mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
.
This commit is contained in:
Toby
@@ -0,0 +1,82 @@
|
||||
---
|
||||
name: audit-logging
|
||||
description: Implement centralized audit logging and SIEM integration. Configure log retention and security monitoring. Use when implementing audit trail requirements.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Audit Logging
|
||||
|
||||
Implement comprehensive audit logging for compliance.
|
||||
|
||||
## Log Categories
|
||||
|
||||
```yaml
|
||||
audit_events:
|
||||
authentication:
|
||||
- Login attempts
|
||||
- MFA events
|
||||
- Session management
|
||||
|
||||
authorization:
|
||||
- Access grants
|
||||
- Permission changes
|
||||
- Role assignments
|
||||
|
||||
data_access:
|
||||
- Read operations
|
||||
- Write operations
|
||||
- Delete operations
|
||||
|
||||
administrative:
|
||||
- Configuration changes
|
||||
- User management
|
||||
- System changes
|
||||
```
|
||||
|
||||
## Application Logging
|
||||
|
||||
```python
|
||||
import logging
|
||||
import json
|
||||
|
||||
class AuditLogger:
|
||||
def log_event(self, event_type, user, resource, action, result):
|
||||
log_entry = {
|
||||
'timestamp': datetime.utcnow().isoformat(),
|
||||
'event_type': event_type,
|
||||
'user': user,
|
||||
'resource': resource,
|
||||
'action': action,
|
||||
'result': result,
|
||||
'source_ip': request.remote_addr
|
||||
}
|
||||
logger.info(json.dumps(log_entry))
|
||||
```
|
||||
|
||||
## Centralized Logging
|
||||
|
||||
```yaml
|
||||
# Fluentd configuration
|
||||
<source>
|
||||
@type tail
|
||||
path /var/log/audit/*.log
|
||||
tag audit.*
|
||||
</source>
|
||||
|
||||
<match audit.**>
|
||||
@type elasticsearch
|
||||
host elasticsearch.example.com
|
||||
index_name audit-logs
|
||||
</match>
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Structured logging (JSON)
|
||||
- Centralized collection
|
||||
- Tamper-proof storage
|
||||
- Retention policies
|
||||
- Alerting on anomalies
|
||||
@@ -0,0 +1,64 @@
|
||||
---
|
||||
name: aws-cloudtrail
|
||||
description: Configure AWS CloudTrail for audit logging. Set up organization trails and event analysis. Use when auditing AWS activity.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS CloudTrail
|
||||
|
||||
Audit AWS account activity with CloudTrail.
|
||||
|
||||
## Create Trail
|
||||
|
||||
```bash
|
||||
# Create organization trail
|
||||
aws cloudtrail create-trail \
|
||||
--name org-audit-trail \
|
||||
--s3-bucket-name audit-logs-bucket \
|
||||
--is-organization-trail \
|
||||
--is-multi-region-trail \
|
||||
--enable-log-file-validation \
|
||||
--kms-key-id arn:aws:kms:...
|
||||
|
||||
# Start logging
|
||||
aws cloudtrail start-logging --name org-audit-trail
|
||||
```
|
||||
|
||||
## Event Selectors
|
||||
|
||||
```bash
|
||||
# Log all management and data events
|
||||
aws cloudtrail put-event-selectors \
|
||||
--trail-name org-audit-trail \
|
||||
--event-selectors '[{
|
||||
"ReadWriteType": "All",
|
||||
"IncludeManagementEvents": true,
|
||||
"DataResources": [{
|
||||
"Type": "AWS::S3::Object",
|
||||
"Values": ["arn:aws:s3:::sensitive-bucket/"]
|
||||
}]
|
||||
}]'
|
||||
```
|
||||
|
||||
## CloudTrail Lake
|
||||
|
||||
```sql
|
||||
-- Query events
|
||||
SELECT eventTime, userIdentity.userName, eventName, sourceIPAddress
|
||||
FROM cloudtrail_logs
|
||||
WHERE eventTime > '2024-01-01'
|
||||
AND eventName LIKE '%Delete%'
|
||||
ORDER BY eventTime DESC
|
||||
LIMIT 100
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Organization-wide trails
|
||||
- Enable log file validation
|
||||
- Encrypt with KMS
|
||||
- CloudWatch Logs integration
|
||||
- Event alerting
|
||||
@@ -0,0 +1,57 @@
|
||||
---
|
||||
name: azure-monitor-audit
|
||||
description: Configure Azure Monitor and Activity Log for auditing. Set up diagnostic settings and log analytics. Use when auditing Azure activity.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Azure Monitor Audit
|
||||
|
||||
Audit Azure activity with Monitor and Activity Logs.
|
||||
|
||||
## Diagnostic Settings
|
||||
|
||||
```bash
|
||||
# Enable diagnostic settings
|
||||
az monitor diagnostic-settings create \
|
||||
--name audit-logs \
|
||||
--resource /subscriptions/{sub}/resourceGroups/{rg}/providers/... \
|
||||
--logs '[{"category":"AuditEvent","enabled":true}]' \
|
||||
--workspace /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}
|
||||
```
|
||||
|
||||
## Activity Log Export
|
||||
|
||||
```bash
|
||||
# Export activity log to Log Analytics
|
||||
az monitor diagnostic-settings subscription create \
|
||||
--name activity-log-export \
|
||||
--location global \
|
||||
--logs '[{"category":"Administrative","enabled":true},{"category":"Security","enabled":true}]' \
|
||||
--workspace /subscriptions/.../workspaces/audit-workspace
|
||||
```
|
||||
|
||||
## Log Analytics Queries
|
||||
|
||||
```kusto
|
||||
// Failed login attempts
|
||||
AuditLogs
|
||||
| where TimeGenerated > ago(24h)
|
||||
| where ResultType != "0"
|
||||
| project TimeGenerated, Identity, ResultDescription, IPAddress
|
||||
|
||||
// Administrative changes
|
||||
AzureActivity
|
||||
| where CategoryValue == "Administrative"
|
||||
| where OperationNameValue contains "write" or OperationNameValue contains "delete"
|
||||
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Centralize to Log Analytics
|
||||
- Long-term archive to Storage
|
||||
- Configure alerts
|
||||
- Regular query reviews
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
name: gcp-audit-logs
|
||||
description: Configure GCP Cloud Audit Logs for compliance. Set up log routing and BigQuery analysis. Use when auditing GCP activity.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# GCP Audit Logs
|
||||
|
||||
Audit GCP activity with Cloud Audit Logs.
|
||||
|
||||
## Audit Log Types
|
||||
|
||||
```yaml
|
||||
log_types:
|
||||
admin_activity:
|
||||
- Always enabled
|
||||
- API calls that modify resources
|
||||
- No charge
|
||||
|
||||
data_access:
|
||||
- Must be enabled
|
||||
- Read/write data operations
|
||||
- Can be high volume
|
||||
|
||||
system_event:
|
||||
- Always enabled
|
||||
- GCP system actions
|
||||
|
||||
policy_denied:
|
||||
- Always enabled
|
||||
- Access denials
|
||||
```
|
||||
|
||||
## Enable Data Access Logs
|
||||
|
||||
```bash
|
||||
# Enable for all services
|
||||
gcloud logging sinks create audit-sink \
|
||||
storage.googleapis.com/audit-logs-bucket \
|
||||
--log-filter='logName:"cloudaudit.googleapis.com"'
|
||||
|
||||
# IAM policy for data access logs
|
||||
gcloud projects get-iam-policy PROJECT_ID > policy.yaml
|
||||
# Add auditConfigs section
|
||||
gcloud projects set-iam-policy PROJECT_ID policy.yaml
|
||||
```
|
||||
|
||||
## BigQuery Analysis
|
||||
|
||||
```sql
|
||||
-- Query audit logs from BigQuery export
|
||||
SELECT
|
||||
timestamp,
|
||||
protopayload_auditlog.authenticationInfo.principalEmail,
|
||||
protopayload_auditlog.methodName,
|
||||
resource.labels.project_id
|
||||
FROM `project.dataset.cloudaudit_googleapis_com_activity_*`
|
||||
WHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 7 DAY)
|
||||
AND protopayload_auditlog.methodName LIKE '%delete%'
|
||||
ORDER BY timestamp DESC
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Export to BigQuery for analysis
|
||||
- Configure log retention
|
||||
- Enable data access logs for sensitive resources
|
||||
- Set up alerting policies
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
name: business-continuity
|
||||
description: Develop business continuity plans and impact analysis. Implement BCP testing and communication procedures. Use when building organizational resilience.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Business Continuity Planning
|
||||
|
||||
Develop and maintain business continuity capabilities.
|
||||
|
||||
## BCP Framework
|
||||
|
||||
```yaml
|
||||
bcp_phases:
|
||||
1_analysis:
|
||||
- Business Impact Analysis (BIA)
|
||||
- Risk assessment
|
||||
- Critical process identification
|
||||
|
||||
2_planning:
|
||||
- Recovery strategies
|
||||
- Resource requirements
|
||||
- Communication plans
|
||||
|
||||
3_implementation:
|
||||
- Procedure documentation
|
||||
- Training
|
||||
- Technology setup
|
||||
|
||||
4_testing:
|
||||
- Plan exercises
|
||||
- Gap identification
|
||||
- Continuous improvement
|
||||
```
|
||||
|
||||
## Business Impact Analysis
|
||||
|
||||
```yaml
|
||||
process_classification:
|
||||
critical:
|
||||
max_downtime: 4 hours
|
||||
examples: Payment processing, authentication
|
||||
|
||||
essential:
|
||||
max_downtime: 24 hours
|
||||
examples: Customer support, reporting
|
||||
|
||||
necessary:
|
||||
max_downtime: 72 hours
|
||||
examples: Internal tools, analytics
|
||||
|
||||
desirable:
|
||||
max_downtime: 7 days
|
||||
examples: Development environments
|
||||
```
|
||||
|
||||
## Communication Plan
|
||||
|
||||
```yaml
|
||||
communication:
|
||||
internal:
|
||||
- Executive notification
|
||||
- Team communication
|
||||
- Status updates
|
||||
|
||||
external:
|
||||
- Customer notification
|
||||
- Regulatory reporting
|
||||
- Media relations
|
||||
|
||||
channels:
|
||||
- Primary: Slack/Teams
|
||||
- Secondary: Email
|
||||
- Emergency: Phone tree
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Annual BIA updates
|
||||
- Regular plan testing
|
||||
- Clear roles and responsibilities
|
||||
- Multiple communication channels
|
||||
- Executive sponsorship
|
||||
@@ -0,0 +1,73 @@
|
||||
---
|
||||
name: disaster-recovery
|
||||
description: Implement disaster recovery strategies and runbooks. Configure RPO/RTO targets and failover procedures. Use when planning for business continuity.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Disaster Recovery
|
||||
|
||||
Implement disaster recovery strategies and procedures.
|
||||
|
||||
## DR Metrics
|
||||
|
||||
```yaml
|
||||
recovery_metrics:
|
||||
RTO: Recovery Time Objective
|
||||
- Maximum acceptable downtime
|
||||
- How long to restore service
|
||||
|
||||
RPO: Recovery Point Objective
|
||||
- Maximum acceptable data loss
|
||||
- How much data can be lost
|
||||
```
|
||||
|
||||
## DR Strategies
|
||||
|
||||
| Strategy | RTO | RPO | Cost |
|
||||
|----------|-----|-----|------|
|
||||
| Backup & Restore | Hours | Hours | $ |
|
||||
| Pilot Light | Minutes-Hours | Minutes | $$ |
|
||||
| Warm Standby | Minutes | Seconds | $$$ |
|
||||
| Multi-Site Active | Near-zero | Near-zero | $$$$ |
|
||||
|
||||
## AWS Multi-Region
|
||||
|
||||
```bash
|
||||
# Cross-region RDS replica
|
||||
aws rds create-db-instance-read-replica \
|
||||
--db-instance-identifier dr-replica \
|
||||
--source-db-instance-identifier prod-db \
|
||||
--source-region us-east-1 \
|
||||
--region us-west-2
|
||||
|
||||
# S3 cross-region replication
|
||||
aws s3api put-bucket-replication \
|
||||
--bucket source-bucket \
|
||||
--replication-configuration file://replication.json
|
||||
```
|
||||
|
||||
## DR Testing
|
||||
|
||||
```yaml
|
||||
dr_test_schedule:
|
||||
tabletop: Quarterly
|
||||
component_failover: Monthly
|
||||
full_failover: Annually
|
||||
|
||||
test_checklist:
|
||||
- [ ] Verify backup integrity
|
||||
- [ ] Test failover procedures
|
||||
- [ ] Validate data consistency
|
||||
- [ ] Measure actual RTO/RPO
|
||||
- [ ] Document lessons learned
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Regular DR testing
|
||||
- Automate failover where possible
|
||||
- Document all procedures
|
||||
- Update runbooks after tests
|
||||
@@ -0,0 +1,90 @@
|
||||
---
|
||||
name: incident-management
|
||||
description: Implement incident management processes and escalation procedures. Configure on-call schedules and post-incident reviews. Use when managing production incidents.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Incident Management
|
||||
|
||||
Implement effective incident management processes.
|
||||
|
||||
## Incident Severity
|
||||
|
||||
| Severity | Impact | Response | Example |
|
||||
|----------|--------|----------|---------|
|
||||
| SEV1 | Total outage | Immediate, all-hands | Site down |
|
||||
| SEV2 | Major degradation | Urgent, on-call | Feature broken |
|
||||
| SEV3 | Minor impact | Standard | Slow performance |
|
||||
| SEV4 | Minimal | Next business day | Cosmetic issue |
|
||||
|
||||
## Incident Process
|
||||
|
||||
```yaml
|
||||
incident_workflow:
|
||||
1_detect:
|
||||
- Alerting triggers
|
||||
- Customer reports
|
||||
- Monitoring anomalies
|
||||
|
||||
2_triage:
|
||||
- Severity assessment
|
||||
- Impact determination
|
||||
- Team notification
|
||||
|
||||
3_respond:
|
||||
- Incident commander assigned
|
||||
- Communication established
|
||||
- Mitigation started
|
||||
|
||||
4_resolve:
|
||||
- Root cause addressed
|
||||
- Service restored
|
||||
- Customer notified
|
||||
|
||||
5_review:
|
||||
- Timeline documented
|
||||
- Root cause analysis
|
||||
- Action items created
|
||||
```
|
||||
|
||||
## Incident Commander
|
||||
|
||||
```yaml
|
||||
ic_responsibilities:
|
||||
- Own incident resolution
|
||||
- Coordinate response teams
|
||||
- Manage communication
|
||||
- Make escalation decisions
|
||||
- Schedule post-mortem
|
||||
```
|
||||
|
||||
## Post-Incident Review
|
||||
|
||||
```markdown
|
||||
## Incident Summary
|
||||
- Duration:
|
||||
- Impact:
|
||||
- Severity:
|
||||
|
||||
## Timeline
|
||||
|
||||
## Root Cause
|
||||
|
||||
## What Went Well
|
||||
|
||||
## What Could Be Improved
|
||||
|
||||
## Action Items
|
||||
| Item | Owner | Due Date |
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Clear severity definitions
|
||||
- Defined escalation paths
|
||||
- Blameless post-mortems
|
||||
- Action item tracking
|
||||
- Regular training
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
name: runbook-creation
|
||||
description: Create operational runbooks and standard operating procedures. Document troubleshooting guides and recovery procedures. Use when documenting operational knowledge.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Runbook Creation
|
||||
|
||||
Create effective operational runbooks and procedures.
|
||||
|
||||
## Runbook Structure
|
||||
|
||||
```markdown
|
||||
# Runbook: [Service/Process Name]
|
||||
|
||||
## Overview
|
||||
Brief description of the service and runbook purpose.
|
||||
|
||||
## Prerequisites
|
||||
- Required access
|
||||
- Tools needed
|
||||
- Knowledge required
|
||||
|
||||
## Procedure
|
||||
Step-by-step instructions with commands.
|
||||
|
||||
## Verification
|
||||
How to confirm success.
|
||||
|
||||
## Rollback
|
||||
Steps to undo if needed.
|
||||
|
||||
## Escalation
|
||||
When and how to escalate.
|
||||
|
||||
## Related Runbooks
|
||||
Links to related procedures.
|
||||
```
|
||||
|
||||
## Example Runbook
|
||||
|
||||
```markdown
|
||||
# Runbook: Database Failover
|
||||
|
||||
## Overview
|
||||
Procedure to failover PostgreSQL to replica.
|
||||
|
||||
## Prerequisites
|
||||
- [ ] DBA access to primary and replica
|
||||
- [ ] VPN connected
|
||||
- [ ] Slack channel #db-ops open
|
||||
|
||||
## Procedure
|
||||
|
||||
### 1. Verify Replica Status
|
||||
\`\`\`bash
|
||||
psql -h replica -c "SELECT pg_is_in_recovery();"
|
||||
# Should return 't'
|
||||
\`\`\`
|
||||
|
||||
### 2. Stop Application Writes
|
||||
\`\`\`bash
|
||||
kubectl scale deployment app --replicas=0
|
||||
\`\`\`
|
||||
|
||||
### 3. Promote Replica
|
||||
\`\`\`bash
|
||||
psql -h replica -c "SELECT pg_promote();"
|
||||
\`\`\`
|
||||
|
||||
### 4. Update DNS
|
||||
\`\`\`bash
|
||||
aws route53 change-resource-record-sets ...
|
||||
\`\`\`
|
||||
|
||||
## Verification
|
||||
- [ ] Application connects to new primary
|
||||
- [ ] No replication lag errors
|
||||
- [ ] Transactions completing
|
||||
|
||||
## Escalation
|
||||
If issues persist after 15 minutes, escalate to:
|
||||
- Primary: @dba-lead
|
||||
- Secondary: @platform-oncall
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Keep procedures simple and clear
|
||||
- Include verification steps
|
||||
- Test runbooks regularly
|
||||
- Version control runbooks
|
||||
- Include troubleshooting tips
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
name: fedramp-compliance
|
||||
description: Implement FedRAMP requirements for federal cloud services. Configure NIST 800-53 controls and continuous monitoring. Use when providing cloud services to US federal agencies.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# FedRAMP Compliance
|
||||
|
||||
Implement FedRAMP requirements for federal cloud services.
|
||||
|
||||
## Impact Levels
|
||||
|
||||
```yaml
|
||||
levels:
|
||||
low:
|
||||
controls: ~125
|
||||
use_case: Public data
|
||||
|
||||
moderate:
|
||||
controls: ~325
|
||||
use_case: CUI, most federal systems
|
||||
|
||||
high:
|
||||
controls: ~425
|
||||
use_case: Law enforcement, emergency services
|
||||
```
|
||||
|
||||
## NIST 800-53 Families
|
||||
|
||||
```yaml
|
||||
control_families:
|
||||
AC: Access Control
|
||||
AU: Audit and Accountability
|
||||
AT: Awareness and Training
|
||||
CM: Configuration Management
|
||||
CP: Contingency Planning
|
||||
IA: Identification and Authentication
|
||||
IR: Incident Response
|
||||
MA: Maintenance
|
||||
MP: Media Protection
|
||||
PE: Physical Protection
|
||||
PL: Planning
|
||||
PS: Personnel Security
|
||||
RA: Risk Assessment
|
||||
CA: Assessment and Authorization
|
||||
SC: System and Communications Protection
|
||||
SI: System and Information Integrity
|
||||
SA: System and Services Acquisition
|
||||
PM: Program Management
|
||||
```
|
||||
|
||||
## Continuous Monitoring
|
||||
|
||||
```yaml
|
||||
conmon:
|
||||
vulnerability_scans: Monthly
|
||||
penetration_tests: Annual
|
||||
poa_m_updates: Monthly
|
||||
security_assessment: Annual
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- 3PAO assessment
|
||||
- SSP documentation
|
||||
- POA&M tracking
|
||||
- Continuous monitoring
|
||||
- Annual authorization
|
||||
@@ -0,0 +1,64 @@
|
||||
---
|
||||
name: gdpr-compliance
|
||||
description: Implement GDPR data protection requirements. Configure consent management, data subject rights, and privacy by design. Use when processing EU personal data.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# GDPR Compliance
|
||||
|
||||
Implement GDPR requirements for EU data protection.
|
||||
|
||||
## Key Principles
|
||||
|
||||
```yaml
|
||||
principles:
|
||||
lawfulness: Legal basis for processing
|
||||
purpose_limitation: Specific, explicit purposes
|
||||
data_minimization: Adequate, relevant, limited
|
||||
accuracy: Accurate and up to date
|
||||
storage_limitation: No longer than necessary
|
||||
integrity: Secure processing
|
||||
accountability: Demonstrate compliance
|
||||
```
|
||||
|
||||
## Data Subject Rights
|
||||
|
||||
```yaml
|
||||
rights:
|
||||
- Right to access
|
||||
- Right to rectification
|
||||
- Right to erasure
|
||||
- Right to restrict processing
|
||||
- Right to data portability
|
||||
- Right to object
|
||||
- Rights related to automated decisions
|
||||
```
|
||||
|
||||
## Technical Implementation
|
||||
|
||||
```python
|
||||
# Data export for portability
|
||||
def export_user_data(user_id):
|
||||
return {
|
||||
"profile": get_profile(user_id),
|
||||
"activity": get_activity_log(user_id),
|
||||
"preferences": get_preferences(user_id)
|
||||
}
|
||||
|
||||
# Right to erasure
|
||||
def delete_user_data(user_id):
|
||||
anonymize_profile(user_id)
|
||||
delete_activity_log(user_id)
|
||||
log_deletion(user_id)
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Privacy impact assessments
|
||||
- Data processing agreements
|
||||
- Consent management
|
||||
- Breach notification (72 hours)
|
||||
- Data Protection Officer (if required)
|
||||
@@ -0,0 +1,74 @@
|
||||
---
|
||||
name: hipaa-compliance
|
||||
description: Implement HIPAA security and privacy rules. Configure PHI protections and BAA requirements. Use when handling healthcare data.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# HIPAA Compliance
|
||||
|
||||
Implement HIPAA requirements for healthcare data protection.
|
||||
|
||||
## HIPAA Rules
|
||||
|
||||
```yaml
|
||||
security_rule:
|
||||
administrative:
|
||||
- Risk analysis
|
||||
- Security management
|
||||
- Workforce training
|
||||
- Contingency planning
|
||||
|
||||
physical:
|
||||
- Facility access
|
||||
- Workstation security
|
||||
- Device controls
|
||||
|
||||
technical:
|
||||
- Access control
|
||||
- Audit controls
|
||||
- Integrity controls
|
||||
- Transmission security
|
||||
```
|
||||
|
||||
## Technical Safeguards
|
||||
|
||||
```yaml
|
||||
requirements:
|
||||
encryption:
|
||||
at_rest: AES-256
|
||||
in_transit: TLS 1.2+
|
||||
|
||||
access_control:
|
||||
- Unique user IDs
|
||||
- Emergency access procedure
|
||||
- Automatic logoff
|
||||
- Encryption/decryption
|
||||
|
||||
audit:
|
||||
- Access logging
|
||||
- Activity monitoring
|
||||
- Log retention (6 years)
|
||||
```
|
||||
|
||||
## AWS HIPAA Setup
|
||||
|
||||
```bash
|
||||
# Enable CloudTrail for HIPAA auditing
|
||||
aws cloudtrail create-trail \
|
||||
--name hipaa-audit-trail \
|
||||
--s3-bucket-name hipaa-logs \
|
||||
--is-multi-region-trail \
|
||||
--enable-log-file-validation
|
||||
|
||||
# Use HIPAA-eligible services only
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Business Associate Agreements (BAAs)
|
||||
- Minimum necessary access
|
||||
- Breach notification procedures
|
||||
- Regular risk assessments
|
||||
@@ -0,0 +1,85 @@
|
||||
---
|
||||
name: iso27001-compliance
|
||||
description: Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# ISO 27001 Compliance
|
||||
|
||||
Implement ISO 27001 Information Security Management System.
|
||||
|
||||
## ISMS Framework
|
||||
|
||||
```yaml
|
||||
plan_do_check_act:
|
||||
plan:
|
||||
- Define scope
|
||||
- Risk assessment
|
||||
- Risk treatment plan
|
||||
- Statement of Applicability
|
||||
|
||||
do:
|
||||
- Implement controls
|
||||
- Security awareness
|
||||
- Document procedures
|
||||
|
||||
check:
|
||||
- Internal audits
|
||||
- Management review
|
||||
- Performance measurement
|
||||
|
||||
act:
|
||||
- Corrective actions
|
||||
- Continual improvement
|
||||
```
|
||||
|
||||
## Annex A Controls
|
||||
|
||||
```yaml
|
||||
control_domains:
|
||||
A.5: Information security policies
|
||||
A.6: Organization of information security
|
||||
A.7: Human resource security
|
||||
A.8: Asset management
|
||||
A.9: Access control
|
||||
A.10: Cryptography
|
||||
A.11: Physical security
|
||||
A.12: Operations security
|
||||
A.13: Communications security
|
||||
A.14: System acquisition/development
|
||||
A.15: Supplier relationships
|
||||
A.16: Incident management
|
||||
A.17: Business continuity
|
||||
A.18: Compliance
|
||||
```
|
||||
|
||||
## Risk Assessment
|
||||
|
||||
```yaml
|
||||
risk_assessment:
|
||||
identify:
|
||||
- Asset inventory
|
||||
- Threat identification
|
||||
- Vulnerability assessment
|
||||
|
||||
analyze:
|
||||
- Likelihood rating
|
||||
- Impact rating
|
||||
- Risk calculation
|
||||
|
||||
evaluate:
|
||||
- Risk acceptance criteria
|
||||
- Prioritization
|
||||
- Treatment options
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Management commitment
|
||||
- Risk-based approach
|
||||
- Document everything
|
||||
- Regular internal audits
|
||||
- Continuous improvement
|
||||
@@ -0,0 +1,77 @@
|
||||
---
|
||||
name: pci-dss-compliance
|
||||
description: Implement PCI DSS requirements for payment card data. Configure cardholder data environment and security controls. Use when processing payment cards.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# PCI DSS Compliance
|
||||
|
||||
Implement PCI DSS requirements for payment card security.
|
||||
|
||||
## Requirements
|
||||
|
||||
```yaml
|
||||
requirements:
|
||||
1_firewall:
|
||||
- Network segmentation
|
||||
- Firewall configuration
|
||||
- CDE isolation
|
||||
|
||||
3_protect_data:
|
||||
- Mask PAN display
|
||||
- Encrypt stored data
|
||||
- Key management
|
||||
|
||||
6_secure_systems:
|
||||
- Patch management
|
||||
- Secure development
|
||||
- Change control
|
||||
|
||||
8_access_control:
|
||||
- Unique IDs
|
||||
- MFA for remote access
|
||||
- Password policies
|
||||
|
||||
10_logging:
|
||||
- Audit trail
|
||||
- Time synchronization
|
||||
- Log retention (1 year)
|
||||
|
||||
11_testing:
|
||||
- Vulnerability scans
|
||||
- Penetration testing
|
||||
- IDS/IPS monitoring
|
||||
```
|
||||
|
||||
## Network Segmentation
|
||||
|
||||
```
|
||||
Internet --> DMZ --> Firewall --> CDE
|
||||
|
|
||||
Non-CDE <-- Firewall --
|
||||
```
|
||||
|
||||
## Data Protection
|
||||
|
||||
```yaml
|
||||
encryption:
|
||||
at_rest: AES-256
|
||||
in_transit: TLS 1.2+
|
||||
key_storage: HSM or dedicated key vault
|
||||
|
||||
tokenization:
|
||||
- Replace PAN with token
|
||||
- Store mapping securely
|
||||
- Reduce CDE scope
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Minimize CDE scope
|
||||
- Use tokenization
|
||||
- Quarterly vulnerability scans
|
||||
- Annual penetration tests
|
||||
- ASV scan certification
|
||||
@@ -0,0 +1,82 @@
|
||||
---
|
||||
name: soc2-compliance
|
||||
description: Implement SOC 2 Trust Services Criteria. Configure security, availability, and processing integrity controls. Use when achieving SOC 2 certification.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# SOC 2 Compliance
|
||||
|
||||
Implement SOC 2 Trust Services Criteria for certification.
|
||||
|
||||
## Trust Services Criteria
|
||||
|
||||
```yaml
|
||||
criteria:
|
||||
security:
|
||||
- Access controls
|
||||
- Change management
|
||||
- Risk assessment
|
||||
- Incident response
|
||||
|
||||
availability:
|
||||
- System monitoring
|
||||
- Disaster recovery
|
||||
- Capacity planning
|
||||
- SLA management
|
||||
|
||||
processing_integrity:
|
||||
- Input validation
|
||||
- Processing completeness
|
||||
- Output accuracy
|
||||
|
||||
confidentiality:
|
||||
- Data classification
|
||||
- Encryption
|
||||
- Access restrictions
|
||||
|
||||
privacy:
|
||||
- Data collection notice
|
||||
- Consent management
|
||||
- Data retention
|
||||
```
|
||||
|
||||
## Key Controls
|
||||
|
||||
```yaml
|
||||
controls:
|
||||
CC6.1_logical_access:
|
||||
- MFA enforcement
|
||||
- Role-based access
|
||||
- Access reviews
|
||||
|
||||
CC7.2_monitoring:
|
||||
- Log aggregation
|
||||
- Alert thresholds
|
||||
- Incident tracking
|
||||
|
||||
CC8.1_change_management:
|
||||
- Change requests
|
||||
- Approval workflows
|
||||
- Testing requirements
|
||||
```
|
||||
|
||||
## Evidence Collection
|
||||
|
||||
```bash
|
||||
# Access review export
|
||||
aws iam generate-credential-report
|
||||
aws iam get-credential-report
|
||||
|
||||
# Audit logs
|
||||
aws cloudtrail lookup-events --start-time $(date -d '30 days ago' --iso)
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Continuous compliance monitoring
|
||||
- Annual risk assessments
|
||||
- Regular control testing
|
||||
- Documentation maintenance
|
||||
@@ -0,0 +1,76 @@
|
||||
---
|
||||
name: access-review
|
||||
description: Conduct periodic access reviews and certifications. Implement access governance and recertification workflows. Use when managing access compliance.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Access Review
|
||||
|
||||
Implement periodic access review processes.
|
||||
|
||||
## Review Process
|
||||
|
||||
```yaml
|
||||
access_review_workflow:
|
||||
1_extract:
|
||||
- Pull access data from systems
|
||||
- Generate access report
|
||||
|
||||
2_review:
|
||||
- Manager certification
|
||||
- Risk-based prioritization
|
||||
- Decision documentation
|
||||
|
||||
3_action:
|
||||
- Revoke unnecessary access
|
||||
- Update exceptions
|
||||
- Document decisions
|
||||
|
||||
4_report:
|
||||
- Compliance metrics
|
||||
- Remediation tracking
|
||||
```
|
||||
|
||||
## AWS IAM Review
|
||||
|
||||
```bash
|
||||
# Generate credential report
|
||||
aws iam generate-credential-report
|
||||
aws iam get-credential-report --output text --query Content | base64 -d
|
||||
|
||||
# Find inactive users
|
||||
aws iam list-users | jq -r '.Users[] | select(.PasswordLastUsed < "2024-01-01") | .UserName'
|
||||
|
||||
# List unused access keys
|
||||
aws iam get-access-key-last-used --access-key-id AKIAXXXXXXXX
|
||||
```
|
||||
|
||||
## Automation
|
||||
|
||||
```python
|
||||
def generate_access_report():
|
||||
users = get_all_users()
|
||||
report = []
|
||||
|
||||
for user in users:
|
||||
report.append({
|
||||
'user': user.email,
|
||||
'roles': user.roles,
|
||||
'last_login': user.last_login,
|
||||
'manager': user.manager,
|
||||
'review_status': 'pending'
|
||||
})
|
||||
|
||||
return report
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Quarterly reviews minimum
|
||||
- Risk-based frequency
|
||||
- Manager attestation
|
||||
- Automated revocation
|
||||
- Audit trail maintenance
|
||||
@@ -0,0 +1,74 @@
|
||||
---
|
||||
name: asset-inventory
|
||||
description: Maintain IT asset inventory and configuration management database. Track hardware, software, and cloud resources. Use when managing IT assets.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Asset Inventory
|
||||
|
||||
Maintain comprehensive IT asset tracking.
|
||||
|
||||
## Asset Categories
|
||||
|
||||
```yaml
|
||||
asset_types:
|
||||
hardware:
|
||||
- Servers
|
||||
- Network devices
|
||||
- Endpoints
|
||||
|
||||
software:
|
||||
- Applications
|
||||
- Operating systems
|
||||
- Licenses
|
||||
|
||||
cloud:
|
||||
- Compute instances
|
||||
- Storage
|
||||
- Databases
|
||||
|
||||
data:
|
||||
- Databases
|
||||
- File shares
|
||||
- Backups
|
||||
```
|
||||
|
||||
## AWS Inventory
|
||||
|
||||
```bash
|
||||
# List all resources
|
||||
aws resourcegroupstaggingapi get-resources
|
||||
|
||||
# EC2 instances
|
||||
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name]'
|
||||
|
||||
# AWS Config
|
||||
aws configservice describe-configuration-recorders
|
||||
```
|
||||
|
||||
## Asset Database Schema
|
||||
|
||||
```yaml
|
||||
asset:
|
||||
id: unique identifier
|
||||
name: display name
|
||||
type: hardware/software/cloud
|
||||
owner: responsible team
|
||||
classification: public/internal/confidential
|
||||
location: physical/cloud location
|
||||
status: active/retired/decommissioned
|
||||
created: timestamp
|
||||
updated: timestamp
|
||||
tags: []
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Automated discovery
|
||||
- Regular reconciliation
|
||||
- Owner assignment
|
||||
- Classification tagging
|
||||
- Lifecycle tracking
|
||||
@@ -0,0 +1,81 @@
|
||||
---
|
||||
name: change-management
|
||||
description: Implement change management processes. Configure CAB reviews, change windows, and rollback procedures. Use when managing production changes.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Change Management
|
||||
|
||||
Implement structured change management processes.
|
||||
|
||||
## Change Process
|
||||
|
||||
```yaml
|
||||
change_workflow:
|
||||
1_request:
|
||||
- Change description
|
||||
- Risk assessment
|
||||
- Rollback plan
|
||||
- Testing evidence
|
||||
|
||||
2_review:
|
||||
- Technical review
|
||||
- Security review
|
||||
- CAB approval (if high risk)
|
||||
|
||||
3_schedule:
|
||||
- Change window
|
||||
- Communication
|
||||
- Resource allocation
|
||||
|
||||
4_implement:
|
||||
- Execute change
|
||||
- Verify success
|
||||
- Update documentation
|
||||
|
||||
5_review:
|
||||
- Post-implementation review
|
||||
- Lessons learned
|
||||
```
|
||||
|
||||
## Change Classification
|
||||
|
||||
| Type | Risk | Approval | Example |
|
||||
|------|------|----------|---------|
|
||||
| Standard | Low | Pre-approved | Patching |
|
||||
| Normal | Medium | Manager | Config change |
|
||||
| Emergency | Variable | Expedited | Security fix |
|
||||
|
||||
## Pull Request Template
|
||||
|
||||
```markdown
|
||||
## Change Description
|
||||
|
||||
## Risk Level
|
||||
- [ ] Low - Standard change
|
||||
- [ ] Medium - Normal change
|
||||
- [ ] High - CAB required
|
||||
|
||||
## Testing
|
||||
- [ ] Unit tests pass
|
||||
- [ ] Integration tests pass
|
||||
- [ ] Staging deployment verified
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
## Stakeholders Notified
|
||||
- [ ] Operations
|
||||
- [ ] Security
|
||||
- [ ] Business owners
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Clear change categories
|
||||
- Required approvals by risk
|
||||
- Rollback procedures documented
|
||||
- Post-change verification
|
||||
- Change freeze windows
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
name: policy-as-code
|
||||
description: Implement policy as code with OPA, Sentinel, and Kyverno. Automate policy enforcement in CI/CD and infrastructure. Use when enforcing compliance through automation.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Policy as Code
|
||||
|
||||
Automate policy enforcement through code.
|
||||
|
||||
## Open Policy Agent (OPA)
|
||||
|
||||
```rego
|
||||
# deny_public_buckets.rego
|
||||
package terraform.s3
|
||||
|
||||
deny[msg] {
|
||||
resource := input.resource.aws_s3_bucket[name]
|
||||
resource.acl == "public-read"
|
||||
msg := sprintf("S3 bucket '%s' has public ACL", [name])
|
||||
}
|
||||
```
|
||||
|
||||
## Kyverno (Kubernetes)
|
||||
|
||||
```yaml
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: require-labels
|
||||
spec:
|
||||
validationFailureAction: enforce
|
||||
rules:
|
||||
- name: check-labels
|
||||
match:
|
||||
resources:
|
||||
kinds:
|
||||
- Pod
|
||||
validate:
|
||||
message: "Label 'app' is required"
|
||||
pattern:
|
||||
metadata:
|
||||
labels:
|
||||
app: "?*"
|
||||
```
|
||||
|
||||
## Checkov
|
||||
|
||||
```bash
|
||||
# Scan Terraform
|
||||
checkov -d . --framework terraform
|
||||
|
||||
# Custom check
|
||||
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
|
||||
|
||||
class S3Encryption(BaseResourceCheck):
|
||||
def scan_resource_conf(self, conf):
|
||||
return CheckResult.PASSED if 'encryption' in conf else CheckResult.FAILED
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Version control policies
|
||||
- Test policies in CI
|
||||
- Gradual rollout (warn → enforce)
|
||||
- Exception management
|
||||
@@ -0,0 +1,73 @@
|
||||
---
|
||||
name: vendor-management
|
||||
description: Implement vendor risk management programs. Assess third-party security and maintain vendor inventory. Use when managing supplier security.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Vendor Management
|
||||
|
||||
Manage third-party vendor security risks.
|
||||
|
||||
## Vendor Assessment
|
||||
|
||||
```yaml
|
||||
assessment_process:
|
||||
1_identify:
|
||||
- Catalog all vendors
|
||||
- Classify by risk tier
|
||||
|
||||
2_assess:
|
||||
- Security questionnaire
|
||||
- SOC 2 review
|
||||
- Penetration test results
|
||||
|
||||
3_contract:
|
||||
- Security requirements
|
||||
- Data processing agreement
|
||||
- SLAs
|
||||
|
||||
4_monitor:
|
||||
- Continuous monitoring
|
||||
- Annual reassessment
|
||||
- Incident notification
|
||||
```
|
||||
|
||||
## Risk Tiers
|
||||
|
||||
| Tier | Criteria | Assessment |
|
||||
|------|----------|------------|
|
||||
| Critical | Access to sensitive data | Full assessment, annual |
|
||||
| High | Significant data access | Questionnaire + SOC 2 |
|
||||
| Medium | Limited data access | Security questionnaire |
|
||||
| Low | No data access | Basic due diligence |
|
||||
|
||||
## Security Questionnaire
|
||||
|
||||
```yaml
|
||||
categories:
|
||||
governance:
|
||||
- Security policies
|
||||
- Risk management
|
||||
- Compliance certifications
|
||||
|
||||
technical:
|
||||
- Access controls
|
||||
- Encryption
|
||||
- Vulnerability management
|
||||
|
||||
operational:
|
||||
- Incident response
|
||||
- Business continuity
|
||||
- Change management
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Tier-based assessments
|
||||
- Regular reassessment
|
||||
- Contract security terms
|
||||
- Incident notification requirements
|
||||
- Exit strategy planning
|
||||
Reference in New Issue
Block a user