Initial commit - 611 cybersecurity skills across all subdomains

skills/implementing-passwordless-authentication-with-fido2/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: None
+description: Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators. Covers WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentica
+domain: cybersecurity
+subdomain: identity-access-management
+tags: [iam, identity, access-control, authentication, fido2, webauthn, passwordless]
+version: "1.0"
+author: mahipal
+license: MIT
+---
+# Implementing Passwordless Authentication with FIDO2
+
+## Overview
+Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators. Covers WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3.
+
+## Objectives
+- Implement comprehensive implementing passwordless authentication with fido2 capability
+- Establish automated discovery and monitoring processes
+- Integrate with enterprise IAM and security tools
+- Generate compliance-ready documentation and reports
+- Align with NIST 800-53 access control requirements
+
+## Security Controls
+| Control | NIST 800-53 | Description |
+|---------|-------------|-------------|
+| Account Management | AC-2 | Lifecycle management |
+| Access Enforcement | AC-3 | Policy-based access control |
+| Least Privilege | AC-6 | Minimum necessary permissions |
+| Audit Logging | AU-3 | Authentication and access events |
+| Identification | IA-2 | User and service identification |
+
+## Verification
+- [ ] Implementation tested in non-production environment
+- [ ] Security policies configured and enforced
+- [ ] Audit logging enabled and forwarding to SIEM
+- [ ] Documentation and runbooks complete
+- [ ] Compliance evidence generated

skills/implementing-passwordless-authentication-with-fido2/references/standards.md

@@ -0,0 +1,20 @@
+# Standards - FIDO2 Passwordless Authentication
+
+## FIDO Standards
+- **FIDO2 Specification**: https://fidoalliance.org/specifications/
+- **WebAuthn Level 2**: W3C Web Authentication API
+- **CTAP2**: Client to Authenticator Protocol 2.0
+
+## NIST Standards
+- **NIST SP 800-63B**: AAL3 - Hardware-based phishing-resistant authenticator
+- **NIST SP 800-53 Rev 5**: IA-2(6), IA-2(8) Replay-resistant authentication
+- **NIST SP 800-157**: PIV Derived Credentials
+
+## CISA Guidance
+- **Phishing-Resistant MFA**: Required for federal agencies under EO 14028
+- **OMB M-22-09**: Federal zero trust strategy requiring phishing-resistant MFA
+
+## Vendor Resources
+- **Yubico FIDO2**: https://www.yubico.com/authentication-standards/fido2/
+- **Microsoft Passkeys**: https://www.microsoft.com/en-us/security/business/security-101/what-is-fido2
+- **Google Passkeys**: Android and Chrome WebAuthn support

skills/implementing-passwordless-authentication-with-fido2/references/workflows.md

@@ -0,0 +1,36 @@
+# FIDO2 Passwordless Authentication Workflows
+
+## Workflow 1: Security Key Enrollment
+1. User receives FIDO2 security key (YubiKey, Titan Key)
+2. User navigates to enrollment portal
+3. System generates WebAuthn registration challenge
+4. Browser prompts user to insert/tap security key
+5. User verifies with PIN or biometric on key
+6. Key generates unique public/private key pair
+7. Public key registered with relying party
+8. User tests authentication with enrolled key
+
+## Workflow 2: Passkey Authentication Flow
+1. User visits login page, enters username
+2. Server sends WebAuthn authentication challenge
+3. Browser prompts for authenticator (key, biometric, passkey)
+4. User verifies identity (touch key, scan fingerprint, enter PIN)
+5. Authenticator signs challenge with private key
+6. Server validates signature with stored public key
+7. User authenticated, session created
+
+## Workflow 3: Migration from Passwords to Passwordless
+1. Phase 1: Deploy FIDO2 to pilot group (IT, security teams)
+2. Phase 2: Enable coexistence (password + FIDO2)
+3. Phase 3: Expand FIDO2 enrollment to all users
+4. Phase 4: Set FIDO2-only policy per group
+5. Phase 5: Disable password authentication for migrated groups
+6. Phase 6: Monitor for fallback authentication attempts
+
+## Workflow 4: Lost/Stolen Key Recovery
+1. User reports lost security key
+2. Admin disables lost key in identity provider
+3. User authenticates via backup method (recovery codes, backup key)
+4. User enrolls replacement security key
+5. Old key permanently revoked
+6. Security team reviews for unauthorized usage of lost key