Bộ mẫu kỹ thuật bảo mật
Mô hình mối đe dọa (STRIDE, LINDDUN), cây tấn công, kiến trúc bảo mật, lập trình an toàn, chuỗi cung ứng (SLSA, SBOM), đánh giá ASVS 5.0 và báo cáo pentest.
Mô hình mối đe dọa
Threat Model Template (STRIDE)
Đầy đủSTRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance
STRIDEPrivacy Threat Model Template (LINDDUN)
Đầy đủPrivacy threat model by LINDDUN category: DFD with trust boundaries, data inventory, elicitation matrix, register, PETs, DPIA link
LINDDUN (threat categories)Attack Tree Analysis Template
ChuẩnAttack tree for one attacker goal: AND/OR tree as list and Mermaid, leaf cost/skill/likelihood, path analysis, countermeasures
Schneier attack trees
Thiết kế
Security Architecture Document Template (NIST SP 800-160, STRIDE)
Đầy đủSecurity architecture: assets, trust boundaries, STRIDE threat register, requirements, IAM, data protection, detection, residual risk
NIST SP 800-160 Vol. 1, STRIDESecure Coding Standard Template
ChuẩnSecure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
Software Supply Chain Security Assessment Template (SLSA)
Đầy đủSupply chain assessment: SLSA 1.2 Build/Source levels, SBOM (SPDX, CycloneDX), provenance, Sigstore, Scorecard, VEX, CI/CD
SLSA 1.2
Kiểm chứng
Security Design Review Template (OWASP ASVS 5.0)
Đầy đủDesign-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 4.0Penetration Test Report Template (PTES, OWASP WSTG)
Đầy đủPentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide