Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-network-policies-for-kubernetes/references/standards.md

@@ -0,0 +1,18 @@
+# Standards Reference - Kubernetes Network Policies
+
+## CIS Kubernetes Benchmark v1.8 - Section 5.3
+- 5.3.1: Ensure CNI supports Network Policies
+- 5.3.2: Ensure default deny NetworkPolicy for all namespaces
+
+## NSA/CISA Kubernetes Hardening Guide
+- Implement network segmentation between namespaces
+- Apply default-deny network policies
+- Restrict pod-to-pod communication to required paths only
+- Block access to cloud metadata endpoints
+
+## MITRE ATT&CK Mitigations
+| Technique | Mitigation via Network Policy |
+|-----------|------------------------------|
+| T1046 - Network Service Scanning | Limit reachable services |
+| T1021 - Remote Services | Block lateral movement |
+| T1552 - Credentials from IMDS | Block 169.254.169.254 |

skills/implementing-network-policies-for-kubernetes/references/workflows.md

@@ -0,0 +1,20 @@
+# Workflows - Kubernetes Network Policies
+
+## Workflow 1: Network Policy Deployment
+```
+[Identify communication paths] --> [Create default-deny] --> [Add allow rules per service]
+         |                                |                           |
+         v                                v                           v
+  Map pod-to-pod traffic         Apply to all namespaces    Test with connectivity checks
+  Document required flows        Verify DNS still works     Monitor for broken connections
+```
+
+## Workflow 2: Progressive Enforcement
+```
+Step 1: Deploy in audit mode (Calico: log-only)
+Step 2: Monitor traffic patterns for 1 week
+Step 3: Create policies matching observed traffic
+Step 4: Apply default-deny in non-production
+Step 5: Validate application functionality
+Step 6: Roll out to production namespaces
+```