SKILL.md

name: implementing-defense-in-depth description: AI agent designs layered security architecture with multiple independent protective barriers ensuring no single point of failure. Use when building security systems, reviewing architecture, or hardening applications.

Implementing Defense in Depth

Quick Start

Perimeter - WAF, DDoS protection, rate limiting, IP filtering
Network - VPC, security groups, mTLS, network policies
Application - Input validation, output encoding, CSRF, CSP
Data - Encryption at rest/transit, access control, classification
Identity - MFA, least privilege, session management
Monitoring - Logging, alerting, anomaly detection across all layers

Features

Feature	Description	Guide
Layered Protection	5+ independent security barriers	Each layer catches what others miss
Perimeter Security	First line of defense	WAF rules, rate limits, DDoS protection
Network Isolation	Segment and protect internal comms	VPC subnets, security groups, mTLS
Application Security	Secure code and request handling	Validate input, encode output, CSP headers
Data Protection	Protect data at rest and in transit	AES-256-GCM, field-level encryption
Identity Security	Authentication and authorization	MFA, RBAC, secure sessions

Common Patterns

# Security Layers Architecture
+--------------------------------------------------+
| LAYER 1: PERIMETER                               |
| WAF | DDoS | Rate Limiting | IP Filtering        |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 2: NETWORK                                 |
| VPC | Security Groups | TLS Everywhere           |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 3: APPLICATION                             |
| Input Validation | Output Encoding | CSRF | CSP  |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 4: DATA                                    |
| Encryption at Rest | Encryption in Transit       |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 5: IDENTITY                                |
| MFA | Least Privilege | Session Management       |
+--------------------------------------------------+

CROSS-CUTTING: Logging | Alerting | Anomaly Detection

# Network Security Groups (Example)
loadBalancer:
  inbound:  [443 from 0.0.0.0/0]
  outbound: [8080 to application-sg]

application:
  inbound:  [8080 from load-balancer-sg]
  outbound: [5432 to database-sg, 443 to external]

database:
  inbound:  [5432 from application-sg]
  outbound: [] # No outbound

Best Practices

Do	Avoid
Implement all layers - each provides unique protection	Relying on a single security layer
Fail securely - deny access when in doubt	Trusting user input at any layer
Log security events for detection/forensics	Exposing detailed error messages
Rotate credentials regularly	Storing secrets in code
Validate all inputs at every layer	Skipping security in development
Encrypt sensitive data at rest and in transit	Assuming internal traffic is safe
Use least privilege for all access	Disabling security for "convenience"
Test security controls regularly	Ignoring security alerts

applying-owasp-security - OWASP security guidelines
implementing-oauth - OAuth authentication flows
implementing-better-auth - Modern auth patterns
verifying-before-completion - Security verification checklists

スコア

総合スコア

60/100

リポジトリの品質指標に基づく評価

✓SKILL.md

SKILL.mdファイルが含まれている

+20

✓LICENSE

ライセンスが設定されている

+10

○説明文

100文字以上の説明がある

0/10

○人気

GitHub Stars 100以上

0/15

○最近の活動

3ヶ月以内に更新がある

0/10

○フォーク

10回以上フォークされている

0/5

✓Issue管理

オープンIssueが50未満

+5

✓言語

プログラミング言語が設定されている

+5

○タグ

1つ以上のタグが設定されている

0/5

レビュー

💬

レビュー機能は近日公開予定です

implementing-defense-in-depth