Skill UI

This skill automates the validation of AWS environments against critical industry compliance benchmarks. It performs detailed checks for CIS AWS Foundations, PCI-DSS, HIPAA, and SOC 2 standards, covering key areas like Identity and Access Management (IAM), logging, data protection, and network security. Essential for preparing for regulatory audits and maintaining continuous secure operations.

This skill provides a comprehensive guide to implementing microsegmentation policies. It details how to move beyond traditional network boundaries (VLANs) to enforce least-privilege access control between individual workloads using identity and application context. Essential for preventing lateral movement and establishing a robust zero-trust architecture aligned with industry compliance standards.

A comprehensive guide to configuring pfSense firewalls for robust network security. This skill covers setting up complex network segmentation across multiple zones (DMZ, internal, guest, IoT), implementing granular firewall rules, configuring NAT for port forwarding, and establishing site-to-site or remote-access VPN tunnels using IPsec or OpenVPN. Ideal for network engineers deploying perimeter or internal firewalls.

A comprehensive guide on deploying Cloudflare Access and Tunnel to establish a Zero Trust Network Access (ZTNA) solution. This method replaces traditional VPNs by securely exposing self-hosted internal applications (web, SSH, RDP) without opening inbound ports. It integrates identity-aware policies, device posture checks, and robust identity providers (Okta, Azure AD) for highly secure, least-privilege access.

A comprehensive guide for implementing enterprise-grade Security Access Service Edge (SASE) architectures using Palo Alto Networks Prisma Access. This skill covers configuring ZTNA connectors, GlobalProtect agents, security policies, and device posture checks (HIP) to provide unified, cloud-delivered security, replacing traditional VPNs and maintaining zero trust principles across remote and branch offices.

This skill provides a comprehensive guide to deploying a Software-Defined Perimeter (SDP) compliant with the CSA v2.0 specification. It details implementing core zero trust mechanisms, including Single Packet Authorization (SPA) and mutual TLS (mTLS), using a controller and gateway architecture. Use this when establishing invisible, identity-centric network access (dark cloud) to harden infrastructure, enforce strict zero trust policies, or meet advanced compliance requirements.

A comprehensive skill for detecting early-stage ransomware indicators before data encryption occurs. It utilizes advanced network detection tools such as Zeek and Suricata, combined with SIEM correlation rules and threat intelligence feeds. This method monitors the entire pre-encryption kill chain, identifying precursor behaviors like initial access broker activity, Cobalt Strike C2 beaconing, credential harvesting (e.g., Mimikatz signatures), and data staging attempts, enabling timely incident response and containment.

A comprehensive guide detailing the methodology for identifying and exploiting Server-Side Request Forgery (SSRF). This technique is critical in authorized penetration testing, allowing attackers to pivot from public-facing applications to internal resources. Use cases include stealing cloud provider metadata (AWS, GCP), scanning private IP ranges, and accessing internal APIs and admin panels.

This skill automates the hardening of Linux endpoints (Ubuntu, RHEL, CentOS) by implementing industry-standard security best practices guided by CIS Benchmarks. It systematically secures various layers, including filesystem permissions, network parameters (sysctl), SSH configuration, user access controls (PAM), and integrates deep auditing using auditd and OpenSCAP. It is essential for achieving compliance with standards like PCI DSS, HIPAA, and SOC 2.

This comprehensive guide details the deployment and configuration of Tofino industrial firewalls to secure critical SCADA and PLC systems. It utilizes Deep Packet Inspection (DPI) capabilities for core OT protocols (Modbus, EtherNet/IP, S7comm), ensuring strict access control and enforcing IEC 62443 zone boundaries. Ideal for segmenting control networks and providing compensating controls for unpatchable legacy equipment.

A comprehensive guide detailing the implementation of 802.1X port-based Network Access Control (NAC) using RADIUS authentication and platforms like PacketFence. This solution enforces identity-based access, performs endpoint posture assessment, and dynamically assigns VLANs. It is essential for establishing zero-trust networks, meeting stringent compliance standards (PCI-DSS, HIPAA), and automating the onboarding of BYOD devices.

This guide details the deployment of Cisco Identity Services Engine (ISE) for comprehensive Network Access Control (NAC). It utilizes 802.1X authentication, MAC Authentication Bypass (MAB), and posture assessment to enforce security policies. Key features include integrating with Active Directory, assigning dynamic VLANs, and applying TrustSec Security Group Tags (SGTs) for advanced network segmentation in enterprise environments.