KESE Security Vulnerability Assessment
Perform comprehensive security vulnerability assessment based on KISA guidelines. Automatically selects the appropriate guideline based on user context.
Guideline Selection
| # |
Guideline |
Description |
Items |
| 1 |
CII (Critical Information Infrastructure) |
Technical(424)+Administrative(127)+Physical(18) |
~560 |
| 2 |
AI Security |
AI Developer/Service Provider/User requirements |
~54 |
| 3 |
Robot Security |
Industrial/Service/Medical robot checklist (11 categories) |
~103 |
| 4 |
Space Security |
Satellite/GSaaS/Supply chain checklist (12 domains) |
53 |
| 5 |
Secure Coding |
JavaScript/Python secure coding (7 categories, 46 CWE) |
46 |
| 6 |
Zero Trust |
Zero Trust maturity assessment (8 elements, 4 maturity levels) |
~396 |
| 7 |
SW Supply Chain |
SBOM-based supply chain security (5 phases, 29 items) |
29 |
Auto-detection
- Servers, networks, databases, web services, firewalls → CII
- AI models, LLM, generative AI, machine learning, prompts → AI Security
- Robots, industrial robots, service robots, medical robots, ROS/ROS2, PLC-linked robot systems → Robot Security
- Satellites, ground stations, GSaaS, space systems, GNSS, VSAT, LEO constellation, space supply chain → Space Security
- JavaScript, Python, web application code, secure coding, CWE, OWASP → Secure Coding
- Zero Trust, ZTA, ZTNA, 제로트러스트, 마이크로세그멘테이션, microsegmentation, SDP, SASE, PEP/PDP, never trust always verify → Zero Trust
- SBOM, supply chain, 공급망, C-SCRM, SCA, CycloneDX, SPDX, npm audit, pip-audit, software bill of materials, 소프트웨어 공급망 → SW Supply Chain
CII Branch
Read the appropriate reference file from templates/cii/ based on the target system.
| System |
Reference File |
Items |
| Unix/Linux |
templates/cii/unix.md |
67 |
| Windows Server |
templates/cii/windows.md |
64 |
| Web Service |
templates/cii/web-service.md |
26 |
| Security Equipment |
templates/cii/security-equip.md |
23 |
| Network Equipment |
templates/cii/network.md |
38 |
| Control System |
templates/cii/control-system.md |
46 |
| PC |
templates/cii/pc.md |
18 |
| DBMS |
templates/cii/database.md |
26 |
| Mobile |
templates/cii/mobile.md |
4 |
| Web Application |
templates/cii/webapp.md |
21 |
| Virtualization |
templates/cii/virtualization.md |
25 |
| Cloud |
templates/cii/cloud.md |
19 |
| Administrative |
templates/cii/admin.md |
127 |
| Physical |
templates/cii/physical.md |
18 |
Check commands available in scripts/cii/ directory.
Judgment Criteria
- Pass: Security settings properly applied
- Partial: Partially implemented, improvement needed
- Fail: Vulnerability exists
- N/A: Not applicable to the environment
AI Security Branch
Read from references/ai-security/ for overview and guidance, and templates/ai-security/ for assessment checklists.
| Target |
Reference File |
| Overview |
references/ai-security/overview.md |
| AI Developer |
templates/ai-security/developer.md |
| Service Provider |
references/ai-security/service-provider.md |
| User |
references/ai-security/user-guide.md |
6-stage lifecycle: Planning → Data → Model Dev → Deploy → Monitoring → Decommission
Robot Security Branch
Read from templates/robot-security/ based on the target robot system or concern.
| Topic |
Reference File |
| Overview |
templates/robot-security/overview.md |
| SSDF / secure software development |
templates/robot-security/ssdf.md |
| Supply chain security |
templates/robot-security/supply-chain.md |
| IEC 62443 controls (IA, UC, SI, DP, DFR, ER, RA) |
templates/robot-security/iec62443.md |
| Cyber resilience |
templates/robot-security/cyber-resilience.md |
| Wireless security |
templates/robot-security/wireless.md |
Assess the relevant categories for industrial, service, or medical robots and generate a dedicated reports/robot-security/ summary when robot security is selected.
Space Security Branch
Read from references/space-security/ for overview and supply chain guidance, and templates/space-security/ for assessment checklists.
| Topic |
Reference File |
| Overview |
references/space-security/overview.md |
| Access Control & Authentication (AC, IA) |
templates/space-security/access-control.md |
| System & Communication Security (SC, SI) |
templates/space-security/system-security.md |
| Operations & Incident Response (SO, IR) |
templates/space-security/operations.md |
| Governance, Personnel, Physical, Risk, Contingency (PS, PE, RA, SG, CP) |
templates/space-security/governance.md |
| Supply Chain Management (SM) + Threat Scenarios |
references/space-security/supply-chain.md |
12 domains, 53 items. Standards: CMMC, K-RMF, NIS2, ISMS-P. Generate reports in reports/space-security/.
Secure Coding Branch
Read from references/secure-coding/ for overview and pseudo code patterns, and templates/secure-coding/ for language-specific assessment.
| Topic |
Reference File |
| Overview (7 categories, 49 CWE) |
references/secure-coding/overview.md |
| Pseudo Code (46 items, language-agnostic) |
references/secure-coding/pseudocode.md |
| JavaScript (Express.js, Node.js, Sequelize) |
templates/secure-coding/javascript.md |
| Python (Django, Flask, SQLAlchemy) |
templates/secure-coding/python.md |
Judgment Criteria
- Pass: Secure coding pattern applied correctly
- Partial: Pattern partially applied, improvement needed
- Fail: Vulnerable pattern detected (UNSAFE code present)
- N/A: Not applicable to the codebase
Zero Trust Branch
Read from references/zero-trust/ for overview and maturity model, and templates/zero-trust/ for assessment checklists.
| Topic |
Reference File |
| Overview |
templates/zero-trust/overview.md |
| Identity & Device |
templates/zero-trust/identity-device.md |
| Network & System |
templates/zero-trust/network-system.md |
| Application & Data |
templates/zero-trust/app-data.md |
| Visibility & Automation |
templates/zero-trust/visibility-automation.md |
| OT/ICS Environment |
templates/zero-trust/ot-environment.md |
| ZT Architecture Reference |
references/zero-trust/overview.md |
| Maturity Model Details |
references/zero-trust/maturity-model.md |
| OT Deployment Guide |
references/zero-trust/ot-guide.md |
8 core elements, ~396 items across 4 maturity levels. Standards: KISA ZT Guideline 2.0, NIST SP 800-207, CISA ZT Maturity Model.
Assessment Flow
- Determine target maturity level (Traditional/Initial/Advanced/Optimal)
- Select relevant core elements based on system context
- If OT/ICS detected, also load
ot-environment.md
- Assess items at or below target maturity level
- Generate gap analysis report
SW Supply Chain Branch
Read from references/supply-chain/ for overview and threat scenarios, and templates/supply-chain/ for assessment checklists. Use scripts/supply-chain/ for SBOM generation and vulnerability scanning commands.
| Topic |
Reference File |
| Overview (C-SCRM, SBOM, Regulations) |
references/supply-chain/overview.md |
| Assessment Overview (6 categories) |
templates/supply-chain/overview.md |
| Self-Assessment Checklist (29 items) |
templates/supply-chain/sbom-checklist.md |
| SBOM Generation Scripts |
scripts/supply-chain/sbom-generate.md |
| Vulnerability Scanning Scripts |
scripts/supply-chain/sbom-vuln-scan.md |
5 phases: Design (5) → Development (11) → Supply (3) → Operations (7) → Maintenance (3). Standards: NIST SP 800-161r1 (C-SCRM), NIST SP 800-218 (SSDF), NTIA SBOM, NIS-SBOM.
Assessment Flow
- Start with
references/supply-chain/overview.md for context
- Load
templates/supply-chain/sbom-checklist.md for the 29-item checklist
- Assess each phase (Design → Development → Supply → Operations → Maintenance)
- Critical items (SC-10, SC-14, SC-15) must ALL pass
- Use
scripts/supply-chain/sbom-generate.md for SBOM creation commands
- Use
scripts/supply-chain/sbom-vuln-scan.md for vulnerability scanning
Notes
- Do not modify files during assessment — read-only
- Mark N/A for technologies not present
- Provide specific remediation for each finding
1---2name: kesekit-start3description: Run a security vulnerability assessment based on KISA guidelines. Supports CII (560+ items), AI Security Guide, Robot Security (103 items), Space Security (satellite/GSaaS/supply chain, 12 domains, 53 items), Secure Coding (46 CWE), Zero Trust (~396 items), and SW Supply Chain Security (SBOM, 29 items). Use when "security assessment", "vulnerability scan", "CII audit", "KISA assessment", "AI security", "robot security", "space security", "satellite security", "GSaaS security", "zero trust", "ZTA", "ZTNA", "supply chain", "SBOM", "공급망", "C-SCRM".4---5
6# KESE Security Vulnerability Assessment
7
8Perform comprehensive security vulnerability assessment based on KISA guidelines. Automatically selects the appropriate guideline based on user context.
9
10## Guideline Selection
11
12| # | Guideline | Description | Items |
13|---|-----------|-------------|:-----:|
14| 1 | **CII (Critical Information Infrastructure)** | Technical(424)+Administrative(127)+Physical(18) | ~560 |
15| 2 | **AI Security** | AI Developer/Service Provider/User requirements | ~54 |
16| 3 | **Robot Security** | Industrial/Service/Medical robot checklist (11 categories) | ~103 |
17| 4 | **Space Security** | Satellite/GSaaS/Supply chain checklist (12 domains) | 53 |
18| 5 | **Secure Coding** | JavaScript/Python secure coding (7 categories, 46 CWE) | 46 |
19| 6 | **Zero Trust** | Zero Trust maturity assessment (8 elements, 4 maturity levels) | ~396 |
20| 7 | **SW Supply Chain** | SBOM-based supply chain security (5 phases, 29 items) | 29 |
21
22### Auto-detection
23- Servers, networks, databases, web services, firewalls → **CII**
24- AI models, LLM, generative AI, machine learning, prompts → **AI Security**
25- Robots, industrial robots, service robots, medical robots, ROS/ROS2, PLC-linked robot systems → **Robot Security**
26- Satellites, ground stations, GSaaS, space systems, GNSS, VSAT, LEO constellation, space supply chain → **Space Security**
27- JavaScript, Python, web application code, secure coding, CWE, OWASP → **Secure Coding**
28- Zero Trust, ZTA, ZTNA, 제로트러스트, 마이크로세그멘테이션, microsegmentation, SDP, SASE, PEP/PDP, never trust always verify → **Zero Trust**
29- SBOM, supply chain, 공급망, C-SCRM, SCA, CycloneDX, SPDX, npm audit, pip-audit, software bill of materials, 소프트웨어 공급망 → **SW Supply Chain**
30
31---
32
33## CII Branch
34
35Read the appropriate reference file from `templates/cii/` based on the target system.
36
37| System | Reference File | Items |
38|--------|---------------|:-----:|
39| Unix/Linux | `templates/cii/unix.md` | 67 |
40| Windows Server | `templates/cii/windows.md` | 64 |
41| Web Service | `templates/cii/web-service.md` | 26 |
42| Security Equipment | `templates/cii/security-equip.md` | 23 |
43| Network Equipment | `templates/cii/network.md` | 38 |
44| Control System | `templates/cii/control-system.md` | 46 |
45| PC | `templates/cii/pc.md` | 18 |
46| DBMS | `templates/cii/database.md` | 26 |
47| Mobile | `templates/cii/mobile.md` | 4 |
48| Web Application | `templates/cii/webapp.md` | 21 |
49| Virtualization | `templates/cii/virtualization.md` | 25 |
50| Cloud | `templates/cii/cloud.md` | 19 |
51| Administrative | `templates/cii/admin.md` | 127 |
52| Physical | `templates/cii/physical.md` | 18 |
53
54Check commands available in `scripts/cii/` directory.
55
56### Judgment Criteria
57- **Pass**: Security settings properly applied
58- **Partial**: Partially implemented, improvement needed
59- **Fail**: Vulnerability exists
60- **N/A**: Not applicable to the environment
61
62---
63
64## AI Security Branch
65
66Read from `references/ai-security/` for overview and guidance, and `templates/ai-security/` for assessment checklists.
67
68| Target | Reference File |
69|--------|---------------|
70| Overview | `references/ai-security/overview.md` |
71| AI Developer | `templates/ai-security/developer.md` |
72| Service Provider | `references/ai-security/service-provider.md` |
73| User | `references/ai-security/user-guide.md` |
74
756-stage lifecycle: Planning → Data → Model Dev → Deploy → Monitoring → Decommission
76
77---
78
79## Robot Security Branch
80
81Read from `templates/robot-security/` based on the target robot system or concern.
82
83| Topic | Reference File |
84|-------|---------------|
85| Overview | `templates/robot-security/overview.md` |
86| SSDF / secure software development | `templates/robot-security/ssdf.md` |
87| Supply chain security | `templates/robot-security/supply-chain.md` |
88| IEC 62443 controls (IA, UC, SI, DP, DFR, ER, RA) | `templates/robot-security/iec62443.md` |
89| Cyber resilience | `templates/robot-security/cyber-resilience.md` |
90| Wireless security | `templates/robot-security/wireless.md` |
91
92Assess the relevant categories for industrial, service, or medical robots and generate a dedicated `reports/robot-security/` summary when robot security is selected.
93
94---
95
96## Space Security Branch
97
98Read from `references/space-security/` for overview and supply chain guidance, and `templates/space-security/` for assessment checklists.
99
100| Topic | Reference File |
101|-------|---------------|
102| Overview | `references/space-security/overview.md` |
103| Access Control & Authentication (AC, IA) | `templates/space-security/access-control.md` |
104| System & Communication Security (SC, SI) | `templates/space-security/system-security.md` |
105| Operations & Incident Response (SO, IR) | `templates/space-security/operations.md` |
106| Governance, Personnel, Physical, Risk, Contingency (PS, PE, RA, SG, CP) | `templates/space-security/governance.md` |
107| Supply Chain Management (SM) + Threat Scenarios | `references/space-security/supply-chain.md` |
108
10912 domains, 53 items. Standards: CMMC, K-RMF, NIS2, ISMS-P. Generate reports in `reports/space-security/`.
110
111---
112
113## Secure Coding Branch
114
115Read from `references/secure-coding/` for overview and pseudo code patterns, and `templates/secure-coding/` for language-specific assessment.
116
117| Topic | Reference File |
118|-------|---------------|
119| Overview (7 categories, 49 CWE) | `references/secure-coding/overview.md` |
120| Pseudo Code (46 items, language-agnostic) | `references/secure-coding/pseudocode.md` |
121| JavaScript (Express.js, Node.js, Sequelize) | `templates/secure-coding/javascript.md` |
122| Python (Django, Flask, SQLAlchemy) | `templates/secure-coding/python.md` |
123
124### Judgment Criteria
125- **Pass**: Secure coding pattern applied correctly
126- **Partial**: Pattern partially applied, improvement needed
127- **Fail**: Vulnerable pattern detected (UNSAFE code present)
128- **N/A**: Not applicable to the codebase
129
130---
131
132## Zero Trust Branch
133
134Read from `references/zero-trust/` for overview and maturity model, and `templates/zero-trust/` for assessment checklists.
135
136| Topic | Reference File |
137|-------|---------------|
138| Overview | `templates/zero-trust/overview.md` |
139| Identity & Device | `templates/zero-trust/identity-device.md` |
140| Network & System | `templates/zero-trust/network-system.md` |
141| Application & Data | `templates/zero-trust/app-data.md` |
142| Visibility & Automation | `templates/zero-trust/visibility-automation.md` |
143| OT/ICS Environment | `templates/zero-trust/ot-environment.md` |
144| ZT Architecture Reference | `references/zero-trust/overview.md` |
145| Maturity Model Details | `references/zero-trust/maturity-model.md` |
146| OT Deployment Guide | `references/zero-trust/ot-guide.md` |
147
1488 core elements, ~396 items across 4 maturity levels. Standards: KISA ZT Guideline 2.0, NIST SP 800-207, CISA ZT Maturity Model.
149
150### Assessment Flow
1511. Determine target maturity level (Traditional/Initial/Advanced/Optimal)
1522. Select relevant core elements based on system context
1533. If OT/ICS detected, also load `ot-environment.md`
1544. Assess items at or below target maturity level
1555. Generate gap analysis report
156
157---
158
159## SW Supply Chain Branch
160
161Read from `references/supply-chain/` for overview and threat scenarios, and `templates/supply-chain/` for assessment checklists. Use `scripts/supply-chain/` for SBOM generation and vulnerability scanning commands.
162
163| Topic | Reference File |
164|-------|---------------|
165| Overview (C-SCRM, SBOM, Regulations) | `references/supply-chain/overview.md` |
166| Assessment Overview (6 categories) | `templates/supply-chain/overview.md` |
167| Self-Assessment Checklist (29 items) | `templates/supply-chain/sbom-checklist.md` |
168| SBOM Generation Scripts | `scripts/supply-chain/sbom-generate.md` |
169| Vulnerability Scanning Scripts | `scripts/supply-chain/sbom-vuln-scan.md` |
170
1715 phases: Design (5) → Development (11) → Supply (3) → Operations (7) → Maintenance (3). Standards: NIST SP 800-161r1 (C-SCRM), NIST SP 800-218 (SSDF), NTIA SBOM, NIS-SBOM.
172
173### Assessment Flow
1741. Start with `references/supply-chain/overview.md` for context
1752. Load `templates/supply-chain/sbom-checklist.md` for the 29-item checklist
1763. Assess each phase (Design → Development → Supply → Operations → Maintenance)
1774. Critical items (SC-10, SC-14, SC-15) must ALL pass
1785. Use `scripts/supply-chain/sbom-generate.md` for SBOM creation commands
1796. Use `scripts/supply-chain/sbom-vuln-scan.md` for vulnerability scanning
180
181---
182
183## Notes
184- Do not modify files during assessment — read-only
185- Mark N/A for technologies not present
186- Provide specific remediation for each finding
aibot88