defensible-pci-frameworks - Threat-oriented defensive frameworks reorganizing

项目说明

Defensible PCI DSS v4.0.1 Frameworks

!License: MIT
!PCI DSS
!Frameworks
!Status

Reorganizing 272 requirements by threat category so you can build actual defense, not just tick compliance boxes.

What This Is

A complete reorganization of PCI DSS v4.0.1's 272 requirements into 12 threat-based defensi. Each framework:

Why This Matters

PCI DSS compliance doesn't prevent breaches. Security teams that understand how requirements combine to defeat specific attacks build more effecti. This repository transforms compliance checkbox exercise into strategic security architecture.

Example: PCI DSS Requirement 8.3.1 requires MFA for administrati. That's a checkbox. The Phishing Attack Defense Framework shows how MFA (Layer 3) combines with user training (Layer 1), email filtering (Layer 2), and beha monitoring (Layer 4) to create comprehensi defense. It provides metrics (phishing click rates <5% after 6 months) and real-world examples (Google's zero successful phishing attacks over 2 years with hardware tokens + training).

The 12 Defensi

1. Phishing Attack Defense - Email filtering, training, MFA, beha detection
2. Insider Threat Defense - Access controls, activity monitoring, pri action auditing
3. Data Exfiltration Pre - Network segmentation, DLP, encryption, egress monitoring
4. DoS Attack Mitigation - Traffic monitoring, rate limiting, capacity planning, failover
5. Zero-Day Response - Patch management, WAF, IDS/IPS, incident response
6. Third-Party Risk - Due diligence, contracts, monitoring, compliance
7. System Hardening - Secure configuration, minimal services, FIM, change management
8. Authentication & Authorization - Identity management, MFA, RBAC, lifecycle management
9. Encryption & Key Management - Data-at-rest, data-in-transit, key lifecycle, HSM
10. Physical Security - Facility access, sur, media destruction, device tampering
11. Policy & Go - Policy documentation, procedures, incident response, compliance
12. Security Training - Baseline awareness, role-specific training, simulations, measurement

Repository Structure

| Path | Description | Link |
|:-----|:------------|:----:|
| Root | | |
| ├── README.md | Main documentation and getting started guide | 📄 |
| ├── CONTRIBUTING.md | Contribution guidelines | 📄 |
| ├── CHANGELOG.md | history and releases | 📄 |
| ├── LICENSE | MIT License | 📄 |
| docs/ | Core documentation | |
| ├── 00-introduction.md | O and philosophy | 📄 |
| ├── 01-executi.md | Business case and ROI | 📄 |
| ├── 02-framework-architecture.md | How frameworks interconnect | 📄 |
| ├── 98-closing-summary.md | Implementation guidance | 📄 |
| ├── 99-glossary.md | Terms and definitions | 📄 |
| └── addendum-platform0.md | Platform0 reference implementation | 📄 |
| docs/frameworks/ | 12 defensi | |
| ├── phishing-defense.md | Email filtering, training, MFA, detection | 📄 |
| ├── insider-threat-defense.md | Access controls, monitoring, auditing | 📄 |
| ├── data-exfiltration-pre.md | Network segmentation, DLP, encryption | 📄 |
| ├── dos-attack-mitigation.md | Traffic monitoring, rate limiting, failover | 📄 |
| ├── zero-day-response.md | Patch management, WAF, incident response | 📄 |
| ├── .md | Due diligence, contracts, monitoring | 📄 |
| ├── system-hardening.md | Secure config, minimal services, FIM | 📄 |
| ├── authentication-authorization.md | Identity management, MFA, RBAC | 📄 |
| ├── encryption-key-mgmt.md | Data-at-rest, data-in-transit, key lifecycle | 📄 |
| ├── physical-security.md | Facility access, sur, media destruction | 📄 |
| ├── policy-go.md | Policy documentation, procedures, compliance | 📄 |
| └── security-training.md | Awareness training, simulations, measurement | 📄 |

Quick Start

For Security Teams

1. Start with your biggest threat: If phishing is your primary concern, read phishing-defense.md first
2. Identify gaps: Compare your controls against the framework's 4-layer architecture
3. Prioritize implementation: Use the implementation sequence and timeline
4. Measure effecti: Track the metrics that matter

For Compliance Teams

1. Map existing controls: Each framework shows which PCI DSS requirements it addresses
2. Identify control gaps: Missing requirements become obvious when as incomplete defenses
3. Explain to auditors: "We implement MFA as part of our phishing defense strategy" is more defensible than "We do it because requirement 8.3.1 says so"

For Executives

Read:

1. 00-introduction.md - What and why
2. 01-executi.md - Business case
3. 98-closing-summary.md - Implementation approach and ROI

Real-World Impact

Traditional compliance approach:

Defensi approach:

Who This Is For

Optional: Platform0 Reference Implementation

The addendum-platform0.md demonstrates how these frameworks can be implemented as platform capabilities rather than application responsibilities. Platform0 is a Docker-first, stack-agnostic de platform that implements 8 of 12 frameworks as built-in patterns.

Platform0 provides:

Platform0 is optional - the frameworks are implementation-agnostic and regardless of your technology stack.

Contributing

Contributions welcome! See CONTRIBUTING.md for guidelines.

Especially :

License

MIT License - See LICENSE for details.

These frameworks are based on publicly a PCI DSS v4.0.1 requirements published by PCI Security Standards Council. This repository provides interpretation and implementation guidance, not the official standard.

Changelog

See CHANGELOG.md for history.

Acknowledgments

Get Started

Begin with: Introduction to Defensi

Or jump directly to the framework addressing your biggest threat.

项目信息

开发语言：未知

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Threat-oriented defensive frameworks reorganizing PCI DSS v4.0.1 requirements by attack type rather than compliance checklist. Educational guide for security professionals implementing strategic layered defense.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。