@sylix/coworker 2.0.11 → 2.0.12

package/dist/skills/defaults/security/threat-mitigation-mapping.md

@@ -0,0 +1,290 @@
+---
+name: threat-mitigation-mapping
+description: Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.
+---
+
+# Threat Mitigation Mapping
+
+Connect threats to controls for effective security planning.
+
+## When to Use This Skill
+
+- Prioritizing security investments
+- Creating remediation roadmaps
+- Validating control coverage
+- Designing defense-in-depth
+- Security architecture review
+- Risk treatment planning
+
+## Core Concepts
+
+### 1. Control Categories
+
+```
+Preventive ────► Stop attacks before they occur
+   │              (Firewall, Input validation)
+   │
+Detective ─────► Identify attacks in progress
+   │              (IDS, Log monitoring)
+   │
+Corrective ────► Respond and recover from attacks
+                 (Incident response, Backup restore)
+```
+
+### 2. Control Layers
+
+| Layer           | Examples                             |
+| --------------- | ------------------------------------ |
+| **Network**     | Firewall, WAF, DDoS protection       |
+| **Application** | Input validation, authentication     |
+| **Data**        | Encryption, access controls          |
+| **Endpoint**    | EDR, patch management                |
+| **Process**     | Security training, incident response |
+
+### 3. Defense in Depth
+
+```
+                    ┌──────────────────────┐
+                    │      Perimeter       │ ← Firewall, WAF
+                    │   ┌──────────────┐   │
+                    │   │   Network    │   │ ← Segmentation, IDS
+                    │   │  ┌────────┐  │   │
+                    │   │  │  Host  │  │   │ ← EDR, Hardening
+                    │   │  │ ┌────┐ │  │   │ ← Auth, Validation
+                    │   │  │ │App │ │  │   │
+                    │   │  │ │Data│ │  │   │ ← Encryption
+                    │   │  │ └────┘ │  │   │
+                    │   │  └────────┘  │   │
+                    └──────────────────────┘
+```
+
+## Templates
+
+### Template 1: Standard Security Controls
+
+```python
+class ControlType(Enum):
+    PREVENTIVE = "preventive"
+    DETECTIVE = "detective"
+    CORRECTIVE = "corrective"
+
+class ControlLayer(Enum):
+    NETWORK = "network"
+    APPLICATION = "application"
+    DATA = "data"
+    ENDPOINT = "endpoint"
+    PROCESS = "process"
+
+# Control Library
+
+CONTROLS = {
+    # Authentication Controls
+    "AUTH-001": {
+        "name": "Multi-Factor Authentication",
+        "description": "Require MFA for all user authentication",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.APPLICATION,
+        "effectiveness": Effectiveness.HIGH,
+        "mitigates": ["SPOOFING"],
+    },
+    "AUTH-002": {
+        "name": "Account Lockout Policy",
+        "description": "Lock accounts after failed authentication attempts",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.APPLICATION,
+        "effectiveness": Effectiveness.MEDIUM,
+        "mitigates": ["SPOOFING"],
+    },
+
+    # Input Validation Controls
+    "VAL-001": {
+        "name": "Input Validation Framework",
+        "description": "Validate and sanitize all user input",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.APPLICATION,
+        "effectiveness": Effectiveness.HIGH,
+        "mitigates": ["TAMPERING", "INJECTION"],
+    },
+    "VAL-002": {
+        "name": "Web Application Firewall",
+        "description": "Deploy WAF to filter malicious requests",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.NETWORK,
+        "effectiveness": Effectiveness.MEDIUM,
+        "mitigates": ["TAMPERING", "INJECTION", "DOS"],
+    },
+
+    # Encryption Controls
+    "ENC-001": {
+        "name": "Data Encryption at Rest",
+        "description": "Encrypt sensitive data in storage",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.DATA,
+        "effectiveness": Effectiveness.HIGH,
+        "mitigates": ["INFORMATION_DISCLOSURE"],
+    },
+    "ENC-002": {
+        "name": "TLS Encryption",
+        "description": "Encrypt data in transit using TLS 1.3",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.NETWORK,
+        "effectiveness": Effectiveness.HIGH,
+        "mitigates": ["INFORMATION_DISCLOSURE", "TAMPERING"],
+    },
+
+    # Logging Controls
+    "LOG-001": {
+        "name": "Security Event Logging",
+        "description": "Log all security-relevant events",
+        "type": ControlType.DETECTIVE,
+        "layer": ControlLayer.APPLICATION,
+        "effectiveness": Effectiveness.MEDIUM,
+        "mitigates": ["REPUDIATION"],
+    },
+
+    # Access Control
+    "ACC-001": {
+        "name": "Role-Based Access Control",
+        "description": "Implement RBAC for authorization",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.APPLICATION,
+        "effectiveness": Effectiveness.HIGH,
+        "mitigates": ["ELEVATION_OF_PRIVILEGE", "INFORMATION_DISCLOSURE"],
+    },
+
+    # Availability Controls
+    "AVL-001": {
+        "name": "Rate Limiting",
+        "description": "Limit request rates to prevent abuse",
+        "type": ControlType.PREVENTIVE,
+        "layer": ControlLayer.APPLICATION,
+        "effectiveness": Effectiveness.MEDIUM,
+        "mitigates": ["DENIAL_OF_SERVICE"],
+    },
+}
+```
+
+### Template 2: Threat to Control Mapping
+
+```python
+# Example: SQL Injection threat mapping
+threat_mapping = {
+    "SQL_INJECTION": {
+        "threat": "SQL Injection Attack",
+        "impact": "Critical",
+        "controls": [
+            {
+                "id": "VAL-001",
+                "status": "implemented",
+                "notes": "Parameterized queries throughout"
+            },
+            {
+                "id": "VAL-002", 
+                "status": "implemented",
+                "notes": "WAF with SQL injection rules"
+            },
+            {
+                "id": "LOG-001",
+                "status": "implemented",
+                "notes": "All queries logged"
+            }
+        ],
+        "residual_risk": "Low"
+    }
+}
+```
+
+### Template 3: Mitigation Analysis
+
+```python
+def analyze_coverage(mapping):
+    """Calculate control coverage for a threat."""
+    if not mapping["controls"]:
+        return 0.0
+    
+    effectiveness_scores = {
+        "LOW": 1,
+        "MEDIUM": 2,
+        "HIGH": 3,
+        "VERY_HIGH": 4
+    }
+    
+    status_multiplier = {
+        "not_implemented": 0.0,
+        "partial": 0.5,
+        "implemented": 0.8,
+        "verified": 1.0
+    }
+    
+    total_score = 0
+    for control in mapping["controls"]:
+        # Get control effectiveness
+        effect = effectiveness_scores.get(CONTROLS[control["id"]]["effectiveness"], 1)
+        status = status_multiplier.get(control["status"], 0)
+        total_score += effect * status
+    
+    max_possible = len(mapping["controls"]) * 4
+    return (total_score / max_possible) * 100
+```
+
+### Template 4: Implementation Roadmap
+
+```python
+def generate_roadmap(threats, controls):
+    """Generate prioritized implementation roadmap."""
+    roadmap = []
+    
+    # Phase 1: Critical threats
+    critical = [t for t in threats if t["impact"] == "Critical"]
+    for threat in critical:
+        # Find missing controls
+        for control in get_controls_for_threat(threat["category"]):
+            if control["status"] != "implemented":
+                roadmap.append({
+                    "phase": 1,
+                    "priority": "Critical",
+                    "threat": threat["name"],
+                    "control": control["name"]
+                })
+    
+    # Phase 2: High threats
+    high = [t for t in threats if t["impact"] == "High"]
+    # Similar logic...
+    
+    return roadmap
+```
+
+## Best Practices
+
+### Do's
+
+- **Map all threats** - No threat should be unmapped
+- **Layer controls** - Defense in depth is essential
+- **Mix control types** - Preventive, detective, corrective
+- **Track effectiveness** - Measure and improve
+- **Review regularly** - Controls degrade over time
+
+### Don'ts
+
+- **Don't rely on single controls** - Single points of failure
+- **Don't ignore cost** - ROI matters
+- **Don't skip testing** - Untested controls may fail
+- **Don't set and forget** - Continuous improvement
+- **Don't ignore people/process** - Technology alone isn't enough
+
+## Common Control Mappings
+
+| Threat | Primary Controls | Secondary Controls |
+|--------|-----------------|-------------------|
+| SQL Injection | Input validation, Parameterized queries | WAF, Least privilege |
+| XSS | Output encoding, CSP | WAF, Input validation |
+| CSRF | CSRF tokens | Same-site cookies |
+| Auth bypass | MFA, Session management | Rate limiting, Logging |
+| Data breach | Encryption, Access controls | DLP, Monitoring |
+| DDoS | Rate limiting, CDN | DDoS protection, Scaling |
+
+## Related Skills
+
+- `stride-analysis` - For threat identification
+- `sast-configuration` - For security scanning
+- `security` - For general security practices