mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-26 19:29:41 +03:00

Files

T

mukul975 efca3ec611 feat: add NIST CSF 2.0 nist_csf field to all 754 cybersecurity skills

Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions)
based on subdomain and content analysis. Restores 11 skills corrupted during
prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields.

All 754 skills now carry structured mappings for all 5 security frameworks:
- MITRE ATT&CK (in tags)
- MITRE ATLAS v5.5 (atlas_techniques)
- MITRE D3FEND v1.3 (d3fend_techniques)
- NIST AI RMF 1.0 (nist_ai_rmf)
- NIST CSF 2.0 (nist_csf)

2026-04-06 11:17:40 +02:00

3.6 KiB

Raw Blame History

name, description, domain, subdomain, tags, version, author, license, nist_ai_rmf, atlas_techniques, nist_csf

name

description

domain

subdomain

Configuring HSM for Key Storage

Overview

Hardware Security Modules (HSMs) are tamper-resistant physical devices that safeguard cryptographic keys and perform cryptographic operations in a hardened environment. Keys stored in an HSM never leave the device boundary, providing the highest level of key protection. This skill covers configuring HSMs using the PKCS#11 standard interface, including key generation, signing, encryption, and key management using both physical HSMs and SoftHSM2 for development.

When to Use

When deploying or configuring configuring hsm for key storage capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Configure SoftHSM2 as a development PKCS#11 provider
Generate and manage keys inside the HSM via PKCS#11
Perform cryptographic operations (sign, verify, encrypt, decrypt) using HSM-resident keys
Implement HSM-backed certificate authority operations
Configure key access policies and user authentication
Interface with cloud HSM services (AWS CloudHSM, Azure)

Key Concepts

HSM Compliance Levels

FIPS Level	Protection	Use Case
FIPS 140-2 Level 1	Software only	Development
FIPS 140-2 Level 2	Tamper-evident, role-based auth	General production
FIPS 140-2 Level 3	Tamper-resistant, identity-based auth	Financial, government
FIPS 140-2 Level 4	Physical tamper response	Military, classified

PKCS#11 Architecture

Application --> PKCS#11 API --> HSM Provider --> Hardware HSM
                                    |
                              (SoftHSM2 for dev)

Key Objects in PKCS#11

Object Type	Description	Operations
CKO_SECRET_KEY	Symmetric keys (AES)	Encrypt, Decrypt, Wrap
CKO_PUBLIC_KEY	Public keys (RSA, EC)	Verify, Encrypt, Wrap
CKO_PRIVATE_KEY	Private keys (RSA, EC)	Sign, Decrypt, Unwrap
CKO_CERTIFICATE	X.509 certificates	Storage, retrieval

Security Considerations

Never export private keys from HSM (use CKA_EXTRACTABLE=False)
Use separate slots/partitions for different applications
Implement multi-person key ceremony for CA root keys
Enable audit logging for all HSM operations
Implement HSM backup and disaster recovery
Use strong PINs and enable SO (Security Officer) PIN

Validation Criteria

SoftHSM2 initializes with token and user PIN
AES key generates inside HSM
RSA key pair generates inside HSM
Encryption/decryption uses HSM-resident keys
Signing/verification uses HSM-resident keys
Keys cannot be exported (non-extractable)
Key listing shows all HSM-stored objects

3.6 KiB Raw Blame History