Skill UI

This comprehensive guide details security best practices for hardening Docker containers and their underlying infrastructure (daemon, runtime, images). It aligns with standards like the CIS Docker Benchmark v1.8.0, enforcing least privilege through non-root users, capability dropping, read-only filesystems, and advanced security profiles (seccomp/AppArmor). Essential for building highly secure, compliant, and production-ready container environments.

This guide details how to harden the Docker daemon configuration using daemon.json. It implements critical security measures such as user namespace remapping, disabling inter-container communication (ICC), enforcing no-new-privileges, and setting up TLS client authentication. Use this when aiming to prevent container breakout, privilege escalation, or meeting CIS benchmark compliance requirements.

Learn how to implement robust container security by integrating the open-source Trivy scanner (from Aqua Security) into your CI/CD pipelines. This guide covers scanning container images, Kubernetes manifests, IaC files, and code repositories to detect critical vulnerabilities, misconfigurations, secrets, and generating Software Bill of Materials (SBOM) for comprehensive supply chain security.

A comprehensive guide detailing how to implement Microsoft Defender for Cloud across various workloads (VMs, containers, SQL, storage) to achieve continuous security monitoring and compliance assessment. This process utilizes Azure Policy, Log Analytics, and Azure Arc for holistic protection, enabling adaptive remediation and meeting stringent regulatory requirements like PCI-DSS and CIS standards.

This guide details implementing robust code signing for various build artifacts, including binaries, packages, and containers. It covers both traditional GPG key-based signing and modern, keyless signing using Sigstore/cosign. Use this process to establish verifiable trust chains, ensure artifact integrity against supply-chain tampering, prove authenticity, and meet advanced security standards like SLSA.

Utilizes Google Distroless images and multi-stage Docker builds to drastically reduce container attack surface. By eliminating unnecessary OS components like shells, package managers, and core utilities, this technique is essential for hardening container security, meeting compliance requirements, or mitigating risks associated with bloated base images.

This skill guides the implementation and auditing of advanced network segmentation within Kubernetes using Calico. It enables establishing zero-trust microsegmentation by creating and managing NetworkPolicy and GlobalNetworkPolicy resources. Use this to strictly control pod-to-pod traffic, enforce namespace isolation, restrict egress rules, and apply DNS-based security policies, significantly hardening your cluster's security posture.

This guide details the implementation of GCP Binary Authorization, a crucial deploy-time security control. It ensures that only trusted, verified container images are deployed on GKE or Cloud Run by requiring cryptographic attestations. Learn how to set up KMS-backed attestors, configure policies, and integrate the validation process into your CI/CD pipeline to enforce robust supply chain integrity.

This skill details implementing robust container supply chain security using Cosign, a Sigstore tool. It supports both key-based and keyless (OIDC) signing, integrating with Fulcio and Rekor. Use it to verify image provenance, attach critical attestations (like SBOMs and SLSA), and enforce secure image policies in Kubernetes environments.

Guides the implementation of Kubernetes Pod Security Standards (PSS) using the Pod Security Admission (PSA) controller. This process involves labeling namespaces with security profiles (Privileged, Baseline, Restricted) and enforcing policies via 'enforce', 'audit', or 'warn' modes. It is crucial for hardening container workloads, migrating away from deprecated PodSecurityPolicy, and ensuring compliance at the namespace level.

This guide details implementing microsegmentation using Akamai Guardicore Segmentation. It helps map application dependencies, visualize east-west traffic flows, and establish granular, least-privilege network policies across diverse environments (VMs, containers, bare metal, cloud). Essential for achieving zero-trust architecture and meeting compliance standards like PCI DSS or HIPAA by preventing lateral movement.

This skill guides the implementation of Mobile Application Management (MAM) policies, enabling robust data protection for corporate assets on both managed and unmanaged mobile devices (BYOD). It covers configuring app-level controls such as Data Loss Prevention (DLP), selective wiping, and containerization using platforms like Microsoft Intune and Azure AD. Use this when enforcing data separation between personal and work environments without requiring full device enrollment.