Skill UI

Configure Microsoft Entra ID conditional access policies to enforce zero-trust controls, covering signal-based policy design, device compliance, risk-based authentication, named locations, session controls, and alignment with NIST zero trust guidance.

Guides designing IEC 62443-3-2 compliant OT security zones and conduits, covering risk-based partitioning, Security Level targets, conduit controls, microsegmentation with industrial firewalls, and validating the zone architecture through traffic analysis and testing.

Guides OT teams through designing and deploying Purdue-based network segmentation, covering VLANs, OT-aware firewalls, DMZs, and migration plans so critical infrastructure stays isolated yet operationally connected.

Design and implement firewall zone-based network segmentation with VLANs, ACLs, and microsegmentation to limit lateral movement, support compliance, and segment east-west traffic for zero-trust environments.

Guides administrators through designing and implementing Privileged Access Workstations (PAWs) with hardened devices, just-in-time access, Intune/GPO compliance, and CyberArk or BeyondTrust integration for secure sensitive operations.

Designs ICS/SCADA network segmentation according to the Purdue Enterprise Reference Architecture, mapping assets from Level 0 to 5, defining zone boundaries, and enforcing strict controls across IT/OT and DMZ layers—ideal for brownfield retrofits, audit remediation, or new deployments requiring IEC 62443 compliance.

Designs a ransomware-resilient backup strategy that enforces the 3-2-1-1-0 architecture, aligns schedules with tiered RPO/RTO targets, isolates backup credentials, and automates restore testing so responders can verify recovery readiness.

Implement Kubernetes RBAC to enforce least-privilege access across namespaces, covering Role/ClusterRole design, binding configuration, service account hardening, OIDC integration, and audit logging for multi-tenant clusters.

Helps SOC teams design detection use cases for SIEM platforms by mapping MITRE techniques, creating correlation rules, and formalizing lifecycle management across Splunk, Elastic, and Sentinel for production monitoring.

GoPhish is an open-source framework designed for security teams to conduct authorized phishing awareness campaigns. This skill guides users through the entire process: deploying GoPhish, setting up realistic phishing scenarios (templates, landing pages), executing the campaign, and analyzing results to measure and improve organizational resilience against social engineering attacks. It is crucial for proactive security testing and incident response validation.

Guides teams through designing, implementing, and evidencing SOC 2 Type II controls aligned with the AICPA Trust Services Criteria, covering scoping, control mapping, evidence collection, remediation, and audit collaboration for a six- to twelve-month examination.

This tool is designed for security professionals to test for Server-Side Request Forgery (SSRF) vulnerabilities. It systematically probes user-controllable URL parameters to identify access to internal network services, cloud metadata endpoints (AWS/GCP/Azure), and restricted local resources. It supports various payload techniques, including protocol handlers (gopher, file), IP encoding, and DNS rebinding, making it essential for thorough security assessments and penetration testing.