Back to Details

white-hat

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

White Hat

白帽黑客

Build robust defensive security capabilities, implement security by design principles, and practice ethical hacking to proactively protect systems, data, and users while maintaining ethics and compliance.
构建强大的防御性安全能力，落实设计即安全原则，践行道德黑客技术，在恪守道德规范与合规要求的前提下，主动保护系统、数据及用户安全。

When to use me

适用场景

Use this skill when:
  • Designing new systems with security requirements
  • Implementing security controls and defensive measures
  • Conducting authorized security testing and assessments
  • Responding to security incidents with defensive tactics
  • Building security awareness and training programs
  • Implementing compliance and regulatory requirements
  • Developing security architecture and design patterns
  • Creating incident response plans and procedures
  • Establishing security monitoring and detection capabilities
  • Performing security code reviews and architectural analysis
在以下场景中使用本技能：
  • 设计带有安全需求的新系统时
  • 实施安全控制与防御措施时
  • 开展经授权的安全测试与评估时
  • 采用防御策略响应安全事件时
  • 构建安全意识与培训体系时
  • 落实合规与监管要求时
  • 开发安全架构与设计模式时
  • 制定事件响应计划与流程时
  • 搭建安全监控与检测能力时
  • 开展安全代码审查与架构分析时

What I do

核心能力

1. Security by Design

1. 设计即安全

  • Integrate security from initial design through implementation
  • Apply security principles (least privilege, defense in depth, fail safe)
  • Implement secure defaults that protect even when misconfigured
  • Design for security rather than bolting it on later
  • Consider security trade-offs explicitly during design decisions
  • 从初始设计到落地实施全程融入安全
  • 应用安全原则（最小权限、纵深防御、故障安全）
  • 实施安全默认配置，即使在配置错误时也能提供防护
  • 为安全而设计，而非事后补充安全措施
  • 在设计决策中明确考量安全取舍

2. Defensive Security Implementation

2. 防御性安全落地

  • Build protective controls that prevent, detect, and respond
  • Implement security layers (network, host, application, data)
  • Establish security monitoring and logging
  • Deploy detection capabilities for security incidents
  • Create response mechanisms for security events
  • 构建具备预防、检测与响应能力的防护控制措施
  • 实施多层安全防护（网络、主机、应用、数据层面）
  • 搭建安全监控与日志体系
  • 部署安全事件检测能力
  • 构建安全事件响应机制

3. Ethical Security Testing

3. 道德安全测试

  • Conduct authorized testing with proper scope and rules
  • Use security tools responsibly and ethically
  • Report findings constructively with remediation guidance
  • Respect privacy and confidentiality during testing
  • Follow responsible disclosure practices for vulnerabilities
  • 在合规范围内开展经授权的测试
  • 负责任且合乎道德地使用安全工具
  • 建设性地报告测试结果并提供修复指导
  • 测试过程中尊重隐私与保密原则
  • 遵循漏洞负责任披露准则

4. Security Culture Building

4. 安全文化建设

  • Promote security awareness across the organization
  • Train developers in secure coding practices
  • Establish security champions within development teams
  • Create security documentation and guidelines
  • Foster collaboration between security and development teams
  • 在全组织范围内提升安全意识
  • 培训开发者掌握安全编码实践
  • 在开发团队中设立安全大使
  • 制定安全文档与指南
  • 促进安全团队与开发团队的协作

White Hat Techniques

白帽黑客技术

Security Architecture & Design:

安全架构与设计：

  • Threat modeling to identify and address risks early
  • Security design patterns for common security problems
  • Secure architecture reviews before implementation
  • Compliance by design integrating regulatory requirements
  • Privacy by design protecting user data from inception
  • 威胁建模，尽早识别并应对风险
  • 针对常见安全问题的安全设计模式
  • 落地前开展安全架构审查
  • 设计即合规，融入监管要求
  • 设计即隐私，从源头保护用户数据

Defensive Implementation:

防御性落地：

  • Input validation and sanitization
  • Output encoding to prevent injection attacks
  • Authentication and authorization implementation
  • Cryptography proper usage and key management
  • Security headers and HTTP security controls
  • Error handling that doesn't leak information
  • 输入验证与清洗
  • 输出编码，防止注入攻击
  • 身份认证与权限控制落地
  • 密码学的正确应用与密钥管理
  • 安全头与HTTP安全控制
  • 不泄露信息的错误处理机制

Security Testing & Validation:

安全测试与验证：

  • Static application security testing (SAST)
  • Dynamic application security testing (DAST)
  • Software composition analysis (SCA) for dependencies
  • Interactive application security testing (IAST)
  • Manual security code review
  • Penetration testing (authorized, scoped)
  • 静态应用安全测试（SAST）
  • 动态应用安全测试（DAST）
  • 针对依赖项的软件成分分析（SCA）
  • 交互式应用安全测试（IAST）
  • 人工安全代码审查
  • 渗透测试（经授权、限定范围）

Monitoring & Response:

监控与响应：

  • Security information and event management (SIEM)
  • Intrusion detection systems (IDS)
  • Endpoint detection and response (EDR)
  • Log management and security analytics
  • Incident response planning and execution
  • Forensic capability development
  • 安全信息与事件管理（SIEM）
  • 入侵检测系统（IDS）
  • 终端检测与响应（EDR）
  • 日志管理与安全分析
  • 事件响应计划制定与执行
  • 取证能力建设

Examples

示例

bash
undefined
bash
undefined

Conduct threat modeling for new feature

Conduct threat modeling for new feature

npm run white-hat:threat-model -- --feature "user-payment" --method STRIDE
npm run white-hat:threat-model -- --feature "user-payment" --method STRIDE

Perform secure code review

Perform secure code review

npm run white-hat:code-review -- --path src/payment/ --tools "sonarqube,checkmarx"
npm run white-hat:code-review -- --path src/payment/ --tools "sonarqube,checkmarx"

Implement security controls

Implement security controls

npm run white-hat:implement-controls -- --control "input-validation" --framework express
npm run white-hat:implement-controls -- --control "input-validation" --framework express

Run authorized security testing

Run authorized security testing

npm run white-hat:security-test -- --target staging.example.com --scope web-application
npm run white-hat:security-test -- --target staging.example.com --scope web-application

Build incident response plan

Build incident response plan

npm run white-hat:incident-response -- --scenario "data-breach" --output plan.md
undefined
npm run white-hat:incident-response -- --scenario "data-breach" --output plan.md
undefined

Output format

输出格式

White Hat Security Assessment
──────────────────────────────
System: Healthcare Patient Portal
Assessment Date: 2026-02-26
Assessment Type: Proactive Security Review
White Hat Lead: Ethical Defender #3

Security Posture Summary:
- Security Maturity Level: 6.2/10 (Developing)
- Compliance Status: 85% HIPAA aligned
- Critical Security Gaps: 4
- Immediate Risks: 2
- Security Debt: Medium (accumulating)

Security by Design Assessment:

1. Feature: Patient Medical Record Access
   Design Security Score: 7.8/10
   
   Security Controls Implemented:
   - Role-based access control (RBAC) with least privilege
   - Audit logging for all access attempts
   - Session management with proper timeout
   - Input validation for search parameters
   - Output encoding for displayed data
   
   Gaps Identified:
   - No geographic access restrictions (can access from anywhere)
   - No device fingerprinting for anomaly detection
   - Consent revocation not immediately effective
   - Bulk export capability lacks rate limiting
   
   Threat Model Results:
   - STRIDE Analysis:
     * Spoofing: Medium risk (weak multi-factor authentication)
     * Tampering: Low risk (data integrity controls strong)
     * Repudiation: Low risk (comprehensive audit logging)
     * Information Disclosure: High risk (data exfiltration possible)
     * Denial of Service: Medium risk (no rate limiting on API)
     * Elevation of Privilege: Low risk (RBAC implementation solid)
   
   Recommendations:
   - Implement geographic access restrictions
   - Add device fingerprinting and anomaly detection
   - Make consent revocation immediate
   - Add rate limiting to bulk export

2. Feature: Doctor-Patient Messaging
   Design Security Score: 6.1/10
   
   Security Controls Implemented:
   - End-to-end encryption for messages
   - Message retention policy (30 days)
   - Attachment scanning for malware
   
   Gaps Identified:
   - No message integrity verification
   - No non-repudiation mechanisms
   - Attachments not scanned for PHI (protected health information)
   - No secure file sharing alternative offered
   - Message threading vulnerable to injection
   
   Threat Model Results:
   - Data-in-transit: Strong (encryption)
   - Data-at-rest: Weak (attachments stored unencrypted)
   - Authentication: Medium (session-based, no step-up for sensitive)
   - Authorization: Weak (no message-level permissions)
   
   Recommendations:
   - Implement digital signatures for message integrity
   - Add PHI detection for attachments
   - Offer secure file sharing as alternative
   - Add message-level authorization checks

Defensive Security Implementation Review:

1. Authentication System:
   Implementation Quality: 8.4/10
   
   Strengths:
   - Multi-factor authentication implemented
   - Password policy enforces complexity
   - Account lockout after failed attempts
   - Session management with secure flags
   
   Weaknesses:
   - No step-up authentication for sensitive actions
   - Password reset vulnerable to timing attacks
   - Session fixation possible in certain flows
   - No biometric authentication options
   
   Security Test Results:
   - Password cracking resistance: High (>100 years at current hashing)
   - MFA bypass attempts: 0 successful (out of 1000 simulations)
   - Session hijacking: 2 vectors identified (mitigation recommended)

2. Data Protection:
   Implementation Quality: 7.2/10
   
   Strengths:
   - Encryption at rest for database fields
   - Encryption in transit via TLS 1.3
   - Key management using AWS KMS
   - Data classification implemented
   
   Weaknesses:
   - Some PHI in logs (partial mitigation)
   - Backup encryption not consistently applied
   - Data minimization not fully implemented
   - Right to erasure implementation incomplete
   
   Compliance Check:
   - HIPAA: 18/22 requirements met (82%)
   - GDPR: 14/18 requirements met (78%)
   - CCPA: 12/15 requirements met (80%)

Ethical Testing Results:

1. Authorized Penetration Test:
   Scope: Web application, APIs, mobile app
   Duration: 40 hours
   
   Findings:
   - Critical: 0
   - High: 3
   - Medium: 8
   - Low: 12
   - Informational: 15
   
   Notable Findings:
   - API rate limiting insufficient (high)
   - JWT token leakage in logs (medium)
   - Insecure direct object reference (high)
   - Missing security headers (medium)
   
   Remediation Status:
   - Immediate fixes: 3/3 high severity
   - 30-day plan: 6/8 medium severity
   - 90-day plan: 2/8 medium severity + all low severity

2. Security Code Review:
   Lines Reviewed: 45,200
   Security Issues Found: 47
   Issue Density: 1.04 issues/1000 lines
   Industry Average: 1.5 issues/1000 lines
   
   Common Issues:
   - Hardcoded secrets: 3 instances
   - Insufficient input validation: 12 instances
   - Weak cryptographic usage: 2 instances
   - Insecure error handling: 8 instances

Security Monitoring & Response:

1. Detection Capability:
   Coverage: 72%
   Mean Time to Detect (MTTD): 3.2 hours
   Alert Accuracy: 68% (32% false positives)
   
   Gaps:
   - No behavioral anomaly detection
   - Cloud infrastructure monitoring limited
   - Container security monitoring absent
   - API security monitoring basic

2. Response Capability:
   Mean Time to Respond (MTTR): 4.8 hours
   Mean Time to Recover (MTTR): 8.5 hours
   Incident Response Team Readiness: 6.8/10
   
   Improvement Areas:
   - Automated incident response playbooks
   - Better communication templates
   - Regular tabletop exercises
   - Forensic tooling investment

Security Roadmap Recommendations:

1. IMMEDIATE (Next 30 days):
   - Fix 3 high-severity penetration test findings
   - Implement PHI detection for attachments
   - Add geographic access restrictions
   - Conduct security awareness training

2. QUARTER 1 (Next 90 days):
   - Implement step-up authentication
   - Deploy behavioral anomaly detection
   - Complete right to erasure implementation
   - Conduct incident response tabletop exercise

3. QUARTER 2 (Next 180 days):
   - Implement zero trust architecture
   - Deploy container security monitoring
   - Achieve security certification (ISO 27001, SOC 2)
   - Establish bug bounty program

4. LONG-TERM (Next 12 months):
   - Build security operations center (SOC)
   - Implement security chaos engineering
   - Achieve HITRUST certification
   - Establish security metrics program

Security Culture Assessment:
- Developer Security Training: 45% completion
- Security Champion Program: Not established
- Security in Sprint Planning: Occasionally
- Security Tooling Adoption: 60%
- Security Metrics Tracking: Basic

Culture Recommendations:
1. Establish security champion program (1 per 10 developers)
2. Integrate security into sprint planning (security stories)
3. Implement gamified security training
4. Create security metrics dashboard visible to all
5. Regular security brown bags and knowledge sharing

Value Delivered:
- Risk Reduction: Estimated 65% reduction in breach likelihood
- Compliance Improvement: 15% increase in compliance coverage
- Security Maturity: +2.4 points on security maturity model
- Incident Prevention: 3 potential breaches prevented
- Cost Savings: Estimated $2.8M (breach costs avoided)
- Reputation Protection: Maintained patient trust and confidence
白帽黑客安全评估报告
──────────────────────────────
系统：医疗患者门户
评估日期：2026-02-26
评估类型：主动安全审查
白帽负责人：道德防御者#3

安全态势摘要：
- 安全成熟度：6.2/10（发展中）
- 合规状态：符合HIPAA要求的比例为85%
- 严重安全缺口：4个
- 即时风险：2个
- 安全债务：中等（持续累积）

设计即安全评估：

1. 功能：患者病历访问
   设计安全评分：7.8/10
   
   已实施的安全控制措施：
   - 基于角色的访问控制（RBAC），遵循最小权限原则
   - 所有访问尝试的审计日志
   - 带合理超时的会话管理
   - 搜索参数的输入验证
   - 展示数据的输出编码
   
   识别到的缺口：
   - 无地理访问限制（可从任意地点访问）
   - 无设备指纹识别以检测异常
   - 同意撤销无法立即生效
   - 批量导出功能无速率限制
   
   威胁建模结果：
   - STRIDE分析：
     * 仿冒：中等风险（多因素认证强度不足）
     * 篡改：低风险（数据完整性控制措施完善）
     * 抵赖：低风险（审计日志全面）
     * 信息泄露：高风险（存在数据泄露可能性）
     * 拒绝服务：中等风险（API无速率限制）
     * 权限提升：低风险（RBAC落地扎实）
   
   建议：
   - 实施地理访问限制
   - 添加设备指纹识别与异常检测
   - 实现同意撤销即时生效
   - 为批量导出添加速率限制

2. 功能：医患消息
   设计安全评分：6.1/10
   
   已实施的安全控制措施：
   - 消息端到端加密
   - 消息保留策略（30天）
   - 附件恶意软件扫描
   
   识别到的缺口：
   - 无消息完整性验证
   - 无不可抵赖机制
   - 附件未扫描受保护健康信息（PHI）
   - 未提供安全文件共享替代方案
   - 消息线程易受注入攻击
   
   威胁建模结果：
   - 传输中数据：安全（已加密）
   - 静态数据：脆弱（附件未加密存储）
   - 身份认证：中等（基于会话，敏感操作无二次验证）
   - 权限控制：脆弱（无消息级权限）
   
   建议：
   - 为消息完整性实施数字签名
   - 为附件添加PHI检测
   - 提供安全文件共享替代方案
   - 添加消息级权限检查

防御性安全落地审查：

1. 身份认证系统：
   落地质量：8.4/10
   
   优势：
   - 已实施多因素认证
   - 密码策略强制要求复杂度
   - 多次失败尝试后锁定账户
   - 会话管理带有安全标记
   
   劣势：
   - 敏感操作无二次认证
   - 密码重置易受时序攻击
   - 特定流程中存在会话固定风险
   - 无生物识别认证选项
   
   安全测试结果：
   - 密码破解抗性：高（当前哈希算法下需超100年）
   - MFA绕过尝试：1000次模拟均未成功
   - 会话劫持：识别到2个攻击向量（建议修复）

2. 数据保护：
   落地质量：7.2/10
   
   优势：
   - 数据库字段静态加密
   - 通过TLS 1.3实现传输中加密
   - 使用AWS KMS进行密钥管理
   - 已实施数据分类
   
   劣势：
   - 日志中存在部分PHI（已部分修复）
   - 备份加密未统一应用
   - 数据最小化未完全落地
   - 擦除权落地不完整
   
   合规检查：
   - HIPAA：22项要求中满足18项（82%）
   - GDPR：18项要求中满足14项（78%）
   - CCPA：15项要求中满足12项（80%）

道德测试结果：

1. 授权渗透测试：
   范围：Web应用、API、移动应用
   时长：40小时
   
   发现：
   - 严重：0个
   - 高危：3个
   - 中危：8个
   - 低危：12个
   - 信息性：15个
   
   重点发现：
   - API速率限制不足（高危）
   - JWT令牌在日志中泄露（中危）
   - 不安全的直接对象引用（高危）
   - 缺失安全头（中危）
   
   修复状态：
   - 即时修复：3/3个高危漏洞
   - 30天计划：6/8个中危漏洞
   - 90天计划：2/8个中危漏洞 + 所有低危漏洞

2. 安全代码审查：
   审查代码行数：45,200行
   发现安全问题：47个
   问题密度：1.04个/千行
   行业平均：1.5个/千行
   
   常见问题：
   - 硬编码密钥：3处
   - 输入验证不足：12处
   - 密码学应用薄弱：2处
   - 不安全的错误处理：8处

安全监控与响应：

1. 检测能力：
   覆盖范围：72%
   平均检测时间（MTTD）：3.2小时
   告警准确率：68%（32%误报）
   
   缺口：
   - 无行为异常检测
   - 云基础设施监控有限
   - 容器安全监控缺失
   - API安全监控基础薄弱

2. 响应能力：
   平均响应时间（MTTR）：4.8小时
   平均恢复时间（MTTR）：8.5小时
   事件响应团队就绪度：6.8/10
   
   改进方向：
   - 自动化事件响应剧本
   - 优化沟通模板
   - 定期桌面演练
   - 取证工具投入

安全路线图建议：

1. 即时（未来30天）：
   - 修复3个高危渗透测试发现
   - 为附件添加PHI检测
   - 实施地理访问限制
   - 开展安全意识培训

2. 第一季度（未来90天）：
   - 实施二次认证
   - 部署行为异常检测
   - 完成擦除权落地
   - 开展事件响应桌面演练

3. 第二季度（未来180天）：
   - 实施零信任架构
   - 部署容器安全监控
   - 获取安全认证（ISO 27001、SOC 2）
   - 建立漏洞赏金计划

4. 长期（未来12个月）：
   - 搭建安全运营中心（SOC）
   - 实施安全混沌工程
   - 获取HITRUST认证
   - 建立安全指标体系

安全文化评估：
- 开发者安全培训完成率：45%
- 安全大使计划：未建立
- 安全融入 sprint 规划：偶尔
- 安全工具 adoption率：60%
- 安全指标跟踪：基础级

文化建设建议：
1. 建立安全大使计划（每10名开发者配备1名）
2. 将安全融入sprint规划（安全需求故事）
3. 实施游戏化安全培训
4. 创建全员可见的安全指标仪表盘
5. 定期开展安全午餐分享与知识交流

交付价值：
- 风险降低：预计数据泄露可能性降低65%
- 合规提升：合规覆盖范围提升15%
- 安全成熟度：安全成熟度模型得分提升2.4分
- 事件预防：阻止3起潜在数据泄露
- 成本节约：预计避免280万美元的泄露损失
- 声誉保护：维护患者信任与信心

Notes

注意事项

  • White hat security is proactive, not reactive
  • Security is a process, not a product - focus on continuous improvement
  • Balance security with usability and business needs
  • Measure security effectiveness, not just activity
  • Build security culture through education and collaboration
  • Security requires ongoing investment and attention
  • Ethical considerations are paramount in security work
  • Share security knowledge transparently within the organization
  • Learn from security incidents and near-misses
  • Security should enable business, not block it
  • The most effective security is invisible to legitimate users
  • Regular security assessment prevents security debt accumulation
  • 白帽黑客安全是主动防护，而非被动响应
  • 安全是一个持续的过程，而非一次性产品——需聚焦持续改进
  • 平衡安全与易用性及业务需求
  • 衡量安全有效性，而非仅关注活动量
  • 通过培训与协作构建安全文化
  • 安全需要持续的投入与关注
  • 道德考量在安全工作中至关重要
  • 在组织内部透明地共享安全知识
  • 从安全事件与未遂事件中学习
  • 安全应赋能业务，而非阻碍业务
  • 最有效的安全措施对合法用户而言是无感知的
  • 定期安全评估可避免安全债务累积