Skill UI

This comprehensive skill guides users through designing and executing advanced social engineering penetration tests. It covers simulating real-world attacks, including phishing (email), vishing (voice), smishing (SMS), and physical pretexting. The goal is to measure an organization's human security resilience, identify training gaps, and test security controls across multiple vectors using tools like GoPhish and SET.

This skill guides the configuration and usage of Hardware Security Modules (HSMs) for robust cryptographic key management. Utilizing the industry-standard PKCS#11 interface, it covers key generation, signing, encryption, and key management directly on hardened physical or soft devices. It is essential for applications requiring the highest level of key protection, ensuring that private keys never leave the secure hardware boundary.

This skill detects advanced cyber-physical attacks mimicking the Stuxnet pattern. It monitors for unauthorized modifications to PLC logic and detects discrepancies between reported sensor readings and actual physical process behavior. Ideal for high-security OT/ICS environments when hunting for APT lateral movement or validating process integrity against sophisticated threats.

This tool provides comprehensive security assessments for the entire IoT ecosystem, including physical hardware, embedded firmware, network communications, and cloud APIs. Testers can perform deep dives using hardware debugging (UART/JTAG), firmware extraction and reverse engineering, analyzing protocols (MQTT, CoAP, BLE), and simulating cloud-to-device attacks to identify vulnerabilities across all layers of the smart device stack.

This comprehensive guide details physical intrusion assessment methodologies, simulating real-world security threats. Techniques covered include tailgating, RFID badge cloning, mechanical lock bypassing, and deploying rogue network devices. It is designed for full-scope red team engagements to evaluate the integrity of physical security controls and map potential paths to network access.

A comprehensive guide detailing advanced security threats in Machine Learning and AI systems. Covers model supply chain attacks (RCE via pickle, poisoning), adversarial examples (FGSM, PGD, physical-world), data privacy breaches, and LLM-specific vulnerabilities. Essential for building robust, secure AI pipelines.

A comprehensive guide to achieving compliance with the HIPAA Security Rule (45 CFR Part 164). This skill outlines the mandatory steps to protect electronic Protected Health Information (ePHI), including conducting thorough risk analyses, deploying administrative, physical, and technical safeguards, managing Business Associate Agreements (BAAs), and preparing for breach notifications and OCR audits. Essential for Covered Entities and Business Associates.

This comprehensive guide assists authors in evaluating the suitability, framing, and structural requirements for submitting research on wireless, mobile, IoT, sensing, and network security/privacy to the ACM WiSec conference. It provides critical expertise on aligning the paper's contribution type, threat model, and evidence standards with top-tier academic conference expectations, ensuring the work emphasizes the physical or network context.

This guide provides comprehensive standards for conducting and presenting experimental evidence in high-level communication journals (JOC). It emphasizes moving beyond simple results to ensure statistical rigor, reproducibility, and comprehensive coverage of physical layer, network, and security aspects, helping submissions withstand expert peer review.

This guide outlines the methodology for conducting hardware security research on embedded systems. It covers physical interface analysis (UART, JTAG, SWD), debug pad triage, secure boot evaluation, and offline firmware extraction. It emphasizes systematic, non-destructive testing protocols and responsible handling of physical devices.

A comprehensive framework for authorized security assessments of Operational Technology (OT) and Industrial Control Systems (ICS). It emphasizes a 'passive-first' approach, covering Purdue model zoning, analyzing industrial protocols (Modbus, DNP3, etc.), and identifying exposure points on SCADA/DCS environments. The methodology strictly avoids disruptive write operations on PLCs, prioritizing read-only validation and safe network analysis for physical safety.

Implement comprehensive automated database backup strategies for PostgreSQL, MySQL, and MongoDB. Configure retention policies, recovery testing, and disaster recovery procedures. Includes scripts for logical and physical backups, ensuring data integrity and security. Suitable for DevOps engineers designing backup plans and verifying RPO/RTO requirements.