# Weirdgme Claude Code Infrastructure Showcase .claude Skills Cybersecurity

> Cybersecurity Skill

- Skill: `aibot88/weirdgme-claude-code-infrastructure-showcase-claude-skills-c` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/weirdgme-claude-code-infrastructure-showcase-claude-skills-c`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/weirdgme-claude-code-infrastructure-showcase-claude-skills-c/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aibot88/weirdgme-claude-code-infrastructure-showcase-claude-skills-c

---

# Cybersecurity Skill

## Overview

Comprehensive cybersecurity guidance covering security architecture, threat modeling, security operations, incident response, application security, network security, cloud security, identity and access management, cryptography, security testing, and compliance.

## When to Use This Skill

This skill should be activated when:
- Designing security architectures
- Implementing security controls
- Conducting threat modeling
- Setting up security operations
- Responding to security incidents
- Securing applications and APIs
- Implementing network security
- Securing cloud environments
- Managing identity and access
- Implementing cryptographic solutions
- Performing security testing
- Achieving security compliance

## Core Security Domains

### 1. Security Architecture & Design

**Principles:**
- Zero Trust Architecture
- Defense in Depth
- Least Privilege
- Separation of Duties
- Fail Secure
- Security by Design

**Architecture Patterns:**
- Segmented network architecture
- Micro-segmentation
- Perimeter security
- Defense in depth layering
- Security zones and enclaves
- DMZ architecture
- Bastion host patterns

### 2. Threat Modeling & Risk Management

**Frameworks:**
- STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
- PASTA (Process for Attack Simulation and Threat Analysis)
- DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability)
- OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)

**Process:**
1. Identify assets
2. Identify threats
3. Assess vulnerabilities
4. Determine risk
5. Implement mitigations
6. Validate and monitor

### 3. Security Operations (SecOps)

**Key Components:**
- Security Operations Center (SOC)
- Security Information and Event Management (SIEM)
- Security Orchestration, Automation, and Response (SOAR)
- Intrusion Detection/Prevention Systems (IDS/IPS)
- Endpoint Detection and Response (EDR)
- Extended Detection and Response (XDR)

**Processes:**
- Continuous monitoring
- Log aggregation and analysis
- Threat intelligence integration
- Alert triage and investigation
- Incident escalation
- Threat hunting
- Vulnerability management
- Patch management

### 4. Incident Response

**Phases:**
1. **Preparation:** IR plan, team, tools, training
2. **Identification:** Detect and determine scope
3. **Containment:** Short-term and long-term containment
4. **Eradication:** Remove threat and vulnerabilities
5. **Recovery:** Restore systems to normal
6. **Lessons Learned:** Post-incident review

**Key Artifacts:**
- Incident Response Plan
- Playbooks/Runbooks
- Communication plan
- Evidence handling procedures
- Chain of custody documentation
- Post-incident reports

### 5. Application Security (AppSec)

**Secure Development:**
- Secure SDLC (SSDLC)
- Security requirements
- Threat modeling in design
- Secure coding practices
- Code review
- Security testing

**Security Testing:**
- Static Application Security Testing (SAST)
- Dynamic Application Security Testing (DAST)
- Interactive Application Security Testing (IAST)
- Software Composition Analysis (SCA)
- Penetration testing
- Bug bounty programs

**Common Vulnerabilities:**
- OWASP Top 10
- SQL Injection
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Insecure deserialization
- Security misconfiguration
- Broken authentication
- Sensitive data exposure

### 6. Network Security

**Controls:**
- Firewalls (next-gen, web application)
- Network segmentation
- VLANs and VXLANs
- VPN (IPSec, SSL/TLS)
- Network Access Control (NAC)
- Intrusion Detection/Prevention
- DDoS protection
- DNS security (DNSSEC)

**Monitoring:**
- Network traffic analysis
- NetFlow/sFlow analysis
- Packet capture and analysis
- Anomaly detection
- Threat intelligence feeds

### 7. Cloud Security

**Shared Responsibility Model:**
- Cloud provider responsibilities
- Customer responsibilities
- Different models: IaaS, PaaS, SaaS

**Cloud Security Controls:**
- Cloud Security Posture Management (CSPM)
- Cloud Workload Protection Platform (CWPP)
- Cloud Access Security Broker (CASB)
- Secure configuration
- Identity and access management
- Encryption (at-rest, in-transit)
- Key management
- Logging and monitoring
- Compliance validation

**Cloud-Specific Threats:**
- Misconfigured storage buckets
- Excessive IAM permissions
- Unencrypted data
- Exposed secrets
- Vulnerable container images
- Supply chain attacks

### 8. Identity & Access Management (IAM)

**Core Concepts:**
- Authentication vs Authorization
- Single Sign-On (SSO)
- Multi-Factor Authentication (MFA)
- Privileged Access Management (PAM)
- Identity Federation
- Just-In-Time (JIT) access
- Zero Trust Network Access (ZTNA)

**Technologies:**
- Active Directory / Azure AD
- LDAP
- SAML 2.0
- OAuth 2.0 / OpenID Connect
- Kerberos
- RADIUS
- TACACS+

**Best Practices:**
- Principle of least privilege
- Regular access reviews
- Strong password policies
- MFA enforcement
- Service account management
- Privileged account monitoring
- Identity lifecycle management

### 9. Cryptography

**Fundamentals:**
- Symmetric encryption (AES, ChaCha20)
- Asymmetric encryption (RSA, ECC)
- Hash functions (SHA-256, SHA-3)
- Digital signatures
- Message Authentication Codes (MAC)
- Key derivation functions (KDF)

**Implementations:**
- TLS/SSL configuration
- Certificate management
- Public Key Infrastructure (PKI)
- Hardware Security Modules (HSM)
- Key Management Systems (KMS)
- Encryption key rotation
- Perfect Forward Secrecy (PFS)

**Post-Quantum Cryptography:**
- NIST PQC candidates
- Hybrid approaches
- Migration planning

### 10. Security Testing & Assessment

**Types:**
- Vulnerability Assessment
- Penetration Testing (black box, white box, gray box)
- Red Team Exercises
- Purple Team Exercises
- Bug Bounty Programs
- Security Audits
- Compliance Assessments

**Methodologies:**
- OWASP Testing Guide
- PTES (Penetration Testing Execution Standard)
- OSSTMM (Open Source Security Testing Methodology Manual)
- NIST SP 800-115

**Tools:**
- Vulnerability scanners (Nessus, Qualys, OpenVAS)
- Web app scanners (Burp Suite, OWASP ZAP)
- Network scanners (Nmap, Masscan)
- Exploitation frameworks (Metasploit)
- Password crackers (John, Hashcat)
- Social engineering (GoPhish)

### 11. Compliance & Governance

**Frameworks:**
- NIST Cybersecurity Framework (CSF)
- ISO/IEC 27001/27002
- CIS Controls
- COBIT
- NIST SP 800-53
- PCI DSS
- HIPAA Security Rule
- GDPR
- SOC 2
- FedRAMP
- CMMC

**Key Activities:**
- Policy development
- Standards documentation
- Control implementation
- Compliance monitoring
- Audit preparation
- Evidence collection
- Risk assessments
- Gap analysis

## Security by Domain

### Commercial/Enterprise Security
- Corporate network security
- Endpoint protection
- Email security
- Data loss prevention (DLP)
- Insider threat programs
- Security awareness training
- Third-party risk management
- Supply chain security

### Government/Cleared Security
- Classified information handling
- SCIF security requirements
- TEMPEST protection
- Cross-domain solutions
- Secure communications (HAIPE, COMSEC)
- Personnel security (clearances)
- Physical security integration
- Continuous monitoring programs

### Cloud-Native Security
- Container security
- Kubernetes security
- Serverless security
- API security
- DevSecOps integration
- Secrets management
- Service mesh security
- Infrastructure as Code security

## Common Security Patterns

### 1. Zero Trust Implementation
```
┌─────────────────────────────────────────┐
│         Zero Trust Architecture         │
├─────────────────────────────────────────┤
│ • Verify explicitly (every access)      │
│ • Least privilege access                │
│ • Assume breach                         │
│                                         │
│ Components:                             │
│ ├─ Identity Provider (IdP)             │
│ ├─ Policy Decision Point (PDP)         │
│ ├─ Policy Enforcement Point (PEP)      │
│ ├─ Continuous monitoring               │
│ └─ Analytics and threat intelligence   │
└─────────────────────────────────────────┘
```

### 2. Defense in Depth Layers
```
┌─────────────────────────────────────────┐
│ Layer 1: Physical Security             │
├─────────────────────────────────────────┤
│ Layer 2: Network Perimeter             │
├─────────────────────────────────────────┤
│ Layer 3: Network Segmentation          │
├─────────────────────────────────────────┤
│ Layer 4: Endpoint Security             │
├─────────────────────────────────────────┤
│ Layer 5: Application Security          │
├─────────────────────────────────────────┤
│ Layer 6: Data Security                 │
├─────────────────────────────────────────┤
│ Layer 7: Security Monitoring           │
└─────────────────────────────────────────┘
```

### 3. Incident Response Workflow
```
Detection → Triage → Investigation → Containment →
Eradication → Recovery → Lessons Learned →
Update Defenses → Monitor
```

## Integration with Other Skills

- **devsecops**: Security in CI/CD pipelines, compliance automation
- **cloud-engineering**: Cloud security architecture, CSPM
- **infrastructure-architecture**: Secure architecture design, threat modeling
- **network-engineering**: Network security controls, segmentation
- **platform-engineering**: Container/K8s security, secrets management
- **observability-engineering**: Security monitoring, SIEM integration
- **sre**: Incident response, security monitoring

## Resources

See the `resources/` directory for detailed guides on:
- Security architecture patterns
- Threat modeling guides
- Incident response playbooks
- Security testing methodologies
- Cryptography implementation guides
- Compliance frameworks
- Security tools and technologies

## Quick Reference

### Security Assessment Questions
1. What assets are we protecting?
2. What are the threats?
3. What are the vulnerabilities?
4. What is the risk level?
5. What controls are in place?
6. What is the residual risk?
7. Are we compliant with requirements?
8. How do we detect incidents?
9. How do we respond?
10. How do we improve?

### Common Security Acronyms
- CIA: Confidentiality, Integrity, Availability
- AAA: Authentication, Authorization, Accounting
- IDS/IPS: Intrusion Detection/Prevention System
- SIEM: Security Information and Event Management
- SOAR: Security Orchestration, Automation, and Response
- EDR: Endpoint Detection and Response
- XDR: Extended Detection and Response
- CASB: Cloud Access Security Broker
- CSPM: Cloud Security Posture Management
- CWPP: Cloud Workload Protection Platform
- PAM: Privileged Access Management
- ZTNA: Zero Trust Network Access
- MFA: Multi-Factor Authentication
- SSO: Single Sign-On

---
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🎯 SKILL ACTIVATED: cybersecurity
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━


**Remember:** Security is not a product, it's a process. Continuous improvement and adaptation are essential.