Initial commit - 611 cybersecurity skills across all subdomains

skills/securing-github-actions-workflows/references/standards.md

@@ -0,0 +1,30 @@
+# Standards Reference: Securing GitHub Actions
+
+## NIST SSDF (SP 800-218)
+
+### PS.1: Protect All Forms of Code
+- Workflows are code and must be reviewed and protected
+- Pin action dependencies to SHA digests
+- Minimize GITHUB_TOKEN permissions
+
+## CIS Software Supply Chain Security
+
+- BD-1: Define security requirements for build processes
+- BD-2: Automate security validation of build configurations
+- BD-3: Pin all external dependencies to immutable references
+
+## OWASP CI/CD Top 10 Risks
+
+| Risk | GitHub Actions Mitigation |
+|------|--------------------------|
+| CICD-SEC-1: Insufficient Flow Control | Environment protection rules, CODEOWNERS |
+| CICD-SEC-3: Dependency Chain Abuse | SHA pinning of actions |
+| CICD-SEC-4: Poisoned Pipeline Execution | Restrict pull_request_target, input sanitization |
+| CICD-SEC-6: Credential Hygiene | OIDC federation, minimal GITHUB_TOKEN scope |
+| CICD-SEC-9: Artifact Integrity | Sign artifacts in workflows |
+
+## SLSA Framework
+
+- Level 2: Hosted build service (GitHub Actions qualifies)
+- Level 3: Hardened build platform with isolation guarantees
+- Workflow hardening prevents provenance falsification

skills/securing-github-actions-workflows/references/workflows.md

@@ -0,0 +1,40 @@
+# Workflow Reference: Securing GitHub Actions
+
+## Hardening Checklist
+
+1. Pin all actions to SHA digests
+2. Set restrictive default permissions
+3. Sanitize all user-controlled inputs
+4. Never use pull_request_target with PR checkout
+5. Enable environment protection for production
+6. Configure CODEOWNERS for workflow files
+7. Enable Dependabot for github-actions
+8. Audit third-party actions quarterly
+9. Use OIDC instead of long-lived cloud credentials
+10. Add harden-runner for network monitoring
+
+## Permission Scoping Reference
+
+| Permission | Use Case |
+|-----------|----------|
+| contents: read | Checkout code |
+| contents: write | Create releases, push tags |
+| security-events: write | Upload SARIF results |
+| packages: write | Push container images |
+| deployments: write | Create deployment status |
+| id-token: write | OIDC cloud authentication |
+| pull-requests: write | Comment on PRs |
+
+## Script Injection Prevention
+
+```yaml
+# DANGEROUS patterns to avoid:
+run: echo "${{ github.event.issue.title }}"
+run: echo "${{ github.event.comment.body }}"
+run: echo "${{ github.head_ref }}"
+
+# SAFE alternatives:
+env:
+  TITLE: ${{ github.event.issue.title }}
+run: echo "${TITLE}"
+```