nomarj OWASP Security Skill Framework for Enclave AI
Overview
Comprehensive OWASP security knowledge base and automation framework for the Enclave AI platform. Provides specialized security expertise for air-gap environments, OWASP Top 10 compliance, and enterprise security requirements.
Specialized Security Agents
Core OWASP Specialists
owasp-injection-specialist - A03 Injection vulnerabilities
- SQL injection prevention and remediation
- Command injection security for air-gap environments
- NoSQL injection protection for DynamoDB
- XSS prevention in React components
- Code injection via eval/Function detection
owasp-auth-specialist - A07 Authentication failures
- JWT security implementation
- OAuth2/OIDC integration
- Session management for air-gap environments
- Multi-factor authentication
- Authentication bypass prevention
owasp-access-control-specialist - A01 Broken access control
- Role-based access control (RBAC) implementation
- Workspace isolation for multi-tenant security
- IAM policy validation
- Privilege escalation prevention
- Administrative control protection
owasp-crypto-specialist - A02 Cryptographic failures
- AWS KMS integration for air-gap environments
- TLS/SSL configuration
- Secure random number generation
- Password hashing best practices
- Secrets management and rotation
owasp-data-specialist - A09 Security logging and monitoring
- Comprehensive audit logging
- Security event detection and correlation
- Log integrity and tamper protection
- Compliance monitoring (SOC2, GDPR, HIPAA)
- Incident response automation
Security Automation Commands
Primary Commands
owasp-scan - Comprehensive vulnerability scanning
- Full OWASP Top 10 analysis
- Air-gap compatible security validation
- Integration with Sigil scanner
- Compliance reporting (SOC2, GDPR)
- Executive summary generation
security-training - Automated security education
- Interactive OWASP training modules
- Hands-on vulnerability labs
- Air-gap security best practices
- TDD security workflow training
- Certification and progress tracking
vuln-fix - Automated vulnerability remediation
- Guided security fixes
- Critical issue prioritization
- Air-gap compatible solutions
- Comprehensive validation testing
- Continuous monitoring setup
Knowledge Base Structure
Core Security Patterns
Air-Gap Security Requirements
- Network isolation validation
- Container security boundaries
- PrivateLink endpoint configuration
- Zero external dependency verification
- VPC security group management
OWASP Top 10 Compliance
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable and Outdated Components
- A07: Identification and Authentication Failures
- A08: Software and Data Integrity Failures
- A09: Security Logging and Monitoring Failures
- A10: Server-Side Request Forgery (SSRF)
Enterprise Compliance
- SOC2 Type II requirements
- GDPR data protection standards
- HIPAA healthcare security
- PCI-DSS payment security
- ISO 27001 information security
Usage Patterns
Proactive Security Scanning
# Daily security validation
/owasp-scan --comprehensive --air-gap
# Pre-deployment security check
/owasp-scan --critical-only --block-on-failure
# Compliance audit
/owasp-scan --compliance SOC2 --generate-report
Reactive Vulnerability Management
# Emergency security remediation
/vuln-fix --severity critical --immediate
# Guided security training after incidents
/security-training --focus authentication --post-incident
# Comprehensive security assessment
/owasp-scan --full-assessment --executive-summary
Continuous Security Improvement
# Weekly security training
/security-training --role developer --weekly-module
# Monthly security assessment
/owasp-scan --monthly-review --trend-analysis
# Quarterly compliance audit
/owasp-scan --compliance-full --quarterly-report
Integration Points
Development Workflow
- Pre-commit security hooks
- CI/CD pipeline integration
- Pull request security reviews
- Automated remediation suggestions
Monitoring and Alerting
- Real-time security event detection
- Automated incident response
- Compliance violation alerts
- Executive security reporting
Training and Education
- Role-based security training tracks
- Hands-on vulnerability laboratories
- Certification programs
- Progress tracking and assessment
Air-Gap Environment Considerations
Offline Security Validation
- No external dependency scanning
- Local vulnerability databases
- Container-based security tools
- Internal certificate management
Network Isolation
- VPC-only communication patterns
- PrivateLink endpoint validation
- Container network segmentation
- Internal DNS resolution
Data Protection
- KMS encryption for all data at rest
- TLS 1.3 for data in transit
- Workspace-based data isolation
- Audit trail immutability
Compliance Frameworks
SOC2 Type II Controls
- CC6.1: Logical and physical access controls
- CC6.2: Transmission and disposal of information
- CC6.3: Network communications protection
- CC6.6: Vulnerability management
- CC6.7: System monitoring
GDPR Requirements
- Article 25: Data protection by design and default
- Article 32: Security of processing
- Article 33: Notification of data breach
- Article 35: Data protection impact assessment
HIPAA Safeguards
- Administrative safeguards (164.308)
- Physical safeguards (164.310)
- Technical safeguards (164.312)
- Organizational requirements (164.314)
Security Metrics and KPIs
Risk Assessment
- Overall security posture score (0-50 scale)
- Critical vulnerability count
- Mean time to remediation (MTTR)
- Security debt accumulation
Compliance Tracking
- Control effectiveness percentages
- Audit readiness scores
- Compliance gap analysis
- Regulatory requirement coverage
Training Effectiveness
- Developer security knowledge scores
- Training completion rates
- Incident reduction metrics
- Security-first development adoption
Continuous Improvement
Learning from Incidents
- Post-incident security analysis
- Root cause identification
- Process improvement recommendations
- Prevention strategy updates
Industry Best Practices
- OWASP guideline updates
- Security framework evolution
- Threat landscape monitoring
- Emerging vulnerability tracking
Tool and Process Enhancement
- Security automation improvements
- Agent capability expansion
- Training program refinement
- Compliance framework updates
This skill framework provides comprehensive OWASP security expertise specifically tailored for the Enclave AI platform's unique air-gap and enterprise requirements.