security-hardening

Name: security-hardening
Author: ancoleman

152installs59forks

How to install security-hardening?

ancoleman/ai-design-components/security-hardening

$npx -y skills add ancoleman/ai-design-components --skill security-hardening

Installs into the current project.

Summary

Reduces attack surface across OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust principles. Use when hardening production infrastructure, meeting compliance requirements, or implementing defense-in-depth security.

Files · 1

View on GitHub

SKILL.md

1	# Security Hardening
2
3	## Purpose
4
5	Proactive reduction of attack surface across infrastructure layers through systematic configuration hardening, least-privilege enforcement, and automated security controls. Applies industry-standard CIS Benchmarks and zero-trust principles to operating systems, containers, cloud configurations, networks, and databases.
6
7	## When to Use This Skill
8
9	Invoke this skill when:
10	- Hardening production infrastructure before deployment
11	- Meeting compliance requirements (SOC 2, PCI-DSS, HIPAA, FedRAMP)
12	- Implementing zero-trust security architecture
13	- Reducing container or cloud misconfiguration risks
14	- Preparing for security audits or penetration tests
15	- Automating security baseline enforcement
16	- Responding to vulnerability scan findings
17
18	## Hardening Layers
19
20	Security hardening applies across five infrastructure layers:
21
22	### Layer 1: Operating System (Linux)
23	- Kernel parameter tuning (sysctl)
24	- SSH configuration hardening
25	- User and group management
26	- File system permissions and mount options
27	- Service minimization
28	- SELinux/AppArmor enforcement
29
30	### Layer 2: Container
31	- Minimal base images (Chainguard, Distroless, Alpine)
32	- Non-root container execution
33	- Read-only root filesystems
34	- Seccomp and AppArmor profiles
35	- Resource limits and capabilities dropping
36	- Pod Security Standards enforcement
37
38	### Layer 3: Cloud Configuration
39	- IAM least privilege and MFA enforcement
40	- Network security groups and NACL configuration
41	- Encryption at rest and in transit
42	- Public access blocking
43	- Logging and monitoring enablement
44	- CSPM (Cloud Security Posture Management) integration
45
46	### Layer 4: Network
47	- Default-deny network policies
48	- Network segmentation and micro-segmentation
49	- TLS/mTLS enforcement
50	- Firewall rule minimization
51	- DNS security (DNSSEC, DNS filtering)
52
53	### Layer 5: Database
54	- Authentication and authorization hardening
55	- Connection encryption (SSL/TLS)
56	- Audit logging enablement
57	- Network isolation and access control
58	- Role-based permissions with least privilege
59
60	## Core Hardening Principles
61
62	### 1. Default Deny, Explicit Allow
63	Start with all access denied, explicitly permit only required operations. Apply default-deny firewall rules and network policies, then allow specific traffic.
64
65	### 2. Least Privilege Access
66	Grant minimum permissions required for operation. Use RBAC, IAM policies with specific resources, and database roles with limited permissions (no DELETE or DDL unless required).
67
68	### 3. Defense in Depth
69	Implement multiple overlapping security controls: network firewalls, authentication, authorization, audit logging, and encryption working together.
70
71	### 4. Minimal Attack Surface
72	Remove unnecessary components, services, and permissions. Use minimal container base images, disable unused services, and drop all Linux capabilities unless required.
73
74	### 5. Fail Securely
75	On error or misconfiguration, default to secure state. Authentication failures deny access, missing configurations use restrictive defaults, and monitoring failures trigger immediate alerts.
76
77	## Hardening Priority Framework
78
79	Prioritize hardening efforts based on exposure and data sensitivity:
80
81	### Critical Priority: Internet-Facing Systems
82	Apply immediately:
83	- Container hardening (minimal images, non-root, read-only)
84	- Network segmentation (DMZ, WAF, DDoS protection)
85	- TLS termination and certificate management
86	- Rate limiting and authentication
87	- Real-time monitoring and alerting
88
89	Tools: Trivy, Falco, ModSecurity, Cloudflare
90
91	### High Priority: Systems with Sensitive Data
92	Apply before production:
93	- Encryption at rest (AES-256, KMS-managed keys)
94	- Strict access controls (RBAC, least privilege)
95	- Comprehensive audit logging
96	- Database connection encryption
97	- Regular vulnerability scanning
98
99	Tools: Checkov, Prowler, Lynis, OpenSCAP
100
101	### Standard Priority: Internal Systems
102	Apply systematically:
103	- OS hardening (CIS Benchmarks)
104	- Service minimization
105	- Patch management automation
106	- Configuration management
107	- Basic monitoring
108
109	Tools: Ansible, Puppet, kube-bench, docker-bench-security
110
111	## CIS Benchmark Integration
112
113	CIS (Center for Internet Security) Benchmarks provide industry-standard hardening guidance.
114
115	### Automated CIS Scanning
116
117	Docker CIS Benchmark:
118	```bash
119	docker run --rm -it \
120	--net host \
121	--pid host \
122	--cap-add audit_control \
123	-v /var/lib:/var/lib:ro \
124	-v /var/run/docker.sock:/var/run/docker.sock:ro \
125	-v /etc:/etc:ro \
126	docker/docker-bench-security
127	```
128
129	Kubernetes CIS Benchmark:
130	```bash
131	kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
132	kubectl logs job/kube-bench
133	```
134
135	Linux CIS Benchmark:
136	```bash
137	# Using Lynis
138	lynis audit system --quick

People who liked this also viewed

6 picks

Type

security-hardening

152installs59forks

View on GitHub

How to install security-hardening?

ancoleman/ai-design-components/security-hardening

$npx -y skills add ancoleman/ai-design-components --skill security-hardening

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security Hardening
2
3	## Purpose
4
5	Proactive reduction of attack surface across infrastructure layers through systematic configuration hardening, least-privilege enforcement, and automated security controls. Applies industry-standard CIS Benchmarks and zero-trust principles to operating systems, containers, cloud configurations, networks, and databases.
6
7	## When to Use This Skill
8
9	Invoke this skill when:
10	- Hardening production infrastructure before deployment
11	- Meeting compliance requirements (SOC 2, PCI-DSS, HIPAA, FedRAMP)
12	- Implementing zero-trust security architecture
13	- Reducing container or cloud misconfiguration risks
14	- Preparing for security audits or penetration tests
15	- Automating security baseline enforcement
16	- Responding to vulnerability scan findings
17
18	## Hardening Layers
19
20	Security hardening applies across five infrastructure layers:
21
22	### Layer 1: Operating System (Linux)
23	- Kernel parameter tuning (sysctl)
24	- SSH configuration hardening
25	- User and group management
26	- File system permissions and mount options
27	- Service minimization
28	- SELinux/AppArmor enforcement
29
30	### Layer 2: Container
31	- Minimal base images (Chainguard, Distroless, Alpine)
32	- Non-root container execution
33	- Read-only root filesystems
34	- Seccomp and AppArmor profiles
35	- Resource limits and capabilities dropping
36	- Pod Security Standards enforcement
37
38	### Layer 3: Cloud Configuration
39	- IAM least privilege and MFA enforcement
40	- Network security groups and NACL configuration
41	- Encryption at rest and in transit
42	- Public access blocking
43	- Logging and monitoring enablement
44	- CSPM (Cloud Security Posture Management) integration
45
46	### Layer 4: Network
47	- Default-deny network policies
48	- Network segmentation and micro-segmentation
49	- TLS/mTLS enforcement
50	- Firewall rule minimization
51	- DNS security (DNSSEC, DNS filtering)
52
53	### Layer 5: Database
54	- Authentication and authorization hardening
55	- Connection encryption (SSL/TLS)
56	- Audit logging enablement
57	- Network isolation and access control
58	- Role-based permissions with least privilege
59
60	## Core Hardening Principles
61
62	### 1. Default Deny, Explicit Allow
63	Start with all access denied, explicitly permit only required operations. Apply default-deny firewall rules and network policies, then allow specific traffic.
64
65	### 2. Least Privilege Access
66	Grant minimum permissions required for operation. Use RBAC, IAM policies with specific resources, and database roles with limited permissions (no DELETE or DDL unless required).
67
68	### 3. Defense in Depth
69	Implement multiple overlapping security controls: network firewalls, authentication, authorization, audit logging, and encryption working together.
70
71	### 4. Minimal Attack Surface
72	Remove unnecessary components, services, and permissions. Use minimal container base images, disable unused services, and drop all Linux capabilities unless required.
73
74	### 5. Fail Securely
75	On error or misconfiguration, default to secure state. Authentication failures deny access, missing configurations use restrictive defaults, and monitoring failures trigger immediate alerts.
76
77	## Hardening Priority Framework
78
79	Prioritize hardening efforts based on exposure and data sensitivity:
80
81	### Critical Priority: Internet-Facing Systems
82	Apply immediately:
83	- Container hardening (minimal images, non-root, read-only)
84	- Network segmentation (DMZ, WAF, DDoS protection)
85	- TLS termination and certificate management
86	- Rate limiting and authentication
87	- Real-time monitoring and alerting
88
89	Tools: Trivy, Falco, ModSecurity, Cloudflare
90
91	### High Priority: Systems with Sensitive Data
92	Apply before production:
93	- Encryption at rest (AES-256, KMS-managed keys)
94	- Strict access controls (RBAC, least privilege)
95	- Comprehensive audit logging
96	- Database connection encryption
97	- Regular vulnerability scanning
98
99	Tools: Checkov, Prowler, Lynis, OpenSCAP
100
101	### Standard Priority: Internal Systems
102	Apply systematically:
103	- OS hardening (CIS Benchmarks)
104	- Service minimization
105	- Patch management automation
106	- Configuration management
107	- Basic monitoring
108
109	Tools: Ansible, Puppet, kube-bench, docker-bench-security
110
111	## CIS Benchmark Integration
112
113	CIS (Center for Internet Security) Benchmarks provide industry-standard hardening guidance.
114
115	### Automated CIS Scanning
116
117	Docker CIS Benchmark:
118	```bash
119	docker run --rm -it \
120	--net host \
121	--pid host \
122	--cap-add audit_control \
123	-v /var/lib:/var/lib:ro \
124	-v /var/run/docker.sock:/var/run/docker.sock:ro \
125	-v /etc:/etc:ro \
126	docker/docker-bench-security
127	```
128
129	Kubernetes CIS Benchmark:
130	```bash
131	kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
132	kubectl logs job/kube-bench
133	```
134
135	Linux CIS Benchmark:
136	```bash
137	# Using Lynis
138	lynis audit system --quick

People who liked this also viewed

6 picks

Type