Skill UI

Learn how to implement robust container security by integrating the open-source Trivy scanner (from Aqua Security) into your CI/CD pipelines. This guide covers scanning container images, Kubernetes manifests, IaC files, and code repositories to detect critical vulnerabilities, misconfigurations, secrets, and generating Software Bill of Materials (SBOM) for comprehensive supply chain security.

This guide details how to use Google Distroless images to drastically reduce the attack surface of containerized applications. By eliminating shells, package managers, and unnecessary OS utilities, these minimal base images enhance security, align with compliance standards, and improve supply chain security in Kubernetes and Docker deployments. It provides multi-stage build patterns for various languages (Go, Java, Python, Node.js).

Binary Authorization is a critical Google Cloud security control that enforces policy-based deployment rules. It mandates that only container images with valid cryptographic attestations (proof of successful vulnerability scanning, code reviews, etc.) can be deployed to GKE or Cloud Run. Use this guide to establish robust supply chain security and compliance controls for your cloud-native applications.

This guide details implementing robust container image provenance verification using Cosign, a Sigstore tool. It covers key-based and keyless (OIDC) signing methods, enabling secure supply chain practices. Users can sign images, attach critical attestations (such as SBOMs and vulnerability scans), and enforce verification in CI/CD pipelines and Kubernetes environments to ensure high integrity and trust.

This comprehensive guide details industry best practices for container image hardening. It covers minimizing attack surface through multi-stage builds, utilizing distroless images, enforcing non-root users, and configuring read-only root filesystems. The techniques ensure compliance with standards like the CIS Docker Benchmark, making images secure and production-ready.

This skill demonstrates how to use Trivy, an open-source security scanner, to perform comprehensive container security assessments. It scans container images, Kubernetes manifests, and Infrastructure as Code (IaC) files for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues. Key features include generating Software Bill of Materials (SBOM) for supply chain transparency and integrating scanning gates into CI/CD pipelines, supporting robust DevSecOps practices.

This toolset guides users through advanced digital forensic techniques using tools like Foremost and Scalpel. It demonstrates how to perform file carving—recovering specific file types (images, documents, etc.) from raw disk images or unallocated space—by analyzing file headers and footers (magic bytes). This is critical for evidence extraction when traditional file system metadata is unavailable or corrupted.

A comprehensive guide for analyzing firmware images from embedded systems, IoT devices, routers, and specialized components like UEFI/BIOS. This skill covers advanced techniques including filesystem extraction, binary reverse engineering (using Ghidra/IDA), rootkit detection, and deep forensic analysis to uncover backdoors, implants, and supply chain compromises. Essential for cybersecurity professionals investigating compromised hardware.

This comprehensive guide details a multi-step workflow for detecting and extracting covert data hidden within images, audio, and video files. It covers initial metadata analysis, running advanced steganalysis tools (like zsteg, binwalk, stegoveritas), and performing low-level analysis such as Least Significant Bit (LSB) analysis to uncover hidden communication channels used in digital forensics and cybersecurity investigations.

This guide demonstrates how to build comprehensive forensic super-timelines using Plaso (log2timeline) to correlate events across diverse sources. It covers the entire workflow, from processing disk images and various logs (MFT, registry, browser history) to generating standardized CSV, JSONL exports, and visualizing the results in tools like Timesketch for deep investigative analysis.

This guide provides a comprehensive workflow for recovering deleted files from forensic disk images and storage media. Utilizing PhotoRec and file signature carving techniques, it addresses scenarios where file systems are corrupted, formatted, or metadata is unavailable. The process includes setup, running the recovery tool in both interactive and command-line modes, and advanced steps for organizing, hashing, and validating file integrity.

Grype is an open-source vulnerability scanner from Anchore. It inspects container images, filesystems, and SBOMs for known CVEs. It leverages Syft-generated SBOMs to match packages against multiple vulnerability databases (NVD, GitHub Advisories). Use it for security assessments, auditing, and integrating into CI/CD pipelines to enforce vulnerability standards and manage supply chain risks.