mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-30 13:19:40 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,73 @@
|
||||
# Standards and Frameworks Reference
|
||||
|
||||
## CSA Software-Defined Perimeter Specification v2.0
|
||||
|
||||
### Core Architecture
|
||||
- **SDP Controller**: Central policy and authentication authority
|
||||
- **Initiating Host (IH)**: Client device requesting access
|
||||
- **Accepting Host (AH)**: Gateway protecting backend resources
|
||||
- **Single Packet Authorization (SPA)**: Pre-authentication mechanism making services invisible
|
||||
|
||||
### SDP Workflow
|
||||
1. IH authenticates to SDP Controller
|
||||
2. Controller validates identity, device posture, and policy
|
||||
3. Controller instructs AH to accept connection from specific IH
|
||||
4. IH sends SPA packet to AH
|
||||
5. AH validates SPA and opens temporary port
|
||||
6. mTLS tunnel established between IH and AH
|
||||
7. Application traffic flows through encrypted tunnel
|
||||
|
||||
### Deployment Models
|
||||
| Model | Use Case | Architecture |
|
||||
|---|---|---|
|
||||
| Client-to-Gateway | Remote user access | IH → AH Gateway → Backend servers |
|
||||
| Client-to-Server | Direct application access | IH → AH (application server) |
|
||||
| Server-to-Server | Workload communication | IH (server) → AH (server) |
|
||||
| Gateway-to-Gateway | Site-to-site connectivity | AH₁ → Controller → AH₂ |
|
||||
|
||||
## NIST SP 800-207: SDP as Zero Trust Deployment
|
||||
|
||||
### SDP Mapping to NIST ZTA Components
|
||||
| NIST Component | SDP Equivalent |
|
||||
|---|---|
|
||||
| Policy Engine (PE) | SDP Controller policy evaluation |
|
||||
| Policy Administrator (PA) | SDP Controller session management |
|
||||
| Policy Enforcement Point (PEP) | SDP Gateway (Accepting Host) |
|
||||
|
||||
### NIST ZTA Tenets Addressed by SDP
|
||||
- All communication secured regardless of network location (mTLS tunnels)
|
||||
- Per-session access grants (dynamic SDP connections)
|
||||
- Dynamic policy evaluation (controller real-time decisions)
|
||||
- Asset integrity monitoring (device posture checks)
|
||||
|
||||
## CISA Zero Trust Maturity Model v2.0
|
||||
|
||||
### Network Pillar - SDP Alignment
|
||||
| Maturity | SDP Capability |
|
||||
|---|---|
|
||||
| Traditional | No SDP, perimeter-based VPN |
|
||||
| Initial | SDP for remote access, basic SPA |
|
||||
| Advanced | Full SDP with device posture, context-aware |
|
||||
| Optimal | Dynamic SDP with continuous verification, ML-driven |
|
||||
|
||||
## Single Packet Authorization (SPA) Technical Details
|
||||
|
||||
### SPA Packet Structure
|
||||
- Encrypted with shared key or asymmetric cryptography
|
||||
- Contains: source IP, timestamp, HMAC, requested service
|
||||
- Single UDP packet (no TCP handshake visible)
|
||||
- Anti-replay protection via timestamp and sequence number
|
||||
|
||||
### fwknop Implementation
|
||||
- Open-source SPA implementation
|
||||
- Supports AES-256 and GnuPG encryption
|
||||
- Integrates with iptables/nftables for firewall rule insertion
|
||||
- Temporary rule created for authenticated session only
|
||||
|
||||
## mTLS Configuration Standards
|
||||
|
||||
### Certificate Requirements
|
||||
- Minimum RSA 2048-bit or ECDSA P-256 keys
|
||||
- Short-lived certificates (24-72 hours) preferred
|
||||
- OCSP stapling for real-time revocation checking
|
||||
- Certificate pinning for additional security
|
||||
@@ -0,0 +1,119 @@
|
||||
# SDP Deployment Workflows
|
||||
|
||||
## Workflow 1: SDP Connection Establishment
|
||||
|
||||
```
|
||||
┌────────────┐ ┌──────────────┐ ┌────────────┐
|
||||
│ IH (Client) │ │ SDP Controller│ │ AH (Gateway)│
|
||||
└──────┬─────┘ └──────┬───────┘ └──────┬─────┘
|
||||
│ │ │
|
||||
│ 1. Authenticate │ │
|
||||
│──────────────────>│ │
|
||||
│ │ │
|
||||
│ 2. Validate ID, │ │
|
||||
│ device, policy │ │
|
||||
│ │ │
|
||||
│ 3. Auth response │ │
|
||||
│<──────────────────│ │
|
||||
│ (SPA key, AH IP) │ │
|
||||
│ │ 4. Notify AH to │
|
||||
│ │ expect IH │
|
||||
│ │────────────────────>│
|
||||
│ │ │
|
||||
│ 5. Send SPA packet│ │
|
||||
│─────────────────────────────────────────>│
|
||||
│ │ │
|
||||
│ │ 6. Validate SPA │
|
||||
│ │ Open port │
|
||||
│ │ │
|
||||
│ 7. mTLS handshake │ │
|
||||
│<════════════════════════════════════════>│
|
||||
│ │ │
|
||||
│ 8. Application │ │
|
||||
│ traffic flows │ │
|
||||
│<═══════════════════════════════════════=>│
|
||||
```
|
||||
|
||||
## Workflow 2: SDP Deployment Lifecycle
|
||||
|
||||
```
|
||||
Phase 1: Planning (Weeks 1-2)
|
||||
├── Inventory protected applications
|
||||
├── Map user-to-application access requirements
|
||||
├── Design PKI infrastructure for mTLS
|
||||
├── Select SDP solution (open-source or commercial)
|
||||
└── Plan network architecture changes
|
||||
|
||||
Phase 2: Controller Setup (Weeks 3-4)
|
||||
├── Deploy SDP controller with HA
|
||||
├── Integrate with IdP (SAML/OIDC)
|
||||
├── Configure PKI and certificate templates
|
||||
├── Define application catalog and policies
|
||||
└── Test controller authentication flow
|
||||
|
||||
Phase 3: Gateway Deployment (Weeks 5-6)
|
||||
├── Deploy gateways in each app environment
|
||||
├── Configure default-drop firewall rules
|
||||
├── Enable SPA listeners
|
||||
├── Register applications with controller
|
||||
└── Verify gateway invisibility (port scan test)
|
||||
|
||||
Phase 4: Client Rollout (Weeks 7-10)
|
||||
├── Package SDP client with certificates
|
||||
├── Deploy to pilot user group
|
||||
├── Validate end-to-end connectivity
|
||||
├── Expand to all user groups
|
||||
└── Decommission legacy VPN access
|
||||
|
||||
Phase 5: Operations (Ongoing)
|
||||
├── Monitor SDP controller and gateway health
|
||||
├── Rotate certificates on schedule
|
||||
├── Review and update access policies
|
||||
├── Conduct quarterly penetration tests
|
||||
└── Update SDP components for security patches
|
||||
```
|
||||
|
||||
## Workflow 3: SPA Validation
|
||||
|
||||
```
|
||||
Incoming Packet to Gateway
|
||||
│
|
||||
v
|
||||
┌─────────────────────┐
|
||||
│ Is it a SPA packet? │
|
||||
│ (Check magic bytes) │
|
||||
└───┬──────────┬──────┘
|
||||
│ │
|
||||
YES NO
|
||||
│ │
|
||||
v v
|
||||
┌──────────┐ ┌──────────┐
|
||||
│ Decrypt │ │ DROP │
|
||||
│ SPA data │ │ silently │
|
||||
└────┬─────┘ └──────────┘
|
||||
v
|
||||
┌─────────────────────┐
|
||||
│ Validate timestamp │
|
||||
│ (within 60s window) │
|
||||
└───┬──────────┬──────┘
|
||||
VALID EXPIRED
|
||||
│ │
|
||||
v v
|
||||
┌──────────┐ ┌──────────┐
|
||||
│ Check │ │ DROP + │
|
||||
│ HMAC │ │ Log │
|
||||
└────┬─────┘ └──────────┘
|
||||
v
|
||||
┌─────────────────────┐
|
||||
│ Verify replay │
|
||||
│ (check sequence DB) │
|
||||
└───┬──────────┬──────┘
|
||||
NEW REPLAY
|
||||
│ │
|
||||
v v
|
||||
┌──────────┐ ┌──────────┐
|
||||
│ Open port │ │ DROP + │
|
||||
│ for src IP│ │ Alert │
|
||||
│ (30s TTL) │ └──────────┘
|
||||
└──────────┘
|
||||
```
|
||||
Reference in New Issue
Block a user