Skill UI

Binary Authorization is a critical Google Cloud security control that enforces policy-based deployment rules. It mandates that only container images with valid cryptographic attestations (proof of successful vulnerability scanning, code reviews, etc.) can be deployed to GKE or Cloud Run. Use this guide to establish robust supply chain security and compliance controls for your cloud-native applications.

Implement robust Static Application Security Testing (SAST) using CodeQL powered by GitHub Advanced Security (GHAS). This solution automates the detection of critical vulnerabilities (e.g., SQL injection, XSS) across large, enterprise-scale codebases, ensuring compliance and maintaining a strong DevSecOps posture throughout the development lifecycle.

This guide details how to implement HashiCorp Vault's dynamic secrets engine. It automates the generation, lease management, and rotation of short-lived credentials for databases (e.g., PostgreSQL, MySQL), AWS IAM, and PKI certificates. This method eliminates the use of static, hardcoded secrets, enforcing zero-trust principles and meeting stringent compliance mandates like PCI-DSS.

This guide details the process of deploying and configuring Tofino industrial firewalls for critical OT/ICS environments. It provides architectural blueprints and Python-based rule generators to implement deep packet inspection (DPI) for key industrial protocols like Modbus, EtherNet/IP, and S7comm. This ensures granular, protocol-aware access control and robust zone segmentation for safeguarding SCADA and PLCs.

This skill guides the implementation of continuous, risk-adaptive identity verification crucial for Zero Trust Architecture (ZTA). It covers deploying phishing-resistant MFA (FIDO2/WebAuthn), advanced risk-based conditional access policies, and identity governance strategies. Users learn how to move beyond traditional credentials by leveraging multiple signals—such as device posture, behavioral biometrics, and location context—to dynamically assess and enforce trust levels before granting access.

This skill guides the design and implementation of security zones and conduits for Industrial Automation and Control Systems (IACS) following IEC 62443-3-2 standards. It covers risk-based zone partitioning, defining security levels (SL-T), deploying microsegmentation using industrial firewalls, and validating the architecture against the Purdue Model.

This guide details implementing robust container image provenance verification using Cosign, a Sigstore tool. It covers key-based and keyless (OIDC) signing methods, enabling secure supply chain practices. Users can sign images, attach critical attestations (such as SBOMs and vulnerability scans), and enforce verification in CI/CD pipelines and Kubernetes environments to ensure high integrity and trust.

This skill guides the implementation of automated security scanning for Infrastructure as Code (IaC) templates using industry-leading tools like Checkov and tfsec. It focuses on integrating security checks into CI/CD pipelines to detect misconfigurations (e.g., public buckets, open ports) in Terraform, CloudFormation, and Kubernetes manifests before they reach production, thereby enforcing policy-based governance and securing the development lifecycle.

This skill covers the complete lifecycle for establishing, implementing, and maintaining an Information Security Management System (ISMS) based on ISO/IEC 27001:2022. Users learn the full process, from initial gap analysis and risk assessment (including defining risk treatment plans) to selecting Annex A controls, developing the Statement of Applicability (SoA), conducting internal audits, and preparing for final certification. It is essential for organizations needing to achieve formal security compliance and robust governance.

This guide details how to implement Kubernetes Pod Security Standards (PSS) using the Pod Security Admission (PSA) controller. PSS defines three mandatory security levels—Privileged, Baseline, and Restricted—for container workloads. It is essential for enhancing security posture, ensuring compliance, and migrating away from deprecated PodSecurityPolicy (PSP) controls by applying namespace labels and defining compliant pod specifications.

This guide details the implementation of robust network access control (NAC) using 802.1X, RADIUS authentication, and platforms like PacketFence. It enables identity-based access enforcement, performs endpoint posture assessment, and dynamically assigns users to appropriate VLANs. Ideal for achieving zero-trust architecture and meeting stringent compliance standards (e.g., PCI-DSS).

A comprehensive guide and tool for implementing secure network segmentation in Operational Technology (OT) environments. It utilizes the Purdue Model and traffic baseline analysis to design secure zones using VLANs, industrial firewalls, and data diodes, ensuring migration from flat networks without operational disruption. Ideal for achieving IEC 62443 compliance and securing IT/OT convergence points.