数据分类体系实战指南用 GitHub Copilot 的 contenteditable="false">【免费下载链接】awesome-copilotCommunity-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot.项目地址: https://gitcode.com/GitHub_Trending/aw/awesome-copilot导读本文以># Sensitive fields typically appear in models.py class User(models.Model): email models.EmailField() # Tier 3 date_of_birth models.DateField() # Tier 2 (combined with name) ssn models.CharField(max_length11) # Tier 18.2 TypeScript / Prismamodel User { email String // Tier 3 phoneNumber String? // Tier 3 dateOfBirth DateTime? // Tier 2 (when combined) cardNumber String? // Tier 2 PCI-DSS }8.3 Java / Spring / JPAEntity public class Patient { Column(name diagnosis) // Tier 1 PHI private String diagnosis; Column(name ssn) // Tier 1 private String ssn; }8.4 C# / EF Corepublic class UserProfile { public string Email { get; set; } // Tier 3 public string PassportNumber { get; set; } // Tier 1 public DateTime DateOfBirth { get; set; } // Tier 2 }8.5 日志语句模式高风险——最常被忽略# BAD — logs PII logger.info(fUser {user.email} logged in from {request.remote_addr}) logger.debug(fPayment for card {card_number}) # Look for these in logging calls: # .info(), .debug(), .warn(), .error(), console.log(), System.out.println()依据hardening-playbook.md 明确邮箱、IP须掩码最后一段、全名、电话等 Tier 1–3 字段不得进入结构化日志安全可记的是内部 UUID、短期会话 ID、事务/关联 ID、错误码、时间戳、HTTP 状态码与耗时。从日志中移除 PII 可使日志暴露向量爆破半径降低 40–60%。8.6 API 响应泄露序列化器 / DTO 模式// Check if these fields are included in response objects // even if not requested — over-fetching is a common exposure vector { id: ..., email: ..., // Tier 3 phone: ..., // Tier 3 dateOfBirth: ..., // Tier 2 — should this be returned? passwordHash: ..., // Tier 1 — should NEVER be returned ssn: ..., // Tier 1 — should NEVER be returned }依据过度抓取over-fetching是常见暴露向量。加固方案是显式投影.select(id name email createdAt)或 Pydantic/DTO 响应模型将 Tier 1 字段从响应中剔除可降低受影响字段 85% 的爆破半径。九、聚合风险评估组合攻击分类体系的关键洞察数据在组合后变得更加敏感。必须始终以组合视角评估字段而非孤立判断单独组合组合后等级风险邮箱 (T3)密码散列 (T1)T1账号接管姓名 (T4)出生日期 (T2) 地址 (T2)T2完整身份重建IP 地址 (T3)时间戳 用户 IDT2行为画像城市 (T4)购买历史 (T4)T3去匿名化风险健康类别 (T4)姓名 邮箱T1触发 HIPAA规则评估字段时永远考虑组合而非只看孤立值。这条规则在评分侧有硬性体现blast-radius-calculator.md 规定——当同一暴露向量中出现来自不同等级的 3 个及以上字段时在最高等级权重基础上0.5聚合攻击加成同时完整性因子Completeness Factor也区分了完整档案1.0与仅邮箱0.5的差异完整身份记录比孤立字段的暴露后果严重得多。十、从清册到报告分级如何驱动完整分析闭环data-classification.md在 contenteditable="false">【免费下载链接】awesome-copilotCommunity-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot.项目地址: https://gitcode.com/GitHub_Trending/aw/awesome-copilot创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
数据分类体系实战指南：用 GitHub Copilot 的 data-breach-blast-radius 技能构建敏感数据分级清册
数据分类体系实战指南用 GitHub Copilot 的 contenteditable="false">【免费下载链接】awesome-copilotCommunity-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot.项目地址: https://gitcode.com/GitHub_Trending/aw/awesome-copilot导读本文以># Sensitive fields typically appear in models.py class User(models.Model): email models.EmailField() # Tier 3 date_of_birth models.DateField() # Tier 2 (combined with name) ssn models.CharField(max_length11) # Tier 18.2 TypeScript / Prismamodel User { email String // Tier 3 phoneNumber String? // Tier 3 dateOfBirth DateTime? // Tier 2 (when combined) cardNumber String? // Tier 2 PCI-DSS }8.3 Java / Spring / JPAEntity public class Patient { Column(name diagnosis) // Tier 1 PHI private String diagnosis; Column(name ssn) // Tier 1 private String ssn; }8.4 C# / EF Corepublic class UserProfile { public string Email { get; set; } // Tier 3 public string PassportNumber { get; set; } // Tier 1 public DateTime DateOfBirth { get; set; } // Tier 2 }8.5 日志语句模式高风险——最常被忽略# BAD — logs PII logger.info(fUser {user.email} logged in from {request.remote_addr}) logger.debug(fPayment for card {card_number}) # Look for these in logging calls: # .info(), .debug(), .warn(), .error(), console.log(), System.out.println()依据hardening-playbook.md 明确邮箱、IP须掩码最后一段、全名、电话等 Tier 1–3 字段不得进入结构化日志安全可记的是内部 UUID、短期会话 ID、事务/关联 ID、错误码、时间戳、HTTP 状态码与耗时。从日志中移除 PII 可使日志暴露向量爆破半径降低 40–60%。8.6 API 响应泄露序列化器 / DTO 模式// Check if these fields are included in response objects // even if not requested — over-fetching is a common exposure vector { id: ..., email: ..., // Tier 3 phone: ..., // Tier 3 dateOfBirth: ..., // Tier 2 — should this be returned? passwordHash: ..., // Tier 1 — should NEVER be returned ssn: ..., // Tier 1 — should NEVER be returned }依据过度抓取over-fetching是常见暴露向量。加固方案是显式投影.select(id name email createdAt)或 Pydantic/DTO 响应模型将 Tier 1 字段从响应中剔除可降低受影响字段 85% 的爆破半径。九、聚合风险评估组合攻击分类体系的关键洞察数据在组合后变得更加敏感。必须始终以组合视角评估字段而非孤立判断单独组合组合后等级风险邮箱 (T3)密码散列 (T1)T1账号接管姓名 (T4)出生日期 (T2) 地址 (T2)T2完整身份重建IP 地址 (T3)时间戳 用户 IDT2行为画像城市 (T4)购买历史 (T4)T3去匿名化风险健康类别 (T4)姓名 邮箱T1触发 HIPAA规则评估字段时永远考虑组合而非只看孤立值。这条规则在评分侧有硬性体现blast-radius-calculator.md 规定——当同一暴露向量中出现来自不同等级的 3 个及以上字段时在最高等级权重基础上0.5聚合攻击加成同时完整性因子Completeness Factor也区分了完整档案1.0与仅邮箱0.5的差异完整身份记录比孤立字段的暴露后果严重得多。十、从清册到报告分级如何驱动完整分析闭环data-classification.md在 contenteditable="false">【免费下载链接】awesome-copilotCommunity-contributed instructions, agents, skills, and configurations to help you make the most of GitHub Copilot.项目地址: https://gitcode.com/GitHub_Trending/aw/awesome-copilot创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
