security

# Security Operations

Secure systems from design through deployment and incident response.

## Quick Reference

### Security Architecture Principles

**Zero Trust Model:**

1. Never trust, always verify
2. Assume breach
3. Verify explicitly
4. Least privilege access
5. Micro-segmentation

**SLSA Framework (Supply Chain):**

- Level 1: Documentation
- Level 2: Hosted build, signed provenance
- Level 3: Hardened builds, 2-person review
- Level 4: Hermetic, reproducible builds

### Threat Modeling (STRIDE)

| Threat                     | Example             | Mitigation                  |
| -------------------------- | ------------------- | --------------------------- |
| **S**poofing               | Fake identity       | Strong auth, MFA            |
| **T**ampering              | Modified data       | Integrity checks, signing   |
| **R**epudiation            | Deny actions        | Audit logs, non-repudiation |
| **I**nformation Disclosure | Data leak           | Encryption, access control  |
| **D**enial of Service      | Overload            | Rate limiting, scaling      |
| **E**levation of Privilege | Unauthorized access | Least privilege, RBAC       |

### Code Security Review Checklist

```markdown
## OWASP Top 10 (2021)

- [ ] A01: Broken Access Control
- [ ] A02: Cryptographic Failures
- [ ] A03: Injection (SQL, NoSQL, OS, LDAP)
- [ ] A04: Insecure Design
- [ ] A05: Security Misconfiguration
- [ ] A06: Vulnerable Components
- [ ] A07: Auth Failures
- [ ] A08: Software/Data Integrity Failures
- [ ] A09: Logging/Monitoring Failures
- [ ] A10: SSRF
```

### Secrets Management

**Never commit secrets.** Use environment-based injection:

```yaml
# Kubernetes External Secrets
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: api-keys
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: api-keys
  data:
    - secretKey: OPENAI_API_KEY
      remoteRef:
        key: secret/