mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-06-12 22:24:56 +03:00
mukul975
efca3ec611
Mapped every skill to NIST CSF 2.0 subcategory IDs (GV/ID/PR/DE/RS/RC functions) based on subdomain and content analysis. Restores 11 skills corrupted during prior rebase, re-enriching with ATLAS, D3FEND, NIST AI RMF, and CSF 2.0 fields. All 754 skills now carry structured mappings for all 5 security frameworks: - MITRE ATT&CK (in tags) - MITRE ATLAS v5.5 (atlas_techniques) - MITRE D3FEND v1.3 (d3fend_techniques) - NIST AI RMF 1.0 (nist_ai_rmf) - NIST CSF 2.0 (nist_csf)
187 lines
7.6 KiB
Markdown
187 lines
7.6 KiB
Markdown
---
|
|
name: deploying-software-defined-perimeter
|
|
description: Deploy a Software-Defined Perimeter using the CSA v2.0 specification with Single Packet Authorization, mutual
|
|
TLS, and SDP controller/gateway configuration to enforce zero trust network access.
|
|
domain: cybersecurity
|
|
subdomain: zero-trust-architecture
|
|
tags:
|
|
- zero-trust
|
|
- sdp
|
|
- software-defined-perimeter
|
|
- network-access
|
|
- ztna
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_csf:
|
|
- PR.AA-01
|
|
- PR.AA-05
|
|
- PR.IR-01
|
|
- GV.PO-01
|
|
---
|
|
|
|
# Deploying Software-Defined Perimeter
|
|
|
|
## Prerequisites
|
|
|
|
- Understanding of zero trust principles (NIST SP 800-207)
|
|
- Knowledge of CSA Software-Defined Perimeter specification
|
|
- Familiarity with PKI and mutual TLS authentication
|
|
- Experience with network security architecture
|
|
|
|
## Overview
|
|
|
|
A Software-Defined Perimeter (SDP) implements zero trust by creating a dynamically provisioned, identity-centric perimeter around individual resources. Defined by the Cloud Security Alliance (CSA), SDP makes application infrastructure invisible to unauthorized users through a "dark cloud" approach where services are hidden until authenticated and authorized. Unlike traditional VPN, SDP establishes one-to-one encrypted connections between verified users and specific applications.
|
|
|
|
This skill covers deploying SDP using the CSA v2.0 specification, implementing Single Packet Authorization (SPA), configuring the SDP controller and gateway, and validating the deployment against NIST SP 800-207 requirements.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When deploying or configuring deploying software defined perimeter capabilities in your environment
|
|
- When establishing security controls aligned to compliance requirements
|
|
- When building or improving security architecture for this domain
|
|
- When conducting security assessments that require this implementation
|
|
|
|
## Prerequisites
|
|
|
|
- Familiarity with zero trust architecture concepts and tools
|
|
- Access to a test or lab environment for safe execution
|
|
- Python 3.8+ with required dependencies installed
|
|
- Appropriate authorization for any testing activities
|
|
|
|
## Architecture
|
|
|
|
### SDP Components (CSA Specification)
|
|
|
|
```
|
|
┌─────────────────────┐
|
|
│ SDP Controller │
|
|
│ - Authentication │
|
|
│ - Authorization │
|
|
│ - Policy management │
|
|
│ - Key management │
|
|
└──────────┬──────────┘
|
|
│
|
|
┌──────┴──────┐
|
|
│ │
|
|
v v
|
|
┌────────┐ ┌────────────┐
|
|
│ IH │ │ AH │
|
|
│(Client)│ │(Gateway) │
|
|
│ │ │ │
|
|
│ SPA │──│ Protected │
|
|
│ mTLS │ │ Resources │
|
|
└────────┘ └────────────┘
|
|
|
|
IH = Initiating Host (User Device)
|
|
AH = Accepting Host (Application Gateway)
|
|
SPA = Single Packet Authorization
|
|
```
|
|
|
|
### SDP Deployment Models
|
|
1. **Client-to-Gateway**: User device connects through SDP gateway to backend applications
|
|
2. **Client-to-Server**: Direct connection between user and application server
|
|
3. **Server-to-Server**: Workload-to-workload communication through SDP
|
|
4. **Gateway-to-Gateway**: Site-to-site connectivity replacing traditional VPN tunnels
|
|
|
|
## Key Concepts
|
|
|
|
### Single Packet Authorization (SPA)
|
|
SPA is a network security mechanism where the SDP gateway drops all TCP/UDP packets by default. A cryptographically signed single packet must be sent before any connection is established. The gateway validates the SPA packet, and only then opens a temporary port for the authenticated session. This makes the gateway invisible to port scanners.
|
|
|
|
### Mutual TLS (mTLS)
|
|
After SPA validation, both the client and server authenticate each other using X.509 certificates. This bidirectional authentication prevents man-in-the-middle attacks and ensures both endpoints are verified.
|
|
|
|
### Dynamic Provisioning
|
|
SDP connections are provisioned on-demand based on real-time policy evaluation. No persistent network tunnels exist; each session is individually authorized and encrypted.
|
|
|
|
## Workflow
|
|
|
|
### Phase 1: SDP Controller Deployment
|
|
|
|
1. **Deploy SDP Controller**
|
|
- Install SDP controller on hardened, redundant infrastructure
|
|
- Configure PKI integration for certificate issuance
|
|
- Set up authentication backend (LDAP, SAML, OIDC)
|
|
- Configure policy database with application definitions
|
|
- Enable audit logging for all controller decisions
|
|
|
|
2. **Configure Authentication**
|
|
- Integrate with enterprise IdP via SAML 2.0 or OIDC
|
|
- Configure device certificate enrollment (SCEP/EST)
|
|
- Enable multi-factor authentication requirements
|
|
- Set up certificate revocation checking (OCSP/CRL)
|
|
|
|
3. **Define Access Policies**
|
|
- Map users/groups to authorized applications
|
|
- Define device posture requirements per application
|
|
- Configure contextual conditions (location, time, risk level)
|
|
- Set session duration and re-authentication intervals
|
|
|
|
### Phase 2: SDP Gateway Deployment
|
|
|
|
4. **Deploy Accepting Hosts (Gateways)**
|
|
- Install SDP gateway instances in front of protected applications
|
|
- Configure default-drop firewall rules (deny all inbound)
|
|
- Enable SPA listener on designated ports
|
|
- Configure mTLS with controller-issued certificates
|
|
- Set up health monitoring and failover
|
|
|
|
5. **Configure Application Definitions**
|
|
- Register each protected application with the controller
|
|
- Define backend server IPs, ports, and protocols
|
|
- Configure load balancing for multi-instance applications
|
|
- Set up application health checks
|
|
|
|
### Phase 3: Client Deployment
|
|
|
|
6. **Deploy Initiating Hosts (Clients)**
|
|
- Install SDP client software on user endpoints
|
|
- Enroll device certificates through automated provisioning
|
|
- Configure SPA key material distribution
|
|
- Test authentication flow: SPA → mTLS → application access
|
|
|
|
7. **Validate End-to-End Flow**
|
|
- Verify SPA packets are accepted by gateway
|
|
- Confirm mTLS handshake succeeds with valid certificates
|
|
- Test application access through the SDP tunnel
|
|
- Verify unauthorized access is blocked (no SPA = invisible gateway)
|
|
|
|
### Phase 4: Operational Validation
|
|
|
|
8. **Security Testing**
|
|
- Port scan the SDP gateway to confirm invisibility (all ports show filtered/closed)
|
|
- Attempt connection without valid SPA (must fail silently)
|
|
- Test with revoked client certificate (must be denied)
|
|
- Attempt lateral movement from one authorized app to another unauthorized app
|
|
- Validate audit trail completeness
|
|
|
|
9. **Monitoring and Maintenance**
|
|
- Configure SIEM integration for SDP controller and gateway logs
|
|
- Set up alerting for failed SPA attempts and certificate errors
|
|
- Establish certificate rotation schedule
|
|
- Document incident response procedures for SDP events
|
|
|
|
## Validation Checklist
|
|
|
|
- [ ] SDP Controller deployed with HA and audit logging
|
|
- [ ] IdP integration tested with SAML/OIDC and MFA
|
|
- [ ] SDP Gateways deployed with default-drop firewall
|
|
- [ ] SPA mechanism validated (gateway invisible to port scans)
|
|
- [ ] mTLS established between clients and gateways
|
|
- [ ] Access policies enforce least-privilege per user/app
|
|
- [ ] Device certificate enrollment automated
|
|
- [ ] Unauthorized access attempts blocked silently
|
|
- [ ] Lateral movement between apps prevented
|
|
- [ ] Logs streaming to SIEM with alerting configured
|
|
- [ ] Certificate rotation and revocation procedures tested
|
|
|
|
## References
|
|
|
|
- CSA Software-Defined Perimeter Architecture Guide v3
|
|
- CSA SDP Specification v2.0
|
|
- NIST SP 800-207: Zero Trust Architecture
|
|
- CISA Zero Trust Maturity Model v2.0
|
|
- fwknop: Single Packet Authorization implementation
|