Skill UI

This comprehensive guide provides expertise in conducting ISO 13485 internal audits for medical device Quality Management Systems (QMS). It covers the full audit lifecycle, including risk-based planning, systematic evidence collection, classifying nonconformities (Major/Minor), and managing CAPA verification to ensure regulatory compliance and continuous improvement.

This guide details deploying Tailscale (or self-hosted Headscale) to create a WireGuard-based zero trust mesh VPN. It establishes encrypted peer-to-peer connections between devices, eliminating the need for traditional VPN servers. Features include identity-aware Access Control Lists (ACLs), subnet routing, and secure connectivity for compliance-driven architectures. Use this when enforcing granular, identity-authenticated access control.

This guide provides comprehensive techniques for detecting Layer 2 ARP poisoning and spoofing attacks. It covers monitoring gratuitous ARP floods, tracking IP-to-MAC mapping changes, and identifying rogue devices. Techniques include deploying ARPWatch, configuring Dynamic ARP Inspection (DAI) on managed switches, and using advanced Wireshark filters or custom Python scripts for robust security monitoring and incident response.

This guide details methods for detecting and mitigating OAuth token theft and replay attacks in cloud environments, specifically targeting Microsoft Entra ID (Azure AD). It covers protection against access token theft, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Users can leverage Conditional Access and Token Protection features to cryptographically bind tokens to devices, significantly enhancing cloud identity security and preventing session hijacking.

This skill implements the CISA Zero Trust Maturity Model (ZTMM) v2.0. It provides a structured framework to assess, gap-analyze, and roadmap the adoption of zero trust architecture across five core pillars: Identity, Devices, Networks, Applications, and Data. It guides organizations from Traditional to Optimal maturity, aiding compliance with NIST standards and federal mandates.

This skill guides the implementation of Mobile Application Management (MAM) policies, enabling robust data protection for corporate assets on both managed and unmanaged mobile devices (BYOD). It covers configuring app-level controls such as Data Loss Prevention (DLP), selective wiping, and containerization using platforms like Microsoft Intune and Azure AD. Use this when enforcing data separation between personal and work environments without requiring full device enrollment.

A comprehensive guide detailing the implementation of 802.1X port-based Network Access Control (NAC) using RADIUS authentication and platforms like PacketFence. This solution enforces identity-based access, performs endpoint posture assessment, and dynamically assigns VLANs. It is essential for establishing zero-trust networks, meeting stringent compliance standards (PCI-DSS, HIPAA), and automating the onboarding of BYOD devices.

A comprehensive tool suite designed to analyze firmware images from embedded devices, including routers, IoT endpoints, and critical system components like UEFI/BIOS. It facilitates deep security analysis by performing firmware extraction, filesystem integrity checks, binary reverse engineering, and sophisticated detection of bootkits, backdoors, and unauthorized modifications.

This comprehensive guide details physical intrusion assessment methodologies, simulating real-world security threats. Techniques covered include tailgating, RFID badge cloning, mechanical lock bypassing, and deploying rogue network devices. It is designed for full-scope red team engagements to evaluate the integrity of physical security controls and map potential paths to network access.

A comprehensive guide detailing the use of Tenable Nessus, an industry-leading vulnerability scanner. Learn how to configure advanced scan policies, perform both authenticated and unauthenticated scans across servers, network devices, and web applications. This skill covers end-to-end processes from execution to result analysis and reporting.

This tool monitors Modbus TCP communication within SCADA and ICS environments to detect security anomalies. It performs deep packet inspection, baselines normal communication patterns (e.g., typical function code distribution, register access), and applies statistical analysis to identify unauthorized register writes, reconnaissance attempts, or denial-of-service attacks targeting industrial control devices.

This tool provides comprehensive management capabilities for Cognitum Seed device fleets. Users can perform various actions such as creating new fleets, listing existing ones, adding or removing individual devices, and deleting entire fleets. It helps maintain firmware policies and manage the lifecycle of connected IoT devices.