starter.wiki中文

Decision map

Security

Which concrete application-security control, assurance workflow, proofing process, or vulnerability-detection route addresses the named threat or obligation?

Recommendation

Start with Secrets Management

Application, platform, and security teams choosing controls for credentials, request defense, accountable evidence, identity proofing, security assurance, and vulnerability discovery.

Open the starting decision

Scope

Use this boundary to avoid solving adjacent problems in the wrong layer.

Included

  • Secret lifecycle and credential controls
  • Automated-abuse detection and mitigation
  • Request quotas and rate enforcement
  • HTTP-layer request filtering
  • Security audit trails and log-management requirements
  • Real-world identity proofing and verification
  • Security-control evidence and assurance workflow automation
  • Vulnerability scanning across dependencies, source, containers, and infrastructure as code

Excluded

  • Application authentication and authorization, which belong to Identity
  • Payment transaction fraud, which belongs to Payments
  • General diagnostics, performance telemetry, and operational logging
  • Legal advice, privacy counsel, non-security compliance, certification promises, or guaranteed audit outcomes
  • Penetration testing and complete secure-development programs as synonyms for vulnerability scanning
12789

Important tools

These tools represent distinct routes inside this decision area; open the relevant Task before treating any as a default.

Decision sequence

Make the foundational ownership decisions before adding specialized capabilities.

  1. Is the immediate problem automated behavior, request volume, malicious HTTP patterns, credential exposure, proofing, evidence, or vulnerable artifacts?

    Begin from the protected asset, threat, or assurance obligation rather than a generic security-platform search.

    Bot Protection Rate Limiting Web Application Firewalls Secrets Management Identity Verification Audit Logs Compliance Automation Vulnerability Scanning

  2. Which sensitive credentials require creation, storage, distribution, rotation, revocation, expiration, and audit controls?

    Define the entire secret lifecycle and runtime or CI ownership before choosing a storage product.

    Secrets Management

  3. Does the request-defense problem concern automated actors, quota, or HTTP payload and rule matching?

    Use Bot Protection for automated abuse, Rate Limiting for quotas, and Web Application Firewalls for HTTP-layer rule enforcement; layer controls only when the threat model requires it.

    Bot Protection Rate Limiting Web Application Firewalls

  4. Which security or administrative actions must be attributable, retained, protected, exported, and reviewed?

    Define audit-event and log-management requirements before selecting storage or analytics.

    Audit Logs

  5. Does the product need confidence in real-world identity evidence beyond ordinary account authentication?

    Choose the proofing level, evidence, geography, privacy, failure, and exception path separately from login.

    Identity Verification

  6. Which artifact requires vulnerability detection: dependency, source code, container, or infrastructure as code?

    Keep one Vulnerability Scanning Task but select explicit SCA, SAST, container, and IaC routes; do not assume one engine covers all surfaces.

    Vulnerability Scanning

  7. Is there a named security framework or customer assurance obligation with defined controls and evidence?

    Only then evaluate Compliance Automation for control mapping, evidence exchange, assessment, and findings; do not treat it as legal advice or automatic certification.

    Compliance Automation Audit Logs Vulnerability Scanning

1259

Decision groups

Each Task owns a distinct user decision rather than a product feature label.

Credential controls

Protect sensitive credentials through their full lifecycle rather than treating secret storage as generic configuration.

Vulnerability discovery

Route one scanning intent across SCA, SAST, container, and IaC surfaces while preserving a shared triage and remediation workflow.

134579

Common confusions

These boundaries prevent adjacent Tasks from collapsing into one generic shortlist.

Treating automated-abuse detection and request quotas as the same control.
Bot Protection evaluates automated behavior; Rate Limiting enforces a quota even for legitimate clients.
Treating HTTP request filtering and automated-actor detection as interchangeable.
Web Application Firewalls apply request rules; Bot Protection focuses on automated behavior and abuse.
Treating attributable audit evidence and diagnostic application logs as one log stream.
Audit Logs prioritize actor, action, integrity, retention, access, and review; Logging prioritizes diagnosis and operations.
Treating identity proofing as another sign-in method.
Identity Verification evaluates evidence about a real-world subject; Authentication establishes control of an account authenticator.
Treating non-security linting and vulnerability detection as one static-analysis task.
Linters & Static Analysis owns code quality; Vulnerability Scanning owns security findings across SCA, SAST, container, and IaC routes.
Assuming a platform can make an organization legally compliant or guarantee certification.
Compliance Automation is limited to security-control evidence and assurance workflows; it does not provide legal conclusions or guarantee audit outcomes.
234789

What to defer

Do not add specialized identity systems before the product has the requirement they serve.

No named security framework, customer assurance obligation, control owner, or evidence workflow exists.

Automation should follow defined controls and evidence requirements rather than create a generic claim of compliance.

Ordinary account authentication meets the product requirement and no proofing, geography, document, personhood, or regulated identity obligation exists.

Proofing adds sensitive evidence, privacy, failure, and exception-handling obligations that login alone does not require.

The software supply chain does not yet contain the corresponding dependency, source, container, or infrastructure-as-code surface.

Select SCA, SAST, container, and IaC routes only for artifacts the team actually owns and can triage.

568910111213

Related starter stacks

See how these decisions appear inside complete application starting points.

Authoritative resources

Standards and primary documentation supporting the Category boundaries.

standardNIST OSCAL

Sources

Claim-level references used for this decision map.

  1. 1
    Secrets Management Cheat Sheet

    OWASP · Accessed Official

  2. 2
    Automated Threats to Web Applications

    OWASP · Accessed Official

  3. 3
    RFC 6585: Additional HTTP Status Codes

    IETF · Accessed Official

  4. 4
    Web Application Firewall overview

    Cloudflare · Accessed Official

  5. 5
    Open Security Controls Assessment Language

    NIST · Accessed Official

  6. 6
    OSCAL layers and models

    NIST · Accessed Official

  7. 7
    SP 800-92: Guide to Computer Security Log Management

    NIST · Accessed Official

  8. 8
    SP 800-63A: Identity Proofing and Enrollment

    NIST · Accessed Official

  9. 9
  10. 10
    Dependency-Check

    OWASP · Accessed Official

  11. 11
    Code scanning with CodeQL

    GitHub · Accessed Official

  12. 12
    SP 800-190: Application Container Security Guide

    NIST · Accessed Official

  13. 13
    What is Checkov?

    Checkov · Accessed Official