网络安全
渗透测试、安全审计、防护加固等网络安全提示词
552 个提示词
- MTTR (mean time to respond) by severity - Containment time - Recovery time -…
Response metrics
- MTTD (mean time to detect) by severity - Alert volume and fidelity (true positive…
Detection metrics
- Patch compliance (critical within SLA, by severity) - MFA enrollment rate (per system,…
Prevention metrics
- Policy compliance rate - Training completion and assessment scores - Risk register…
Governance metrics
- KPIs (reporting rate, click rate, completion rate, sentiment) - Department-level…
Measurement and improvement
- Phishing simulations (calibrated to sophistication) - Gamification and recognition…
Continuous engagement
- Developers: secure coding, secrets management, supply chain - IT ops: hardening,…
Role-based training
- Onboarding security module (mandatory) - Annual refresher (role-based content) -…
General audience training
- Phishing simulation results - Knowledge assessment quiz - Behavioral metrics…
Baseline assessment
设计企业安全意识培训项目,涵盖通用培训、角色培训和持续教育。
Security Awareness Training Program Design
- Timeline and TTP mapping to MITRE ATT&CK - Detection coverage heatmap - Critical…
Reporting
- Blue team alerting analysis (what fired, what missed) - Response time measurement -…
Detection and response measurement
- Initial access strategy (3-5 vectors with fallback) - Persistence mechanisms…
Attack execution plan (aligned to threat actor TTPs)
- OSINT on target (LinkedIn, public docs, GitHub, job postings) - Technology stack…
Intelligence preparation
- Scope and rules of engagement - Success criteria and boundaries - Communication…
Pre-engagement
规划红队演练,模拟高级威胁行为者,测试检测和响应能力。
Red Team Engagement Plan
- Backup architecture (3-2-1, immutable, tested) - Disaster recovery and BCP -…
Resilience and recovery
- SIEM architecture and data sources - SOAR automation maturity - Threat hunting…
Monitoring and response
- EDR/XDR coverage and maturity - Mobile device management (MDM) strategy - Server…
Endpoint and workload
- Secure SDLC integration (SAST, DAST, SCA, IaC scanning) - API security gateway and…
Application security
- Data classification and labeling - Encryption strategy (at rest, in transit, in use)…
Data protection
- Segmentation strategy (macro and micro) - Zero trust network access (ZTNA) deployment…
Network security
- Identity provider and federation strategy - MFA coverage and phishing-resistant…
Identity and access
审查企业安全架构,评估纵深防御、零信任、合规和可扩展性。