Skill UI

A comprehensive guide to implementing least-privilege security for AWS Lambda execution roles. It details the process of auditing existing permissions, analyzing actual API usage via CloudTrail and IAM Access Analyzer, creating narrowly scoped IAM policies, and enforcing strict permission boundaries (SCPs) to eliminate over-privileging and minimize the blast radius.

This skill provides a comprehensive guide for deploying Microsoft Defender for Cloud across Azure, multi-cloud, and hybrid environments. It covers activating specific Defender plans for various workloads (servers, containers, storage), optimizing the Secure Score, establishing environment connectors for AWS/GCP, and implementing advanced controls like Just-In-Time (JIT) access for robust, centralized cloud workload protection.

Harbor is an open-source container registry designed for robust security and compliance. This guide details the comprehensive workflow for securing your container ecosystem by implementing advanced features such as vulnerability scanning (Trivy), image signing (Notary/Cosign), Role-Based Access Control (RBAC), and content trust policies. Learn how to enforce image provenance and maintain strict access control in Kubernetes environments.

This comprehensive guide outlines the end-to-end security lifecycle for Kubernetes applications deployed via Helm. It covers critical topics such as chart provenance verification (GPG signing), template scanning (using tools like kubesec and checkov), enforcing strict security contexts, managing secrets securely (ExternalSecrets), and defining robust RBAC rules for CI/CD pipelines.

This skill provides comprehensive guidance on hardening and securing critical process historian servers (e.g., OSIsoft PI, Honeywell PHD) operating within Operational Technology (OT) environments. It covers best practices for network placement across the Purdue Model, implementing robust access controls, establishing secure data replication architectures through DMZs (using data diodes), preventing SQL injection, and maintaining data integrity for safety-critical and regulatory reporting purposes. It is essential for minimizing cyber risks in industrial control systems.

This skill provides a comprehensive guide to hardening managed Kubernetes clusters on major cloud platforms (EKS, AKS, GKE). It details implementing critical security layers, including Pod Security Standards, least-privilege network policies, workload identity (eliminating static cloud credentials), and runtime security monitoring. Essential for securing production environments and meeting compliance requirements.

This skill provides comprehensive security hardening guidelines for serverless compute platforms like AWS Lambda, Azure Functions, and Google Cloud Functions. It covers essential security pillars including enforcing least privilege IAM roles, integrating robust secrets management (e.g., AWS Secrets Manager), automating dependency vulnerability scanning within CI/CD pipelines, and implementing strict input validation to mitigate risks such as injection and credential theft. Ideal for DevSecOps practitioners and security architects.

A comprehensive security script designed to test REST API authentication mechanisms for common vulnerabilities. It assesses broken token validation, missing authentication on critical endpoints, weak password policies, and session management flaws. The tool specifically evaluates JWT implementation, API key handling, and adherence to OWASP API Security Top 10, helping identify authentication bypasses before production deployment.

This skill provides advanced techniques and code examples for monitoring, mapping, and pivoting across adversary-controlled infrastructure. It leverages Passive DNS, Certificate Transparency logs, Shodan/Censys scanning, and network fingerprinting (JARM/JA3S) to discover C2 servers, phishing domains, and exploitable assets over time, which is crucial for advanced security operations and threat intelligence gathering.

A structured guide for SOC Tier 1 analysts to triage security alerts within Splunk Enterprise Security (ES). It provides a systematic workflow for classifying severity, investigating notable events, correlating evidence across diverse data sources (proxy, firewall, logs), and making clear disposition decisions (True Positive, False Positive) required for escalation or closure.

This playbook guides Security Operations Center (SOC) analysts through a comprehensive, multi-step process for triaging and prioritizing security incidents. It covers receiving alerts from SIEM/EDR, enriching data using threat intelligence feeds (VirusTotal, AbuseIPDB), classifying the incident type (MITRE ATT&CK mapping), and calculating a severity score based on asset criticality and data sensitivity. The workflow culminates in automating ticket creation and triggering immediate response procedures via tools like PagerDuty.

This guide details implementing an IEC 62443 compliant conduit architecture for secure remote access into Operational Technology (OT) environments. It mandates the use of jump servers, MFA gateways, session recording, and approval workflows within a DMZ to strictly control vendor and engineer access, eliminating direct VPN connections to critical ICS assets.