Skip to content

feat: map DPRK IT Workers onto the Security Map #638

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattaereal merged 1 commit into from
Sep 14, 2026
Merged

feat: map DPRK IT Workers onto the Security Map #638

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
227 changes: 227 additions & 0 deletions components/security-map/securityMap.generated.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -782,6 +782,30 @@ export const securityMapGraph = {
"assessmentEligible": true,
"framework": "wallet-security"
},
{
"id": "control-continuous-remote-identity-review",
"type": "control",
"title": "Continuous remote identity review",
"summary": "Keep checking remote workers after hire: camera-on presence, identity consistency, and access that still matches the role.",
"domains": [
"people"
],
"status": "proposed",
"tags": [
"hiring",
"identity",
"dprk"
],
"roles": [
"founder-executive"
],
"lifecycle": [
"normal-operations"
],
"controlClass": "detective",
"assessmentEligible": true,
"framework": "dprk-it-workers"
},
{
"id": "control-controlled-surrender",
"type": "control",
Expand Down Expand Up @@ -1878,6 +1902,56 @@ export const securityMapGraph = {
],
"href": "/infrastructure/domain-and-dns-security/overview"
},
{
"id": "guidance-dprk-general-information",
"type": "guidance",
"title": "DPRK IT workers: general information",
"summary": "False-identity remote IT work that funds a sanctioned regime. Treat it as high-impact insider and sanctions risk, not ordinary freelance noise.",
"domains": [
"people"
],
"status": "proposed",
"tags": [
"dprk",
"sanctions"
],
"href": "/dprk-it-workers/general-information",
"framework": "dprk-it-workers"
},
{
"id": "guidance-dprk-it-workers",
"type": "guidance",
"title": "Insider threats (DPRK)",
"summary": "Fraudulently hired remote workers who fund a sanctioned regime and can pivot to theft, extortion, or sabotage. Hiring and access control are the primary defenses.",
"domains": [
"people"
],
"status": "proposed",
"tags": [
"dprk",
"insider"
],
"href": "/dprk-it-workers/overview",
"framework": "dprk-it-workers"
},
{
"id": "guidance-dprk-mitigation",
"type": "guidance",
"title": "Mitigating DPRK IT workers",
"summary": "Hiring verification plus least privilege before a hit. After discovery, revoke access, preserve evidence, and treat sanctions and supply-chain exposure as incidents.",
"domains": [
"people",
"development-supply-chain"
],
"status": "proposed",
"tags": [
"dprk",
"hiring",
"least-privilege"
],
"href": "/dprk-it-workers/mitigating-dprk-it-workers",
"framework": "dprk-it-workers"
},
{
"id": "guidance-dprk-playbook",
"type": "guidance",
Expand All @@ -1894,6 +1968,23 @@ export const securityMapGraph = {
"href": "/incident-management/playbooks/hacked-dprk",
"framework": "incident-management"
},
{
"id": "guidance-dprk-ttps",
"type": "guidance",
"title": "DPRK IT worker TTPs",
"summary": "Spot fraud and inconsistency across identity, code history, and interviews. Do not rely on stereotypes. Tactics change.",
"domains": [
"people"
],
"status": "proposed",
"tags": [
"dprk",
"hiring",
"ttps"
],
"href": "/dprk-it-workers/techniques-tactics-and-procedures",
"framework": "dprk-it-workers"
},
{
"id": "guidance-duress-defensive-principles",
"type": "guidance",
Expand Down Expand Up @@ -2805,6 +2896,30 @@ export const securityMapGraph = {
"upgrade"
]
},
{
"id": "surface-contributor-hire-path",
"type": "attack-surface",
"title": "Contributor-to-hire path",
"summary": "Valid pull requests and open-source help used to skip ordinary hiring checks and request repository or infrastructure access.",
"domains": [
"people",
"development-supply-chain"
],
"status": "proposed",
"tags": [
"hiring",
"oss",
"dprk"
],
"roles": [
"founder-executive",
"engineer-developer"
],
"lifecycle": [
"normal-operations"
],
"framework": "dprk-it-workers"
},
{
"id": "surface-custodial-admin-access",
"type": "attack-surface",
Expand Down Expand Up @@ -3638,6 +3753,13 @@ export const securityMapGraph = {
"type": "depends-on",
"status": "proposed"
},
{
"id": "detects:control-continuous-remote-identity-review:threat-dprk-it-worker-infiltration",
"source": "control-continuous-remote-identity-review",
"target": "threat-dprk-it-worker-infiltration",
"type": "detects",
"status": "proposed"
},
{
"id": "detects:control-dns-change-monitoring:threat-frontend-dns-hijacking",
"source": "control-dns-change-monitoring",
Expand Down Expand Up @@ -3708,6 +3830,13 @@ export const securityMapGraph = {
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:component-hiring-pipeline:guidance-dprk-it-workers",
"source": "component-hiring-pipeline",
"target": "guidance-dprk-it-workers",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:component-software-wallet:guidance-wallet-security",
"source": "component-software-wallet",
Expand Down Expand Up @@ -3743,6 +3872,13 @@ export const securityMapGraph = {
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-continuous-remote-identity-review:guidance-dprk-mitigation",
"source": "control-continuous-remote-identity-review",
"target": "guidance-dprk-mitigation",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-controlled-surrender:guidance-duress-defensive-principles",
"source": "control-controlled-surrender",
Expand Down Expand Up @@ -3855,6 +3991,20 @@ export const securityMapGraph = {
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-hiring-identity-verification:guidance-dprk-mitigation",
"source": "control-hiring-identity-verification",
"target": "guidance-dprk-mitigation",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-hiring-identity-verification:guidance-dprk-ttps",
"source": "control-hiring-identity-verification",
"target": "guidance-dprk-ttps",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-hiring-identity-verification:guidance-people-controls",
"source": "control-hiring-identity-verification",
Expand Down Expand Up @@ -3890,6 +4040,13 @@ export const securityMapGraph = {
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-insider-threat-mitigation:guidance-dprk-mitigation",
"source": "control-insider-threat-mitigation",
"target": "guidance-dprk-mitigation",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-insider-threat-mitigation:guidance-insider-threat",
"source": "control-insider-threat-mitigation",
Expand All @@ -3911,6 +4068,13 @@ export const securityMapGraph = {
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-least-privilege-review:guidance-dprk-mitigation",
"source": "control-least-privilege-review",
"target": "guidance-dprk-mitigation",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:control-least-privilege-review:guidance-iam",
"source": "control-least-privilege-review",
Expand Down Expand Up @@ -4121,6 +4285,13 @@ export const securityMapGraph = {
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:response-dprk-it-worker:guidance-dprk-mitigation",
"source": "response-dprk-it-worker",
"target": "guidance-dprk-mitigation",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:response-dprk-it-worker:guidance-dprk-playbook",
"source": "response-dprk-it-worker",
Expand Down Expand Up @@ -4184,13 +4355,34 @@ export const securityMapGraph = {
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-general-information",
"source": "threat-dprk-it-worker-infiltration",
"target": "guidance-dprk-general-information",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-it-workers",
"source": "threat-dprk-it-worker-infiltration",
"target": "guidance-dprk-it-workers",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-playbook",
"source": "threat-dprk-it-worker-infiltration",
"target": "guidance-dprk-playbook",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-ttps",
"source": "threat-dprk-it-worker-infiltration",
"target": "guidance-dprk-ttps",
"type": "documented-by",
"status": "proposed"
},
{
"id": "documented-by:threat-duress-coercion:guidance-coercion-duress",
"source": "threat-duress-coercion",
Expand Down Expand Up @@ -4366,6 +4558,13 @@ export const securityMapGraph = {
"type": "exposes",
"status": "proposed"
},
{
"id": "exposes:component-hiring-pipeline:surface-contributor-hire-path",
"source": "component-hiring-pipeline",
"target": "surface-contributor-hire-path",
"type": "exposes",
"status": "proposed"
},
{
"id": "exposes:component-hiring-pipeline:surface-hiring-contractor-access",
"source": "component-hiring-pipeline",
Expand Down Expand Up @@ -4464,6 +4663,13 @@ export const securityMapGraph = {
"type": "mitigates",
"status": "proposed"
},
{
"id": "mitigates:control-continuous-remote-identity-review:threat-dprk-it-worker-infiltration",
"source": "control-continuous-remote-identity-review",
"target": "threat-dprk-it-worker-infiltration",
"type": "mitigates",
"status": "proposed"
},
{
"id": "mitigates:control-controlled-surrender:threat-duress-coercion",
"source": "control-controlled-surrender",
Expand Down Expand Up @@ -4821,6 +5027,13 @@ export const securityMapGraph = {
"type": "protects",
"status": "proposed"
},
{
"id": "protects:control-continuous-remote-identity-review:component-hiring-pipeline",
"source": "control-continuous-remote-identity-review",
"target": "component-hiring-pipeline",
"type": "protects",
"status": "proposed"
},
{
"id": "protects:control-controlled-surrender:asset-key-holder-safety",
"source": "control-controlled-surrender",
Expand Down Expand Up @@ -4877,6 +5090,13 @@ export const securityMapGraph = {
"type": "protects",
"status": "proposed"
},
{
"id": "protects:control-hiring-identity-verification:surface-contributor-hire-path",
"source": "control-hiring-identity-verification",
"target": "surface-contributor-hire-path",
"type": "protects",
"status": "proposed"
},
{
"id": "protects:control-identity-separation:asset-key-holder-safety",
"source": "control-identity-separation",
Expand Down Expand Up @@ -5136,6 +5356,13 @@ export const securityMapGraph = {
"type": "targets",
"status": "proposed"
},
{
"id": "targets:threat-dprk-it-worker-infiltration:surface-contributor-hire-path",
"source": "threat-dprk-it-worker-infiltration",
"target": "surface-contributor-hire-path",
"type": "targets",
"status": "proposed"
},
{
"id": "targets:threat-dprk-it-worker-infiltration:surface-hiring-contractor-access",
"source": "threat-dprk-it-worker-infiltration",
Expand Down
5 changes: 3 additions & 2 deletions docs/data/security-map/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,8 +122,9 @@ The first seed is `proposed` on purpose.

1. Run `pnpm run coverage:security-map` and treat the lists as the work queue.
2. Map one framework per PR (`feat/security-map-<framework>`). Steward review for security semantics.
Wallet Security, Physical Security (duress), and Treasury Operations are seeded. Next coverage
gaps are empty frameworks on the work queue, not another implied seed.
Wallet Security, Physical Security (duress), Treasury Operations, and DPRK IT Workers are seeded.
Next gaps are remaining empty frameworks on the work queue.


3. Add the missing component, surface, control, or guidance edge. Cross-links appear because two
frameworks share a node, not because overview pages mention each other.
Expand Down
Loading