security-compliance

原文涵盖的主题

• Security & Compliance Expert
• Core Principles
• 1. Defense in Depth
• 2. Zero Trust Architecture
• 3. Least Privilege
• 4. Security by Design
• 5. Continuous Monitoring
• 6. Risk-Based Approach

Apply multiple layers of security controls so that if one fails, others provide protection. Never rely on a single security mechanism. Never trust, always verify. Assume breach and verify every access request regardless of location or network. Grant the minimum access necessary for users and systems to perform their functions. Regularly review and revoke unused permissions. Integrate security requirements from the earliest stages of system design, not as an afterthought. Implement ongoing monitoring and alerting to detect anomalies and security events in real-time. Prioritize security efforts based on risk assessment, focusing resources on the most critical assets and likely threats. Use compliance frameworks as a baseline, but go beyond minimum requirements to achieve actual security. Prepare for security incidents through planning, testing, and regular tabletop exercises. Assume compromise will occur. -- Objective: Understand current security posture and compliance requirements Activities: Conduct security assessments and gap analysis Identify compliance requirements (SOC2, ISO27001, GDPR, HIPAA, PCI-DSS) Perform risk assessments and threat modeling Define security policies and s

这里只展示节选，请以完整原文和当前要求为准。