creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-02 09:07:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

Initial commit - 611 cybersecurity skills across all subdomains

Browse Source
This commit is contained in:
mukul975
2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/implementing-pci-dss-compliance-controls/SKILL.md
+122
View File
@@ -0,0 +1,122 @@
---
name: implementing-pci-dss-compliance-controls
description: PCI DSS 4.0.1 establishes 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data. With PCI DSS 3.2.1 retiring April 2024 and 51 new requirements
domain: cybersecurity
subdomain: compliance-governance
tags: [compliance, governance, pci-dss, payment-security, cardholder-data]
version: "1.0"
author: mahipal
license: MIT
---
# Implementing PCI DSS Compliance Controls
## Overview
PCI DSS 4.0.1 establishes 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data. With PCI DSS 3.2.1 retiring April 2024 and 51 new requirements becoming mandatory March 31, 2025, this skill covers implementing all requirements including the new customized validation approach, enhanced authentication, and continuous monitoring controls.
## Prerequisites
- Understanding of payment card processing flows and cardholder data environment (CDE)
- Knowledge of network segmentation and security architecture
- Access to cardholder data environment for scoping
- Understanding of PCI compliance validation levels (merchant levels 1-4, service provider levels 1-2)
## Core Concepts
### 12 PCI DSS Requirements by Control Objective
**Build and Maintain a Secure Network and Systems**
1. Install and maintain network security controls (firewalls, NSCs)
2. Apply secure configurations to all system components
**Protect Account Data**
3. Protect stored account data (encryption, tokenization, truncation)
4. Protect cardholder data with strong cryptography during transmission
**Maintain a Vulnerability Management Program**
5. Protect all systems and networks from malicious software
6. Develop and maintain secure systems and software
**Implement Strong Access Control Measures**
7. Restrict access to system components and cardholder data by business need to know
8. Identify users and authenticate access to system components
9. Restrict physical access to cardholder data
**Regularly Monitor and Test Networks**
10. Log and monitor all access to system components and cardholder data
11. Test security of systems and networks regularly
**Maintain an Information Security Policy**
12. Support information security with organizational policies and programs
### Key PCI DSS 4.0 Changes
- **Customized Approach**: Alternative to defined approach, allowing custom control design with objective-based validation
- **MFA for all CDE access**: Extended beyond admin to all access to cardholder data (Req 8.4.2)
- **Targeted Risk Analysis**: Organizations perform their own risk analysis for flexible requirements
- **Authenticated Vulnerability Scanning**: Internal scans must use authenticated scanning (Req 11.3.1.1)
- **Anti-phishing mechanisms**: Technical controls to detect and protect against phishing (Req 5.4.1)
- **Automated log review**: Automated mechanisms for review of audit logs (Req 10.4.1.1)
## Implementation Steps
### Phase 1: Scoping and Assessment (Weeks 1-4)
1. Identify all cardholder data flows (card present, card not present, storage)
2. Define Cardholder Data Environment (CDE) boundaries
3. Validate network segmentation effectiveness
4. Determine compliance validation level
5. Conduct PCI DSS gap assessment against all 12 requirements
### Phase 2: Network and System Security (Weeks 5-12)
1. Deploy and configure network security controls (Req 1)
2. Implement network segmentation to minimize CDE scope
3. Harden system configurations using CIS Benchmarks (Req 2)
4. Implement WAF for public-facing web applications (Req 6.4.1)
5. Deploy anti-malware on all in-scope systems (Req 5)
### Phase 3: Data Protection (Weeks 13-20)
1. Implement encryption for stored cardholder data (Req 3)
2. Deploy tokenization where possible to reduce scope
3. Enforce TLS 1.2+ for all cardholder data transmission (Req 4)
4. Implement key management procedures
5. Deploy data discovery tools to locate unencrypted cardholder data
### Phase 4: Access Controls (Weeks 21-28)
1. Implement RBAC based on business need to know (Req 7)
2. Deploy MFA for all access to CDE (Req 8)
3. Implement unique user IDs for all users
4. Enforce password policies meeting PCI DSS 4.0 requirements
5. Implement physical access controls for CDE facilities (Req 9)
### Phase 5: Monitoring and Testing (Weeks 29-36)
1. Deploy centralized logging for all CDE components (Req 10)
2. Implement automated log review mechanisms
3. Conduct internal and external vulnerability scans (Req 11)
4. Perform penetration testing (internal and external)
5. Implement file integrity monitoring (FIM) for critical files
### Phase 6: Policy and Governance (Weeks 37-42)
1. Develop comprehensive information security policy (Req 12)
2. Implement security awareness training including anti-phishing
3. Establish incident response plan specific to cardholder data
4. Conduct targeted risk analyses for flexible requirements
5. Document and validate all controls for assessment
## Key Artifacts
- CDE Scope Documentation and Network Diagrams
- Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC)
- Attestation of Compliance (AOC)
- Quarterly ASV Scan Reports
- Annual Penetration Test Report
- Risk Assessment Documentation
- Security Policies and Procedures
## Common Pitfalls
- Scope creep due to inadequate network segmentation
- Storing prohibited data (CVV, full track data) after authorization
- Missing the March 2025 deadline for new mandatory requirements
- Treating PCI DSS as annual compliance rather than continuous security
- Not including cloud and container environments in CDE scope
## References
- PCI DSS v4.0.1: https://www.pcisecuritystandards.org/document_library/
- PCI SSC Quick Reference Guide
- PCI DSS 4.0 Summary of Changes
- UpGuard PCI DSS 4.0 Guide: https://www.upguard.com/blog/pci-compliance
skills/implementing-pci-dss-compliance-controls/assets/template.md
+140
View File
@@ -0,0 +1,140 @@
# Implementing PCI DSS Compliance Controls - Audit Checklist
## Organization Information
| Field | Value |
|-------|-------|
| Organization Name | |
| Assessment Date | |
| Assessor | |
| Standard | PCI DSS v4.0.1 |
---
## Compliance Checklist
### 1. Requirement 1: Install and maintain network security controls
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 2. Requirement 2: Apply secure configurations to all system components
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 3. Requirement 3: Protect stored account data
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 4. Requirement 4: Protect cardholder data with strong cryptography during transmission
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 5. Requirement 5: Protect all systems and networks from malicious software
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 6. Requirement 6: Develop and maintain secure systems and software
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 7. Requirement 7: Restrict access by business need to know
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 8. Requirement 8: Identify users and authenticate access
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 9. Requirement 9: Restrict physical access to cardholder data
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 10. Requirement 10: Log and monitor all access to system components
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 11. Requirement 11: Test security of systems and networks regularly
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
### 12. Requirement 12: Support information security with policies and programs
- [ ] Policy/procedure documented
- [ ] Controls implemented
- [ ] Evidence available
- [ ] Tested and verified
- **Status**: Compliant / Partially Compliant / Non-Compliant / N/A
- **Evidence**: _______________
- **Notes**: _______________
---
## Summary
| Status | Count |
|--------|-------|
| Compliant | |
| Partially Compliant | |
| Non-Compliant | |
| N/A | |
## Sign-off
| Role | Name | Signature | Date |
|------|------|-----------|------|
| Assessor | | | |
| Security Manager | | | |
| Senior Management | | | |
skills/implementing-pci-dss-compliance-controls/references/standards.md
+25
View File
@@ -0,0 +1,25 @@
# Implementing PCI DSS Compliance Controls - Standards Reference
## Primary Standard
- **Standard**: PCI DSS v4.0.1
- **Governing Body**: PCI Security Standards Council
## Key Requirements
- Requirement 1: Install and maintain network security controls
- Requirement 2: Apply secure configurations to all system components
- Requirement 3: Protect stored account data
- Requirement 4: Protect cardholder data with strong cryptography during transmission
- Requirement 5: Protect all systems and networks from malicious software
- Requirement 6: Develop and maintain secure systems and software
- Requirement 7: Restrict access by business need to know
- Requirement 8: Identify users and authenticate access
- Requirement 9: Restrict physical access to cardholder data
- Requirement 10: Log and monitor all access to system components
- Requirement 11: Test security of systems and networks regularly
- Requirement 12: Support information security with policies and programs
## Cross-References
- ISO/IEC 27001:2022
- NIST Cybersecurity Framework 2.0
- CIS Controls v8.1
- COBIT 2019
skills/implementing-pci-dss-compliance-controls/references/workflows.md
+94
View File
@@ -0,0 +1,94 @@
# Implementing PCI DSS Compliance Controls - Workflows
## Workflow 1: Assessment and Planning
```
Start
|
v
[Scope Definition]
- Define boundaries and objectives
- Identify stakeholders
- Gather existing documentation
|
v
[Current State Assessment]
- Review existing controls
- Identify gaps against requirements
- Document findings
|
v
[Gap Analysis]
- Compare current vs required state
- Prioritize gaps by risk
- Estimate remediation effort
|
v
[Remediation Planning]
- Define action items with owners
- Set timelines and milestones
- Allocate resources and budget
|
v
End
```
## Workflow 2: Implementation
```
Start
|
v
[Policy and Procedure Development]
- Draft policies aligned to standard
- Review with stakeholders
- Obtain management approval
|
v
[Technical Control Deployment]
- Implement technical controls
- Configure monitoring and alerting
- Validate control effectiveness
|
v
[Training and Awareness]
- Train relevant personnel
- Communicate policy changes
- Document training completion
|
v
[Verification and Testing]
- Test controls against requirements
- Document evidence of operation
- Address deficiencies
|
v
End
```
## Workflow 3: Ongoing Compliance
```
Start
|
v
[Continuous Monitoring]
- Monitor control effectiveness
- Track compliance metrics
- Report to management
|
v
[Periodic Review]
- Annual reassessment
- Update for regulatory changes
- Incorporate lessons learned
|
v
[Audit and Certification]
- Internal audit programme
- External audit/assessment
- Address findings
|
v
End
```