Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-image-provenance-verification-with-cosign/references/standards.md

@@ -0,0 +1,36 @@
+# Standards and References - Image Provenance with Cosign
+
+## SLSA Framework (Supply-chain Levels for Software Artifacts)
+- Level 1: Documentation of build process
+- Level 2: Source version controlled + signed provenance
+- Level 3: Hardened build platform, non-falsifiable provenance
+- Level 4: Two-party review, hermetic reproducible builds
+
+## NIST SP 800-190
+- Section 4.1: Image vulnerabilities - Verify image integrity before deployment
+- Section 5.1: Image security - Cryptographic signing and verification
+
+## Executive Order 14028 (Improving the Nation's Cybersecurity)
+- Section 4(e): SBOM requirements for software supply chain
+- Section 4(g): Software supply chain security guidelines
+
+## Sigstore Components
+
+| Component | Purpose | URL |
+|-----------|---------|-----|
+| Cosign | Container signing/verification | https://github.com/sigstore/cosign |
+| Fulcio | Free code signing CA | https://fulcio.sigstore.dev |
+| Rekor | Transparency log | https://rekor.sigstore.dev |
+| policy-controller | K8s admission enforcement | https://github.com/sigstore/policy-controller |
+
+## Compliance Mappings
+
+### PCI DSS v4.0
+- Req 6.3.2: Develop software securely with integrity verification
+
+### SOC 2
+- CC8.1: Change management with cryptographic verification
+
+### FedRAMP
+- SA-12: Supply chain protection
+- SI-7: Software, firmware, and information integrity

skills/implementing-image-provenance-verification-with-cosign/references/workflows.md

@@ -0,0 +1,41 @@
+# Workflow - Image Provenance with Cosign
+
+## Phase 1: Setup
+1. Install cosign CLI
+2. Choose signing method: keyless (recommended) or key-based
+3. If key-based: generate keys, store private key in KMS
+4. Configure CI/CD OIDC token for keyless signing
+
+## Phase 2: Build Pipeline Integration
+1. Build container image
+2. Push to registry (by digest)
+3. Sign image with cosign (keyless or key-based)
+4. Generate SBOM with syft
+5. Attach SBOM as attestation
+6. Attach vulnerability scan as attestation
+
+## Phase 3: Admission Enforcement
+1. Deploy policy-controller or Kyverno
+2. Create ClusterImagePolicy requiring signatures
+3. Test with signed image (should pass)
+4. Test with unsigned image (should be denied)
+5. Enable enforcement in production namespaces
+
+## Phase 4: Verification
+```bash
+# Manual verification
+cosign verify --certificate-identity=CI_IDENTITY \
+  --certificate-oidc-issuer=ISSUER \
+  IMAGE@DIGEST
+
+# Verify SBOM attestation
+cosign verify-attestation --type cyclonedx \
+  --certificate-identity=CI_IDENTITY \
+  --certificate-oidc-issuer=ISSUER \
+  IMAGE@DIGEST
+```
+
+## Phase 5: Monitoring
+1. Check Rekor transparency log for audit trail
+2. Monitor admission controller deny events
+3. Alert on unsigned image deployment attempts