ___/10)

    • Security design documents complete
    • Threat model documentation comprehensive
    • Security control documentation detailed
    • Risk assessment documentation thorough

  • Implementation Guidance (Score: ___/10)

    • Secure coding guidelines documented
    • Security configuration guides created
    • Incident response procedures documented
    • Security training materials developed

6.2 Stakeholder Communication

  • Technical Communication (Score: ___/10)

    • Clear technical security recommendations
    • Implementation guidance provided
    • Risk communication effective
    • Cross-team collaboration facilitated

  • Executive Reporting (Score: ___/10)

    • Business impact clearly communicated
    • Risk levels appropriately conveyed
    • ROI of security investments demonstrated
    • Strategic security recommendations provided

Quality Scoring Matrix

Overall Quality Score Calculation

Total Score = (Section 1  0.20) + (Section 2  0.25) + (Section 3  0.20) + 
              (Section 4  0.15) + (Section 5  0.10) + (Section 6  0.10)

Quality Rating Thresholds

  • Excellent (9.0-10.0): Exceptional security implementation with comprehensive coverage
  • Very Good (8.0-8.9): Strong security implementation with minor improvements needed
  • Good (7.0-7.9): Solid security implementation with some areas for enhancement
  • Satisfactory (6.0-6.9): Adequate security implementation requiring improvements
  • Needs Improvement (5.0-5.9): Security implementation requires significant enhancements
  • Unsatisfactory (<5.0): Security implementation requires major rework

Critical Security Requirements (Must Pass)

  • No Critical Vulnerabilities: Zero critical security vulnerabilities present
  • Authentication Security: Secure authentication mechanisms implemented
  • Data Protection: Sensitive data properly encrypted and protected
  • Input Validation: Comprehensive input validation implemented
  • Security Headers: All required security headers configured
  • Access Control: Proper authorization mechanisms implemented
  • Compliance Requirements: All applicable compliance requirements met

Remediation Tracking

Finding ID Severity Description Assigned To Due Date Status
SEC-001 Critical [Description] [Assignee] [Date] [Status]
SEC-002 High [Description] [Assignee] [Date] [Status]
SEC-003 Medium [Description] [Assignee] [Date] [Status]

Review and Approval

Quality Review

  • Reviewer Name: [Name]
  • Review Date: [Date]
  • Overall Quality Score: ___/10.0
  • Quality Rating: [Excellent/Very Good/Good/Satisfactory/Needs Improvement/Unsatisfactory]

Security Approval

  • Security Specialist: [Name] - [Date] - [Signature]
  • Technical Architect: [Name] - [Date] - [Signature]
  • Security Manager: [Name] - [Date] - [Signature]

Recommendations for Improvement

  1. [Recommendation 1]
  2. [Recommendation 2]
  3. [Recommendation 3]

Next Review Date

Scheduled Review: [Date] Review Frequency: [Monthly/Quarterly/As Needed]

Checklist Version: 1.0
Last Updated: [Date]
Document Owner: Security Integration Specialist
Quality Framework Integration: BMAD Method Quality Standards