Mistake Clinic
Module-Specific Mistake Radar
| Mistake | Signal | Repair |
|---|---|---|
| Collect everything | High cost, low decisions | Tie signals to threats |
| Alert equals fact | Context contradicts | Test hypotheses |
| No logs means no attack | Telemetry gap | Validate completeness |
| Contain by wiping | Evidence destroyed | Coordinate preservation |
| Restore equals recover | Persistence remains | Validate trusted state |
| Review equals checklist | Risks lack evidence | Trace threats to controls and tests |
Practice Mistake Checks
Verify threat-to-signal mapping, schema and time quality, replay, benign noise, triage, evidence provenance, scope, roles, containment, revocation, eradication, trusted recovery, communication, fitness functions, external findings, disclosure, and residual risk.
Required evidence
Submit threat-linked rules, validated telemetry, replay and noise results, evidence provenance, timeline, decision log, containment and recovery proof, architecture correction, independent finding disposition, and residual risk. Protect sensitive incident data.
Oral defense
Triage one ambiguous signal, distinguish evidence from inference, demonstrate containment and trusted recovery, and defend the architecture or executive risk decision.
Source backbone
Use NIST SP 800-61, MITRE ATT&CK, NIST CSF, and Building Secure and Reliable Systems.