Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-google-workspace-phishing-protection/references/standards.md

@@ -0,0 +1,31 @@
+# Standards & References: Google Workspace Phishing Protection
+
+## Google Workspace Security Settings Path
+- Admin Console > Apps > Google Workspace > Gmail > Safety
+- Admin Console > Security > Gmail Enhanced Safe Browsing
+- Admin Console > Apps > Google Workspace > Gmail > Authenticate email
+
+## MITRE ATT&CK References
+- **T1566.001**: Phishing: Spearphishing Attachment
+- **T1566.002**: Phishing: Spearphishing Link
+- **T1656**: Impersonation
+- **T1586.002**: Compromise Accounts: Email Accounts
+
+## Key Protection Settings
+| Setting | Location | Default | Recommended |
+|---|---|---|---|
+| Domain spoofing protection | Safety | Off | On - Quarantine |
+| Employee name spoofing | Safety | Off | On - Warning |
+| Pre-delivery scanning | Safety | On | On (enhanced) |
+| Attachment protection | Safety | Partial | Full - all options |
+| Enhanced Safe Browsing | Security | Off | On |
+| Gmail Security Sandbox | Safety | Off | On (Enterprise) |
+
+## Google Workspace License Requirements
+| Feature | Business Starter | Business Standard | Enterprise |
+|---|---|---|---|
+| Basic phishing protection | Yes | Yes | Yes |
+| Enhanced pre-delivery scanning | Yes | Yes | Yes |
+| Gmail Security Sandbox | No | No | Yes |
+| Security Investigation Tool | No | Partial | Yes |
+| Advanced Protection Program | Yes | Yes | Yes |

skills/implementing-google-workspace-phishing-protection/references/workflows.md

@@ -0,0 +1,60 @@
+# Workflows: Google Workspace Phishing Protection
+
+## Workflow 1: Gmail Inbound Protection Pipeline
+
+```
+Inbound email arrives at Gmail
+  |
+  v
+[Connection-level checks]
+  +-- IP reputation
+  +-- SPF validation
+  +-- DKIM verification
+  +-- DMARC evaluation
+  |
+  v
+[Enhanced Pre-Delivery Scanning]
+  +-- Content analysis for phishing indicators
+  +-- URL expansion (shortened URLs)
+  +-- Image scanning for embedded phishing
+  +-- NLP analysis for social engineering
+  |
+  v
+[Attachment Protection]
+  +-- File type analysis
+  +-- Script detection in attachments
+  +-- Encrypted attachment from untrusted sender check
+  +-- Security Sandbox detonation (Enterprise)
+  |
+  v
+[Spoofing Detection]
+  +-- Domain name similarity check
+  +-- Employee name impersonation check
+  +-- Internal domain spoofing check
+  |
+  v
+[Delivery decision]
+  +-- DELIVER: Clean message to inbox
+  +-- WARN: Deliver with yellow warning banner
+  +-- SPAM: Route to spam folder
+  +-- QUARANTINE: Hold for admin review
+  +-- REJECT: Block delivery entirely
+```
+
+## Workflow 2: Safe Browsing URL Protection
+
+```
+User clicks URL in Gmail
+  |
+  v
+[Enhanced Safe Browsing check]
+  +-- Real-time URL reputation lookup
+  +-- Check against known phishing database
+  +-- Dynamic page analysis
+  |
+  v
+[Decision]
+  +-- SAFE: Allow navigation
+  +-- DANGEROUS: Display full-page warning
+  +-- SUSPICIOUS: Display interstitial warning
+```