| name | security-scanning-threat-mitigation-mapping |
| description | Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness. Use when: the task directly matches threat mitigation mapping responsibilities within plugin security-scanning. Do not use when: a more specific framework or task-focused skill is clearly a better match. |
Security Scanning Threat Mitigation Mapping
Scope
- Use when: the task directly matches threat mitigation mapping responsibilities within plugin security-scanning.
- Do not use when: a more specific framework or task-focused skill is clearly a better match.
Shared Plugin Context
See references/plugin-context.md.
Source
- Converted from
~/code/agents/plugins/security-scanning/skills/threat-mitigation-mapping/SKILL.md
Instructions
Threat Mitigation Mapping
Connect threats to controls for effective security planning.
When to Use This Skill
- Prioritizing security investments
- Creating remediation roadmaps
- Validating control coverage
- Designing defense-in-depth
- Security architecture review
- Risk treatment planning
Core Concepts
1. Control Categories
Preventive ────► Stop attacks before they occur
│ (Firewall, Input validation)
│
Detective ─────► Identify attacks in progress
│ (IDS, Log monitoring)
│
Corrective ────► Respond and recover from attacks
(Incident response, Backup restore)
2. Control Layers
| Layer | Examples |
|---|
| Network | Firewall, WAF, DDoS protection |
| Application | Input validation, authentication |
| Data | Encryption, access controls |
| Endpoint | EDR, patch management |
| Process | Security training, incident response |
3. Defense in Depth
┌──────────────────────┐
│ Perimeter │ ← Firewall, WAF
│ ┌──────────────┐ │
│ │ Network │ │ ← Segmentation, IDS
│ │ ┌────────┐ │ │
│ │ │ Host │ │ │ ← EDR, Hardening
│ │ │ ┌────┐ │ │ │
│ │ │ │App │ │ │ │ ← Auth, Validation
│ │ │ │Data│ │ │ │ ← Encryption
│ │ │ └────┘ │ │ │
│ │ └────────┘ │ │
│ └──────────────┘ │
└──────────────────────┘
Templates
Template 1: Mitigation Model
from dataclasses import dataclass, field
from enum import Enum
from typing import List, Dict, Optional, Set
from datetime import datetime
class ControlType(Enum):
PREVENTIVE = "preventive"
DETECTIVE = "detective"
CORRECTIVE = "corrective"
class ControlLayer(Enum):
NETWORK = "network"
APPLICATION = "application"
DATA = "data"
ENDPOINT = "endpoint"
PROCESS = "process"
PHYSICAL = "physical"
class ImplementationStatus(Enum):
NOT_IMPLEMENTED = "not_implemented"
PARTIAL = "partial"
IMPLEMENTED = "implemented"
VERIFIED = "verified"
class Effectiveness(Enum):
NONE = 0
LOW = 1
MEDIUM = 2
HIGH = 3
VERY_HIGH = 4
@dataclass
class SecurityControl:
id: str
name: str
description: str
control_type: ControlType
layer: ControlLayer
effectiveness: Effectiveness
implementation_cost:
maintenance_cost:
status: ImplementationStatus = ImplementationStatus.NOT_IMPLEMENTED
mitigates_threats: [] = field(default_factory=)
dependencies: [] = field(default_factory=)
technologies: [] = field(default_factory=)
compliance_refs: [] = field(default_factory=)
() -> :
status_multiplier = {
ImplementationStatus.NOT_IMPLEMENTED: ,
ImplementationStatus.PARTIAL: ,
ImplementationStatus.IMPLEMENTED: ,
ImplementationStatus.VERIFIED: ,
}
.effectiveness.value * status_multiplier[.status]
:
:
name:
category:
description:
impact:
likelihood:
risk_score:
:
threat: Threat
controls: [SecurityControl]
residual_risk: =
notes: =
() -> :
.controls:
total_score = (c.coverage_score() c .controls)
max_possible = (.controls) * Effectiveness.VERY_HIGH.value
(total_score / max_possible) * max_possible >
() -> :
layers = (c.layer c .controls c.status != ImplementationStatus.NOT_IMPLEMENTED)
(layers) >=
() -> :
types = (c.control_type c .controls c.status != ImplementationStatus.NOT_IMPLEMENTED)
(types) >=
:
name:
threats: [Threat] = field(default_factory=)
controls: [SecurityControl] = field(default_factory=)
mappings: [MitigationMapping] = field(default_factory=)
() -> [Threat]:
mapped_ids = {m.threat. m .mappings}
[t t .threats t. mapped_ids]
() -> [, ]:
{
m.threat.: m.calculate_coverage()
m .mappings
}
() -> []:
gaps = []
mapping .mappings:
coverage = mapping.calculate_coverage()
coverage < :
gaps.append({
: mapping.threat.,
: mapping.threat.name,
: coverage,
: ,
:
})
mapping.has_defense_in_depth():
gaps.append({
: mapping.threat.,
: mapping.threat.name,
: coverage,
: ,
:
})
mapping.has_control_diversity():
gaps.append({
: mapping.threat.,
: mapping.threat.name,
: coverage,
: ,
:
})
gaps
Template 2: Control Library
class ControlLibrary:
"""Library of standard security controls."""
STANDARD_CONTROLS = {
"AUTH-001": SecurityControl(
id="AUTH-001",
name="Multi-Factor Authentication",
description="Require MFA for all user authentication",
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.APPLICATION,
effectiveness=Effectiveness.HIGH,
implementation_cost="Medium",
maintenance_cost="Low",
mitigates_threats=["SPOOFING"],
technologies=["TOTP", "WebAuthn", "SMS OTP"],
compliance_refs=["PCI-DSS 8.3", "NIST 800-63B"]
),
"AUTH-002": SecurityControl(
id="AUTH-002",
name="Account Lockout Policy",
description="Lock accounts after failed authentication attempts",
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.APPLICATION,
effectiveness=Effectiveness.MEDIUM,
implementation_cost="Low",
maintenance_cost="Low",
mitigates_threats=["SPOOFING"],
technologies=["Custom implementation"],
compliance_refs=["PCI-DSS 8.1.6"]
),
"VAL-001": SecurityControl(
id="VAL-001",
name="Input Validation Framework",
description="Validate and sanitize all user input",
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.APPLICATION,
effectiveness=Effectiveness.HIGH,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[, ],
technologies=[, , ],
compliance_refs=[]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.NETWORK,
effectiveness=Effectiveness.MEDIUM,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[, , ],
technologies=[, , ],
compliance_refs=[]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.DATA,
effectiveness=Effectiveness.HIGH,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[],
technologies=[, , ],
compliance_refs=[, ]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.NETWORK,
effectiveness=Effectiveness.HIGH,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[, ],
technologies=[, ],
compliance_refs=[, ]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.DETECTIVE,
layer=ControlLayer.APPLICATION,
effectiveness=Effectiveness.MEDIUM,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[],
technologies=[, , ],
compliance_refs=[, ]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.DATA,
effectiveness=Effectiveness.MEDIUM,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[, ],
technologies=[, ],
compliance_refs=[]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.APPLICATION,
effectiveness=Effectiveness.HIGH,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[, ],
technologies=[, , ],
compliance_refs=[, ]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.APPLICATION,
effectiveness=Effectiveness.MEDIUM,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[],
technologies=[, , ],
compliance_refs=[]
),
: SecurityControl(
=,
name=,
description=,
control_type=ControlType.PREVENTIVE,
layer=ControlLayer.NETWORK,
effectiveness=Effectiveness.HIGH,
implementation_cost=,
maintenance_cost=,
mitigates_threats=[],
technologies=[, , ],
compliance_refs=[]
),
}
() -> [SecurityControl]:
[
c c .STANDARD_CONTROLS.values()
threat_category c.mitigates_threats
]
() -> [SecurityControl]:
[c c .STANDARD_CONTROLS.values() c.layer == layer]
() -> [SecurityControl]:
.STANDARD_CONTROLS.get(control_id)
() -> [SecurityControl]:
available = .get_controls_for_threat(threat.category)
[c c available c. existing_controls]
Template 3: Mitigation Analysis
class MitigationAnalyzer:
"""Analyze and optimize mitigation strategies."""
def __init__(self, plan: MitigationPlan, library: ControlLibrary):
self.plan = plan
self.library = library
def calculate_overall_risk_reduction(self) -> float:
"""Calculate overall risk reduction percentage."""
if not self.plan.mappings:
return 0.0
weighted_coverage = 0
total_weight = 0
for mapping in self.plan.mappings:
weight = mapping.threat.risk_score
coverage = mapping.calculate_coverage()
weighted_coverage += weight * coverage
total_weight += weight
return weighted_coverage / total_weight if total_weight > 0 else 0
def get_critical_gaps(self) -> List[Dict]:
"""Find critical gaps that need immediate attention."""
gaps = self.plan.get_gaps()
critical_threats = {t.id for t in self.plan.threats if t.impact == "Critical"}
return [g g gaps g[] critical_threats]
() -> [SecurityControl]:
recommended = []
remaining_budget = budget
unmapped = .plan.get_unmapped_threats()
all_controls = (.library.STANDARD_CONTROLS.values())
controls_with_value = []
control all_controls:
control.status == ImplementationStatus.NOT_IMPLEMENTED:
cost = cost_map.get(control., ())
cost <= remaining_budget:
threats_covered = ([
t t unmapped
t.category control.mitigates_threats
])
threats_covered > :
value = (threats_covered * control.effectiveness.value) / cost
controls_with_value.append((control, value, cost))
controls_with_value.sort(key= x: x[], reverse=)
control, value, cost controls_with_value:
cost <= remaining_budget:
recommended.append(control)
remaining_budget -= cost
recommended
() -> []:
roadmap = []
gaps = .plan.get_gaps()
phase1 = []
gap gaps:
mapping = (
(m m .plan.mappings m.threat. == gap[]),
)
mapping mapping.threat.impact == :
controls = .library.get_controls_for_threat(mapping.threat.category)
phase1.extend([
{
: gap[],
: c.,
: c.name,
: ,
:
}
c controls
c.status == ImplementationStatus.NOT_IMPLEMENTED
])
roadmap.extend(phase1[:])
phase2 = []
gap gaps:
mapping = (
(m m .plan.mappings m.threat. == gap[]),
)
mapping mapping.threat.impact == :
controls = .library.get_controls_for_threat(mapping.threat.category)
phase2.extend([
{
: gap[],
: c.,
: c.name,
: ,
:
}
c controls
c.status == ImplementationStatus.NOT_IMPLEMENTED
])
roadmap.extend(phase2[:])
roadmap
() -> [, []]:
layer_coverage = {layer.value: [] layer ControlLayer}
mapping .plan.mappings:
control mapping.controls:
control.status [ImplementationStatus.IMPLEMENTED, ImplementationStatus.VERIFIED]:
layer_coverage[control.layer.value].append(control.)
layer_coverage
() -> :
risk_reduction = .calculate_overall_risk_reduction()
gaps = .plan.get_gaps()
critical_gaps = .get_critical_gaps()
layer_coverage = .defense_in_depth_analysis()
report =
report
() -> :
lines = []
layer, controls coverage.items():
status = controls
lines.append()
.join(lines)
() -> :
gaps:
lines = []
gap gaps:
lines.append()
lines.append()
lines.append()
.join(lines)
() -> :
recommendations = []
layer_coverage = .defense_in_depth_analysis()
layer, controls layer_coverage.items():
controls:
recommendations.append()
gaps = .plan.get_gaps()
(g[] == g gaps):
recommendations.append()
.join(recommendations) recommendations
() -> :
roadmap = .generate_roadmap()
roadmap:
lines = []
current_phase =
item roadmap:
item[] != current_phase:
current_phase = item[]
lines.append()
lines.append()
.join(lines)
Template 4: Control Effectiveness Testing
from dataclasses import dataclass
from typing import List, Callable, Any
import asyncio
@dataclass
class ControlTest:
control_id: str
test_name: str
test_function: Callable[[], bool]
expected_result: bool
description: str
class ControlTester:
"""Test control effectiveness."""
def __init__(self):
self.tests: List[ControlTest] = []
self.results: List[Dict] = []
def add_test(self, test: ControlTest) -> None:
self.tests.append(test)
async def run_tests(self) -> List[Dict]:
"""Run all control tests."""
self.results = []
for test in self.tests:
try:
result = test.test_function()
passed = result == test.expected_result
self.results.append({
"control_id": test.control_id,
: test.test_name,
: passed,
: result,
: test.expected_result,
: test.description,
:
})
Exception e:
.results.append({
: test.control_id,
: test.test_name,
: ,
: ,
: test.expected_result,
: test.description,
: (e)
})
.results
() -> :
control_results = [r r .results r[] == control_id]
control_results:
passed = ( r control_results r[])
(passed / (control_results)) *
() -> :
.results:
total = (.results)
passed = ( r .results r[])
report =
controls = {}
result .results:
cid = result[]
cid controls:
controls[cid] = []
controls[cid].append(result)
control_id, results controls.items():
score = .get_effectiveness_score(control_id)
report +=
r results:
status = r[]
report +=
r[]:
report +=
report
Best Practices
Do's
- Map all threats - No threat should be unmapped
- Layer controls - Defense in depth is essential
- Mix control types - Preventive, detective, corrective
- Track effectiveness - Measure and improve
- Review regularly - Controls degrade over time
Don'ts
- Don't rely on single controls - Single points of failure
- Don't ignore cost - ROI matters
- Don't skip testing - Untested controls may fail
- Don't set and forget - Continuous improvement
- Don't ignore people/process - Technology alone isn't enough
Resources
