Skill UI

This skill analyzes AWS IAM policies using boto3 and Cloudsplaining principles to detect potential privilege escalation paths in AWS accounts. It identifies overly permissive policies, dangerous permission combinations (such as combining role passing and resource creation), and violations of least-privilege principles. It is designed for security incident investigation, threat hunting, and validating overall cloud security posture.

This guide provides comprehensive steps to harden Docker containers and associated runtime environments based on the CIS Docker Benchmark v1.8.0. It covers implementing least-privilege principles, such as running as non-root users, dropping capabilities, using read-only filesystems, and applying seccomp/AppArmor profiles. Use this when preparing containers for production deployment or conducting security audits to minimize the attack surface.

Explores how to implement AWS IAM Permission Boundaries to cap the maximum permissions granted to users or roles. This advanced security feature allows security teams to safely delegate IAM management to developers for self-service while strictly enforcing the principle of least privilege and preventing privilege escalation in cloud environments.

This guide details implementing microsegmentation using Akamai Guardicore Segmentation. It helps map application dependencies, visualize east-west traffic flows, and establish granular, least-privilege network policies across diverse environments (VMs, containers, bare metal, cloud). Essential for achieving zero-trust architecture and meeting compliance standards like PCI DSS or HIPAA by preventing lateral movement.

This skill details the deployment of Privileged Access Management (PAM) for critical database systems, including Oracle, SQL Server, PostgreSQL, and MySQL. It covers essential security controls such as session proxy configuration, credential vaulting, query auditing, and enforcing least-privilege access, helping organizations meet stringent compliance and security standards.

Implement Kubernetes RBAC to enforce least-privilege access across namespaces, covering Role/ClusterRole design, binding configuration, service account hardening, OIDC integration, and audit logging for multi-tenant clusters.

This guide outlines best practices for hardening Kubernetes Role-Based Access Control (RBAC). It focuses on implementing least-privilege principles by auditing and removing excessive cluster-admin bindings, scoping roles to namespaces, separating service accounts, and integrating external OIDC providers. Use this when improving cluster security posture, meeting compliance standards, or mitigating privilege escalation risks.

This guide details how to implement Zero Standing Privilege (ZSP) using CyberArk Secure Cloud Access (SCA). It eliminates persistent admin roles in AWS, Azure, and GCP by granting ephemeral, scoped, and time-bound access. Access is governed by the TEA framework (Time, Entitlements, Approvals), ensuring least privilege and robust security compliance for critical cloud environments.

HashiCorp Boundary is an identity-aware proxy that establishes secure, zero-trust access to infrastructure resources, eliminating the need for traditional VPNs. It enforces a default-deny model and integrates with HashiCorp Vault to dynamically broker credentials. This ensures just-in-time, least-privilege access, automatic credential revocation, and comprehensive session recording for strict compliance and auditing.

This guide details the methodology and tools for conducting authorized privilege escalation assessments within AWS environments. It systematically utilizes specialized tools like Pacu and Principal Mapper (PMapper) to identify critical IAM misconfigurations, excessive permissions, and weak cross-account trust relationships. It is essential for validating the principle of least privilege and assessing the potential blast radius of compromised credentials during authorized penetration testing.

This tool performs a comprehensive review of OAuth 2.0 scopes, identifying over-permissioned third-party application integrations, excessive API scopes, and unused token grants. It is crucial for implementing the principle of least privilege across complex identity providers and SaaS ecosystems. Use cases include compliance auditing (GDPR, SOC 2), post-incident security reviews, and managing shadow IT risk by auditing cross-boundary consent grants.

This process validates the necessity of elevated permissions across critical accounts, including domain admins, service accounts, and cloud IAM roles. It is a core identity governance function mandated by major compliance frameworks (SOX, PCI DSS) to enforce the principle of least privilege, detect stale or excessive access, and ensure continuous security compliance.