“网络安全”

CI/CD security

Threat Modeling Workshop Facilitation

主持威胁建模工作坊,使用STRIDE/Attack Tree/PASTA方法识别系统威胁。

System decomposition

Threat identification

Risk assessment

Mitigation design

Documentation and tracking

Security Incident Response Plan Generator

生成安全事件响应计划,涵盖准备、检测、遏制、根除、恢复和事后分析阶段。

Preparation

Detection and analysis

Containment, eradication, recovery

Post-incident activity

Purple Team Exercise Design

设计紫队演练,协调红队攻击和蓝队检测,验证防御有效性。

Planning and scoping

Attack scenarios (select 10-15 techniques across tactics)

Execution methodology

Detection validation

Reporting

Security Architecture Review

审查企业安全架构,评估纵深防御、零信任、合规和可扩展性。

Identity and access