ক্যাপস্টোন — একটি প্রতিষ্ঠানের নিরাপত্তা: threat model থেকে incident মহড়া পর্যন্ত

// Taza Bazar risk register (fictional). Amounts in lakh taka.
// lef = loss events per year, lm = loss per event, as [low, high] ranges.
const risks = [
  { id: "R1", name: "ransomware at head office", lef: [0.1, 0.5], lm: [20, 120] },
  { id: "R2", name: "customer data via API flaw", lef: [0.2, 1], lm: [5, 60] },
  { id: "R3", name: "customer account takeover", lef: [2, 10], lm: [0.3, 2] },
  { id: "R4", name: "staff phishing, fake refunds", lef: [1, 4], lm: [1, 8] },
  { id: "R5", name: "forged payment webhook", lef: [0.5, 2], lm: [0.5, 5] },
  { id: "R6", name: "DDoS during a sale", lef: [0.5, 2], lm: [1, 10] },
  { id: "R7", name: "vendor breach", lef: [0.1, 0.5], lm: [3, 30] },
  { id: "R8", name: "CCTV recorder exposed", lef: [0.2, 1], lm: [0.5, 6] },
];
const TOLERANCE = 50; // one bad year for one risk, assumed by the owners
const mid = ([lo, hi]) => Math.sqrt(lo * hi); // geometric middle of a range

const rows = risks.map((r) => ({
  ...r,
  ale: mid(r.lef) * mid(r.lm),         // yearly loss, middle estimate
  worst: r.lef[1] * r.lm[1],           // both ranges at their high end
})).sort((a, b) => b.ale - a.ale);

console.log("rank id  yearly  high   flag  risk");
rows.forEach((r, i) => {
  const flag = r.worst > TOLERANCE ? "OVER" : "-";
  console.log(`${i + 1}    ${r.id}  ${r.ale.toFixed(1).padStart(5)}  ${r.worst.toFixed(0).padStart(4)}   ${flag.padEnd(4)}  ${r.name}`);
});
const total = rows.reduce((s, r) => s + r.ale, 0);
const top3 = rows.slice(0, 3).reduce((s, r) => s + r.ale, 0);
console.log(`total ${total.toFixed(1)} lakh, top 3 share ${(100 * top3 / total).toFixed(0)}%`);

// Mini detection test on toy events (fictional; clock in minutes).
// truth: "bad" = planted by the test author, "ok" = normal activity.
const f = (t, src, user) => ({ t, k: "fail", src, user });
const ev = [
  f(10, "203.0.113.7", "a1"), f(11, "203.0.113.7", "a2"), f(12, "203.0.113.7", "a3"),
  f(13, "203.0.113.7", "a4"), f(14, "203.0.113.7", "a5"),
  { t: 15, k: "login", src: "203.0.113.7", user: "a5", truth: "bad" },
  f(20, "198.51.100.9", "b1"), f(21, "198.51.100.9", "b1"), f(22, "198.51.100.9", "b1"),
  { t: 23, k: "login", src: "198.51.100.9", user: "b1", truth: "ok" },
  f(30, "203.0.113.20", "c1"), f(45, "203.0.113.20", "c2"),
  f(60, "203.0.113.20", "c3"), f(75, "203.0.113.20", "c4"),
  { t: 90, k: "login", src: "203.0.113.20", user: "c4", truth: "bad" },
  { t: 100, k: "login", src: "198.51.100.30", user: "d1", truth: "ok" },
];
// Rule: a login after at least `n` failures from one source in `win` minutes.
const rule = (n, win) => ev.filter((e) => e.k === "login").map((e) => ({
  ...e,
  alert: ev.filter((x) => x.k === "fail" && x.src === e.src && x.t < e.t && e.t - x.t <= win).length >= n,
}));
function score(n, win) {
  const r = rule(n, win);
  const tp = r.filter((e) => e.alert && e.truth === "bad").length;
  const fp = r.filter((e) => e.alert && e.truth === "ok").length;
  const fn = r.filter((e) => !e.alert && e.truth === "bad").length;
  const precision = tp + fp ? tp / (tp + fp) : 0, recall = tp + fn ? tp / (tp + fn) : 0;
  console.log(`n=${n} win=${String(win).padStart(2)}  TP=${tp} FP=${fp} FN=${fn}  ` +
    `precision=${precision.toFixed(2)} recall=${recall.toFixed(2)}`);
}
[[3, 10], [5, 10], [3, 60], [4, 60]].forEach(([n, w]) => score(n, w));
// A rule also needs a test that it stays quiet on normal activity.
const quiet = !rule(4, 60).find((e) => e.src === "198.51.100.30").alert;
console.log(`quiet on normal login: ${quiet ? "PASS" : "FAIL"}`);

// Pick controls by yearly risk reduction per lakh, within budget and team time.
// cost = lakh taka, wk = person-weeks, cut = assumed yearly reduction (lakh).
const items = [
  ["C1", "MFA and passkeys", 1.0, 3, 5.0], ["C2", "immutable backup", 2.0, 3, 4.5],
  ["C3", "API object checks", 1.5, 6, 4.5], ["C4", "CDN, WAF, rate limit", 2.5, 2, 3.3],
  ["C5", "EDR on 40 devices", 3.5, 3, 2.5], ["C6", "MDR service", 6.0, 2, 3.0],
  ["C7", "central logs, 10 rules", 1.0, 5, 2.0], ["C8", "webhook signature", 0.3, 2, 1.2],
  ["C9", "vendor review", 0.5, 3, 0.9], ["C10", "CCTV on own VLAN", 0.4, 1, 0.5],
  ["C11", "IR plan, tabletop", 0.5, 2, 1.5], ["C12", "just-in-time admin", 1.5, 3, 1.5],
].map(([id, name, cost, wk, cut]) => ({ id, name, cost, wk, cut }));
const BUDGET = 15, WEEKS = 8, QUARTERS = 4;

const byValue = [...items].sort((a, b) => b.cut / b.cost - a.cut / a.cost);
const free = Array(QUARTERS).fill(WEEKS), plan = [[], [], [], []];
let spent = 0, cut = 0;
for (const c of byValue) {
  const q = free.findIndex((w) => w >= c.wk);
  if (q < 0 || spent + c.cost > BUDGET) { console.log(`skip ${c.id} ${c.name}`); continue; }
  plan[q].push(c); free[q] -= c.wk; spent += c.cost; cut += c.cut;
}
plan.forEach((p, q) => console.log(`Q${q + 1}: ${p.map((c) => c.id).join(" ")}` +
  `  cost ${p.reduce((s, c) => s + c.cost, 0).toFixed(1)}  weeks ${WEEKS - free[q]}`));
console.log(`greedy: spent ${spent.toFixed(1)} of ${BUDGET}, cut ${cut.toFixed(1)} a year`);

// Check every subset. 12 items give 4096 subsets, small enough here.
let best = { cut: 0, ids: "" };
for (let m = 0; m < 1 << items.length; m++) {
  const s = items.filter((_, i) => m >> i & 1);
  const cost = s.reduce((a, c) => a + c.cost, 0), wk = s.reduce((a, c) => a + c.wk, 0);
  const v = s.reduce((a, c) => a + c.cut, 0);
  if (cost <= BUDGET + 1e-9 && wk <= WEEKS * QUARTERS && v > best.cut + 1e-9)
    best = { cut: v, cost, wk, ids: s.map((c) => c.id).join(" ") };
}
console.log(`best subset: cut ${best.cut.toFixed(1)}, cost ${best.cost.toFixed(1)}, weeks ${best.wk}`);
console.log(`ids: ${best.ids}`);

// Programme maturity rubric. Score each domain 0 to 4 against written evidence.
// 0 none, 1 ad hoc, 2 written, 3 running with proof, 4 measured and improving.
const domains = [
  ["assets and data", 2, "finish the data map, name an owner per asset"],
  ["risk register", 2, "review the top risks every quarter"],
  ["identity", 3, "phishing-resistant login for every admin"],
  ["network and endpoint", 2, "separate zones, turn on disk encryption"],
  ["web and API", 3, "add object-level tests to the build"],
  ["secure SDLC", 2, "make secret and dependency checks blocking"],
  ["logging and detection", 3, "test each rule with planted events"],
  ["incident response", 3, "run a tabletop, test a restore"],
  ["governance and privacy", 2, "assign data duties, set retention"],
  ["vendors", 1, "list vendors, tier them, check contracts"],
];
const start = [2, 1, 1, 1, 1, 0, 0, 1, 1, 0];
const after = [3, 3, 3, 2, 3, 2, 2, 3, 2, 2];
const maxScore = domains.reduce((s, d) => s + d[1] * 4, 0);

function report(label, scores) {
  const total = domains.reduce((s, d, i) => s + d[1] * scores[i], 0);
  const pct = 100 * total / maxScore;
  const level = pct < 25 ? "initial" : pct < 50 ? "basic" : pct < 75 ? "managed" : "strong";
  console.log(`${label}: ${total}/${maxScore} = ${pct.toFixed(0)}% (${level})`);
  // Lowest score first; on a tie, the larger weighted gain first.
  const next = domains.map((d, i) => ({ d, gain: d[1] * (4 - scores[i]), s: scores[i] }))
    .sort((a, b) => a.s - b.s || b.gain - a.gain).slice(0, 3);
  next.forEach((n) => console.log(`  next (${n.s}/4, gain ${n.gain}): ${n.d[0]}: ${n.d[2]}`));
}
report("start", start);
report("after one year", after);