Initial commit: antifragile cybersecurity consulting blueprint
Complete repository of frameworks, playbooks, and assessment resources for cybersecurity consultations focused on antifragile enterprise design. Includes: - Core philosophy and manifest (5 pillars) - 12 modular engagement packages - AI sovereignty and operations frameworks - Zero-budget vulnerability discovery and hardening playbooks - M365 E3 hardening and antifragile project plans - Osquery sovereign discovery platform blueprint - Perimeter scanning capability guide - AI-assisted TVM blueprint for AI-powered adversaries - Vertical specializations: banking, telco, power/utilities - CIS Controls v8 and NIST CSF 2.0 mappings - Risk registers and assessment templates - C-suite conversation guide and business case templates
This commit is contained in:
108
antifragile-consulting/README.md
Normal file
108
antifragile-consulting/README.md
Normal file
@@ -0,0 +1,108 @@
|
||||
# Antifragile Enterprise Consulting Repository
|
||||
|
||||
> *"Wind extinguishes a candle and energizes fire. You want to be the fire and wish for the wind."* — Nassim Nicholas Taleb
|
||||
|
||||
This repository contains reusable frameworks, playbooks, and assessment resources for consulting engagements focused on building **antifragile organizations**—enterprises that do not merely survive disruption but grow stronger from it.
|
||||
|
||||
## What Is Antifragile?
|
||||
|
||||
Most security and resilience frameworks optimize for **robustness**—the ability to withstand shocks. Antifragility goes further. An antifragile system:
|
||||
|
||||
- **Benefits from volatility** and stressors
|
||||
- **Learns faster** from failures than from successes
|
||||
- **Decentralizes critical functions** to avoid single points of failure
|
||||
- **Treats optionality as a strategic asset**, not overhead
|
||||
|
||||
## Repository Structure
|
||||
|
||||
```
|
||||
├── core/ # Foundational frameworks and principles
|
||||
│ ├── move-fast-and-fix-things.md # Company philosophy: speed, repair, existing tools
|
||||
│ ├── antifragile-manifest.md # The five pillars of antifragile enterprise
|
||||
│ ├── modular-engagements.md # Menu of independent, self-contained modules
|
||||
│ ├── ai-sovereignty-framework.md # AI sovereignty as a strategic mandate
|
||||
│ ├── ai-operations-inevitability.md # Why defensive AI is inevitable (business AI is optional)
|
||||
│ ├── azure-openai-sovereignty-bridge.md # Azure OpenAI/Foundry as sovereignty stepping stone
|
||||
│ ├── organizational-resilience.md # Dev/Sec/Ops merger and shift-left arguments
|
||||
│ ├── quality-management-engagement.md # Embedded process assurance for teams feeling "not in control"
|
||||
│ ├── blue-purple-team-foundation.md # Building defensive capability from existing tools
|
||||
│ ├── retained-capability.md # What to keep in-house when outsourcing security (MSSP, pentest, compliance)
|
||||
│ ├── executive-summary.md # One-page board brief
|
||||
│ ├── c-suite-conversation-guide.md # Persuasion scripts for top management
|
||||
│ └── t0-asset-framework.md # Tier 0 asset classification and protection
|
||||
├── playbooks/ # Executable modernisation and response plans
|
||||
│ ├── rapid-modernisation-plan.md # 30-60-90-180 day transformation roadmap
|
||||
│ ├── endpoint-management-entry-vector.md # Intune/device management as engagement entry point
|
||||
│ ├── ai-assisted-tvm.md # AI-powered vulnerability management blueprint
|
||||
│ ├── zero-budget-vulnerability-discovery.md # Script-based vuln discovery without commercial scanners
|
||||
│ ├── perimeter-scanning-capability.md # External attack surface scanning strategy
|
||||
│ ├── osquery-custom-platform.md # Build a sovereign vuln/asset discovery platform on osquery
|
||||
│ ├── m365-antifragile-project.md # M365 greenfield/modernisation with antifragile design
|
||||
│ ├── m365-e3-hardening.md # M365 E3-specific tactical hardening
|
||||
│ ├── ad-endpoint-hardening.md # On-prem AD, Windows endpoint, hybrid identity
|
||||
│ ├── zero-budget-hardening.md # Maximize existing tool investment
|
||||
│ ├── implementation-playbook.md # Step-by-step operational guide
|
||||
│ └── business-case-template.md # Financial justification and ROI framework
|
||||
├── assessment-templates/ # Diagnostic tools and maturity models
|
||||
│ ├── README.md # Assessment roadmap and development plan
|
||||
│ ├── antifragile-risk-register.md # Antifragile risk taxonomy and register template
|
||||
│ └── m365-project-risk-register.md # M365 project-specific risk register
|
||||
├── reference/ # External standards, mappings, and citations
|
||||
│ ├── cis-controls-mapping.md # CIS Controls v8 alignment
|
||||
│ ├── nist-csf-mapping.md # NIST CSF 2.0 alignment
|
||||
│ ├── vertical-power-utilities.md # Power generation, transmission, water utilities
|
||||
│ ├── vertical-telco.md # Telecommunications and mobile operators
|
||||
│ └── vertical-banking.md # Financial services regulatory alignment
|
||||
└── assets/ # Diagrams, visuals, and presentation materials
|
||||
```
|
||||
|
||||
## Our Posture: Move Fast and Fix Things
|
||||
|
||||
This practice is built on a simple, actionable stance: **move fast and fix things**. We do not wait for perfect plans. We identify the kill chain, extract value from existing investments, and close existential gaps before they become incidents.
|
||||
|
||||
- **Speed is a security control.** A 90% solution deployed today outperforms a 100% solution that ships in six months.
|
||||
- **Work beats purchases.** Most organizations own 60-80% of the capabilities they need. We configure and operationalize before we shop.
|
||||
- **Every fix must produce a signal.** A remediation without telemetry is a remediation that will rot.
|
||||
|
||||
Read the full [Move Fast and Fix Things](core/move-fast-and-fix-things.md) philosophy.
|
||||
|
||||
## Core Pillars
|
||||
|
||||
1. **[Structural Decoupling](core/antifragile-manifest.md#pillar-1-structural-decoupling)** — Remove hidden dependencies before they become fatal ones
|
||||
2. **[Optionality Preservation](core/antifragile-manifest.md#pillar-2-optionality-preservation)** — Maintain strategic exits and alternatives at every layer
|
||||
3. **[Stress-to-Signal Conversion](core/antifragile-manifest.md#pillar-3-stress-to-signal-conversion)** — Turn failures, attacks, and outages into intelligence
|
||||
4. **[Sovereign Intelligence](core/antifragile-manifest.md#pillar-4-sovereign-intelligence)** — Own your cognitive infrastructure; never rent your ability to think
|
||||
5. **[Asymmetric Payoff Design](core/antifragile-manifest.md#pillar-5-asymmetric-payoff-design)** — Engineer outcomes where small investments yield disproportionate protection
|
||||
|
||||
## Standards Alignment
|
||||
|
||||
Our approach is not an alternative to established frameworks. It is the fastest path to meeting them while building real resilience:
|
||||
|
||||
- **[CIS Controls v8](reference/cis-controls-mapping.md)** — IG1 as a non-negotiable 90-day floor, achieved primarily through existing tool configuration
|
||||
- **[NIST CSF 2.0](reference/nist-csf-mapping.md)** — All six functions addressed with emphasis on GOVERN as the missing keystone
|
||||
|
||||
## Quick Start for Executives and Board Members
|
||||
|
||||
1. **Read** [Executive Summary](core/executive-summary.md) — one page, five minutes, the full case
|
||||
2. **Review** [Business Case Template](playbooks/business-case-template.md) — financial justification, ROI, and risk quantification
|
||||
3. **Browse** [C-Suite Conversation Guide](core/c-suite-conversation-guide.md) — how your advisors should frame the conversation
|
||||
|
||||
## Quick Start for Consultants
|
||||
|
||||
1. **Open** `core/move-fast-and-fix-things.md` — understand the engagement posture
|
||||
2. **Read** `core/antifragile-manifest.md` — understand the philosophy
|
||||
3. **Study** `playbooks/m365-e3-hardening.md` — master the primary client environment (most clients are E3)
|
||||
4. **Study** `playbooks/ad-endpoint-hardening.md` — cover on-premises AD and endpoint gaps
|
||||
5. **Study** `playbooks/zero-budget-hardening.md` — extract value from existing tools in 30 days
|
||||
6. **Deploy** `playbooks/rapid-modernisation-plan.md` — run the 30-60-90-180 day roadmap
|
||||
7. **Reference** `core/t0-asset-framework.md` and `core/ai-sovereignty-framework.md` — classify assets and own intelligence
|
||||
8. **Map** `reference/cis-controls-mapping.md` and `reference/nist-csf-mapping.md` — align to standards
|
||||
9. **Adapt** `reference/vertical-power-utilities.md`, `reference/vertical-telco.md`, or `reference/vertical-banking.md` — tailor for regulated critical infrastructure clients
|
||||
|
||||
## Usage and Licensing
|
||||
|
||||
These documents are designed for reuse across client engagements. Adapt, remix, and extend. Credit the framework when presenting externally.
|
||||
|
||||
---
|
||||
|
||||
*Built for practitioners who defend the future, not just the perimeter.*
|
||||
Reference in New Issue
Block a user