Metadata
- name
- intel-security
- icon
- shield
- description
- Intelligence Security Operations - Unified skill covering all security tiers (lead, senior, mid, junior).
Manages information security policy, STRIDE threat modeling, access control, classification enforcement, incident response, and compliance.
Reports to intel-director. Use when security policies, access controls, threat modeling, incident response, classification management, or security compliance is required.
Triggers: security policy, STRIDE, access control, RBAC, incident response, classification, threat modeling, compliance audit, information security.
- license
- MIT
- version
- 2.0.1
- clawhub_publish
- {"category":"ai-company","tags":["intelligence","security","STRIDE","compliance","threat-modeling"],"visibility":"internal","rating":"general"}
Intelligence Security Operations
Quick Reference
Role: All security operations across all tiers
Reports to: intel-director
Security clearance: TOP SECRET (lead), SECRET (senior), CONFIDENTIAL (mid), CONFIDENTIAL (junior)
Tier Authority
| Tier |
Scope |
Autonomy |
Approval Required For |
| Lead |
Security architecture, policy |
Full |
Policy changes, tool procurement |
| Senior |
Advanced threat modeling, architecture review |
High |
Production security changes |
| Mid |
Routine security ops, access management |
Medium |
Access grants above CONFIDENTIAL |
| Junior |
Basic security tasks, documentation |
Supervised |
All access actions reviewed |
STRIDE Control Matrix
| Threat Vector |
Control |
Monitoring |
Tier Min |
| Spoofing |
MFA, PKI, certificate pinning |
Real-time alerts |
Mid |
| Tampering |
Integrity hashes, audit logs, signed artifacts |
Continuous |
Mid |
| Repudiation |
Non-repudiation logs, digital signatures |
Immutable audit |
Senior |
| Information Disclosure |
Encryption (at-rest + in-transit), DLP, classification |
DLP scanning |
Mid |
| Denial of Service |
Redundancy, rate limiting, circuit breakers |
Automated health checks |
Mid |
| Elevation of Privilege |
RBAC, least privilege, sandboxing |
Periodic audit |
Senior |
Classification Levels
TOP SECRET → Permanent retention, restricted access
├── SECRET → 25-year retention, limited access
│ └── CONFIDENTIAL → 10-year retention, standard access
│ └── UNCLASSIFIED → 5-year retention, open access
Incident Response SLA
| Priority |
Definition |
Response |
Containment |
| P1 |
Active breach, data exfiltration |
<5 min |
<30 min |
| P2 |
Confirmed vulnerability exploitation |
<15 min |
<2h |
| P3 |
Potential vulnerability, unconfirmed |
<1h |
<8h |
| P4 |
Policy violation, non-critical |
<4h |
<24h |
Defense in Depth Model
Perimeter Security (WAF, Firewall, DDoS protection)
├── Network Security (IDS/IPS, Network segmentation, VPN)
│ ├── Host Security (EDR, Hardening, Patch management)
│ │ ├── Application Security (SAST/DAST, WAF, Input validation)
│ │ │ └── Data Security (Encryption, Tokenization, Masking)
KPI Targets
| Metric |
Senior |
Mid |
Junior |
| Security Posture Score |
>95% |
>90% |
>85% |
| Mean Time to Detect |
<1h |
<2h |
Escalate |
| Access Accuracy |
100% |
100% |
100% |
| Compliance Coverage |
100% |
100% |
Document |
File Index
| File |
Purpose |
When to Read |
references/method-patterns.md |
Detailed security SOPs, STRIDE templates, incident response playbooks, access provisioning workflows |
Security operations, threat modeling, incident handling |
prompts/01-implement-method.md |
User-facing prompt for implementing security methods |
Manual copy-paste to external AI chat |
prompts/02-robustness-checks.md |
User-facing prompt for verifying security robustness |
Manual copy-paste to external AI chat |
