Skill UI

A comprehensive guide for deploying and managing network deception systems using industry-leading honeypot platforms like OpenCanary, T-Pot, and Cowrie. This skill helps security professionals detect unauthorized access attempts, trace lateral movement, and gather critical threat intelligence by simulating vulnerable services within a controlled environment. Ideal for enhancing network security architecture and creating early warning indicators for intrusions.

A comprehensive guide to implementing Kubernetes NetworkPolicies, which enforce granular ingress and egress rules at the pod level. This skill enables zero-trust microsegmentation by defining default-deny rules, allowing specific traffic flows (like DNS or inter-service communication), and blocking sensitive access (e.g., cloud metadata). Essential for securing containerized workloads and preventing lateral movement within a cluster.

This comprehensive guide details how to implement robust privileged session monitoring and recording using advanced PAM solutions like CyberArk PSM. It covers critical aspects including architecting network controls (routing all access through proxies), configuring keystroke logging and session recording for RDP/SSH, and establishing real-time monitoring rules. Essential for meeting strict compliance requirements (e.g., PCI-DSS, SOX, HIPAA) and generating non-repudiable audit trails.

Tetragon is a CNCF project that provides advanced, high-performance runtime security observability and enforcement for Kubernetes clusters. By utilizing eBPF, it operates directly at the Linux kernel level to monitor and enforce policies on process execution, file system access, network traffic, and dangerous system calls (syscalls). It offers low-overhead threat detection, making it essential for securing containerized environments against container escapes and unauthorized activity.

This comprehensive guide details the implementation of Zero Trust Architecture (ZTA) across major multi-cloud platforms (AWS, Azure, GCP), adhering to NIST SP 800-207 and BeyondCorp principles. It covers identity-centric access, micro-segmentation, continuous risk assessment, and deploying Identity-Aware Proxies to secure modern, distributed workloads without relying on traditional network perimeters.

This guide details implementing Zero Trust Network Access (ZTNA) across major cloud providers (AWS, Azure, GCP). It replaces traditional VPNs by enforcing identity-based, context-aware access controls using identity-aware proxies and micro-segmentation. Use it to secure cloud workloads, limit lateral movement, and comply with modern security standards like BeyondCorp.

This skill guides the end-to-end deployment of Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). It enables secure, granular, and context-aware access to internal applications without placing users on the corporate network. Ideal for hybrid and remote workforces needing robust security controls and regulatory compliance beyond traditional VPN limitations.

Provides a comprehensive guide to implementing the Zero Trust security model using Google BeyondCorp Enterprise. It configures the Identity-Aware Proxy (IAP) to enforce access decisions based on granular context (user identity, device posture, network attributes), moving away from traditional network perimeters. Ideal for securing sensitive GCP resources and meeting compliance requirements.

This guide provides a comprehensive framework for assessing the security posture of the Kubernetes etcd cluster. Since etcd stores all critical cluster data (Secrets, RBAC policies), compromising it is a high-risk event. The assessment covers mandatory checks for encryption at rest, TLS transport security, strict access control, secure backup procedures, and network isolation, ensuring compliance and hardening the control plane.

Open Source Intelligence (OSINT) is the critical first phase of red team engagements. This guide details how to systematically collect publicly available data about a target organization. It covers mapping network assets (domains, IPs), identifying personnel for social engineering, discovering credential leaks, and mapping the entire technology stack. Use this skill during authorized security assessments to build comprehensive attack surface maps and initial access strategies.

This comprehensive guide details physical intrusion assessment methodologies, simulating real-world security threats. Techniques covered include tailgating, RFID badge cloning, mechanical lock bypassing, and deploying rogue network devices. It is designed for full-scope red team engagements to evaluate the integrity of physical security controls and map potential paths to network access.

This skill simulates advanced Layer 2 network attacks, including VLAN hopping, using techniques like switch spoofing (DTP) and 802.1Q double tagging. It is designed exclusively for authorized penetration testing environments to validate network segmentation, test trunk port hardening, and assess the risk of unauthorized VLAN access across the network infrastructure.