threat-mitigation-mapping

wshobson ｜ 安全護欄 ｜ 原文 ｜ MIT

把已找出的威脅對應到安全控制與緩解措施

---
name: threat-mitigation-mapping
description: 把已找出的威脅對應到適當的安全控制與緩解措施。排定資安投資優先順序、制定修補計畫，或驗證控制措施有效性時使用。
---

# Threat Mitigation Mapping

把威脅和控制措施連起來，做有效的資安規劃。

## When to Use This Skill

- 排定資安投資的優先順序
- 制定修補路線圖
- 驗證控制措施的涵蓋範圍
- 設計縱深防禦
- 資安架構 review
- 風險處置規劃

## Core Concepts

### 1. Control Categories

```
Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)
```

### 2. Control Layers

| Layer           | Examples                             |
| --------------- | ------------------------------------ |
| **Network**     | Firewall、WAF、DDoS 防護       |
| **Application** | 輸入驗證、認證     |
| **Data**        | 加密、存取控制          |
| **Endpoint**    | EDR、修補程式管理                |
| **Process**     | 資安訓練、事件應變 |

### 3. Defense in Depth

```
                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘
```

## Templates and detailed worked examples

完整的範本庫，以及詳細的緩解措施／控制措施對應，放在 `references/details.md`。需要以下這些具體範本時，再去讀那個檔案：Mitigation Model、Defense in Depth 評分、Executive Summary 骨架、Critical Gaps 報告、Recommendations、Implementation Roadmap、Results by Control。

## Best Practices

### Do's

- **Map all threats** - 不能有任何威脅沒被對應
- **Layer controls** - 縱深防禦是必要的
- **Mix control types** - 預防型、偵測型、矯正型都要有
- **Track effectiveness** - 量測並持續改善
- **Review regularly** - 控制措施會隨時間退化

### Don'ts

- **Don't rely on single controls** - 會有單點故障
- **Don't ignore cost** - ROI 很重要
- **Don't skip testing** - 沒測過的控制措施可能會失效
- **Don't set and forget** - 要持續改進
- **Don't ignore people/process** - 光靠技術是不夠的

---
name: threat-mitigation-mapping
description: Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.
---

# Threat Mitigation Mapping

Connect threats to controls for effective security planning.

## When to Use This Skill

- Prioritizing security investments
- Creating remediation roadmaps
- Validating control coverage
- Designing defense-in-depth
- Security architecture review
- Risk treatment planning

## Core Concepts

### 1. Control Categories

```
Preventive ────► Stop attacks before they occur
   │              (Firewall, Input validation)
   │
Detective ─────► Identify attacks in progress
   │              (IDS, Log monitoring)
   │
Corrective ────► Respond and recover from attacks
                  (Incident response, Backup restore)
```

### 2. Control Layers

| Layer           | Examples                             |
| --------------- | ------------------------------------ |
| **Network**     | Firewall, WAF, DDoS protection       |
| **Application** | Input validation, authentication     |
| **Data**        | Encryption, access controls          |
| **Endpoint**    | EDR, patch management                |
| **Process**     | Security training, incident response |

### 3. Defense in Depth

```
                    ┌──────────────────────┐
                    │      Perimeter       │ ← Firewall, WAF
                    │   ┌──────────────┐   │
                    │   │   Network    │   │ ← Segmentation, IDS
                    │   │  ┌────────┐  │   │
                    │   │  │  Host  │  │   │ ← EDR, Hardening
                    │   │  │ ┌────┐ │  │   │
                    │   │  │ │App │ │  │   │ ← Auth, Validation
                    │   │  │ │Data│ │  │   │ ← Encryption
                    │   │  │ └────┘ │  │   │
                    │   │  └────────┘  │   │
                    │   └──────────────┘   │
                    └──────────────────────┘
```

## Templates and detailed worked examples

Full template library and detailed mitigation/control mappings live in `references/details.md`. Read that file when you need the concrete templates for: Mitigation Model, Defense in Depth scoring, Executive Summary scaffolding, Critical Gaps reporting, Recommendations, Implementation Roadmap, Results by Control.

## Best Practices

### Do's

- **Map all threats** - No threat should be unmapped
- **Layer controls** - Defense in depth is essential
- **Mix control types** - Preventive, detective, corrective
- **Track effectiveness** - Measure and improve
- **Review regularly** - Controls degrade over time

### Don'ts

- **Don't rely on single controls** - Single points of failure
- **Don't ignore cost** - ROI matters
- **Don't skip testing** - Untested controls may fail
- **Don't set and forget** - Continuous improvement
- **Don't ignore people/process** - Technology alone isn't enough