.

security/operations/incident-response/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: incident-response
+description: Handle security incidents with IR playbooks and procedures. Implement detection, containment, eradication, and recovery processes. Use when responding to security events or building incident response capabilities.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Incident Response
+
+Handle security incidents effectively with structured response procedures.
+
+## Incident Response Phases
+
+```yaml
+phases:
+  1_preparation:
+    - IR team and contacts
+    - Tools and access ready
+    - Playbooks documented
+    
+  2_detection:
+    - Alert triage
+    - Initial assessment
+    - Severity classification
+    
+  3_containment:
+    - Short-term containment
+    - Evidence preservation
+    - System isolation
+    
+  4_eradication:
+    - Root cause analysis
+    - Remove threat
+    - Patch vulnerabilities
+    
+  5_recovery:
+    - System restoration
+    - Monitoring enhanced
+    - Business continuity
+    
+  6_lessons_learned:
+    - Post-incident review
+    - Documentation update
+    - Process improvement
+```
+
+## Severity Classification
+
+| Level | Impact | Response Time |
+|-------|--------|---------------|
+| Critical | Data breach, full outage | Immediate |
+| High | Service degraded, potential breach | < 1 hour |
+| Medium | Limited impact, contained | < 4 hours |
+| Low | Minimal impact | Next business day |
+
+## Initial Response Checklist
+
+```markdown
+- [ ] Confirm incident is real (not false positive)
+- [ ] Classify severity level
+- [ ] Notify IR team
+- [ ] Begin documentation
+- [ ] Preserve evidence
+- [ ] Implement containment
+- [ ] Communicate to stakeholders
+```
+
+## Evidence Collection
+
+```bash
+# System state
+ps aux > /evidence/processes.txt
+netstat -tuln > /evidence/connections.txt
+last -a > /evidence/logins.txt
+
+# Memory dump
+dd if=/dev/mem of=/evidence/memory.dump
+
+# Log preservation
+tar czf /evidence/logs.tar.gz /var/log/
+```
+
+## Best Practices
+
+- Pre-defined playbooks
+- Regular IR drills
+- Clear communication channels
+- Legal team involvement
+- Post-incident reviews
+
+## Related Skills
+
+- [audit-logging](../../../compliance/auditing/audit-logging/) - Log analysis
+- [alerting-oncall](../../../devops/observability/alerting-oncall/) - Alert management

security/operations/incident-response/assets/incident-template.md

@@ -0,0 +1,155 @@
+# Incident Report: [INCIDENT-ID]
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Incident ID** | INC-YYYY-MMDD-XXX |
+| **Status** | Open / Contained / Resolved |
+| **Severity** | SEV1 / SEV2 / SEV3 / SEV4 |
+| **Incident Commander** | [Name] |
+| **Detection Time** | YYYY-MM-DD HH:MM UTC |
+| **Resolution Time** | YYYY-MM-DD HH:MM UTC |
+| **Duration** | X hours Y minutes |
+
+**Summary:** [1-2 sentence description of the incident]
+
+---
+
+## Timeline
+
+| Time (UTC) | Event |
+|------------|-------|
+| YYYY-MM-DD HH:MM | [Event description] |
+| YYYY-MM-DD HH:MM | [Event description] |
+| YYYY-MM-DD HH:MM | [Event description] |
+
+---
+
+## Impact Assessment
+
+### Systems Affected
+- [ ] System 1 - [Impact description]
+- [ ] System 2 - [Impact description]
+
+### Data Affected
+- [ ] Type of data
+- [ ] Volume
+- [ ] Sensitivity classification
+
+### Users Affected
+- Number of users: [X]
+- User groups: [Groups]
+
+### Business Impact
+- [ ] Service downtime: [Duration]
+- [ ] Financial impact: [Estimate]
+- [ ] Reputation impact: [Assessment]
+
+---
+
+## Root Cause Analysis
+
+### Attack Vector
+[Description of how the incident occurred]
+
+### Contributing Factors
+1. [Factor 1]
+2. [Factor 2]
+3. [Factor 3]
+
+### Root Cause
+[Description of the underlying cause]
+
+---
+
+## Indicators of Compromise (IOCs)
+
+### IP Addresses
+```
+X.X.X.X - [Description]
+```
+
+### Domains
+```
+malicious.domain.com - [Description]
+```
+
+### File Hashes
+```
+SHA256: [hash] - [Filename]
+```
+
+### Other IOCs
+[Any other relevant indicators]
+
+---
+
+## Response Actions
+
+### Containment
+- [x] Action 1
+- [x] Action 2
+- [ ] Action 3 (in progress)
+
+### Eradication
+- [ ] Action 1
+- [ ] Action 2
+
+### Recovery
+- [ ] Action 1
+- [ ] Action 2
+
+---
+
+## Lessons Learned
+
+### What Went Well
+1. [Item 1]
+2. [Item 2]
+
+### What Could Be Improved
+1. [Item 1]
+2. [Item 2]
+
+---
+
+## Action Items
+
+| ID | Action | Owner | Due Date | Status |
+|----|--------|-------|----------|--------|
+| 1 | [Action description] | [Name] | YYYY-MM-DD | Open |
+| 2 | [Action description] | [Name] | YYYY-MM-DD | Open |
+
+---
+
+## Notifications
+
+### Internal
+- [ ] Security Team
+- [ ] Engineering Team
+- [ ] Executive Team
+- [ ] Legal/Compliance
+
+### External
+- [ ] Affected customers
+- [ ] Regulatory bodies
+- [ ] Law enforcement
+
+---
+
+## Appendix
+
+### Evidence Files
+- [Link to evidence archive]
+- [Link to log exports]
+
+### Related Documents
+- [Link to runbook used]
+- [Link to previous incidents]
+
+---
+
+**Report Author:** [Name]  
+**Report Date:** YYYY-MM-DD  
+**Last Updated:** YYYY-MM-DD

security/operations/incident-response/references/incident-playbook.md

@@ -0,0 +1,147 @@
+# Incident Response Playbook
+
+## Incident Severity Levels
+
+| Level | Name | Description | Response Time | Example |
+|-------|------|-------------|---------------|---------|
+| SEV1 | Critical | Active breach, data exfiltration | Immediate | Ransomware, active attacker |
+| SEV2 | High | Confirmed compromise, contained | 1 hour | Malware, credential theft |
+| SEV3 | Medium | Suspicious activity, potential threat | 4 hours | Phishing success, anomaly |
+| SEV4 | Low | Minor security event | 24 hours | Policy violation |
+
+## Response Phases
+
+### 1. Detection & Triage (0-15 minutes)
+
+```
+□ Confirm the incident is real (not false positive)
+□ Assess initial scope and severity
+□ Assign Incident Commander
+□ Open incident channel (#incident-YYYY-MM-DD)
+□ Start incident timeline documentation
+```
+
+**Key Questions:**
+- What systems are affected?
+- Is the threat active?
+- What data may be compromised?
+- Is it contained or spreading?
+
+### 2. Containment (15-60 minutes)
+
+**Short-term Containment:**
+```
+□ Isolate affected systems (network/firewall)
+□ Block malicious IPs/domains
+□ Disable compromised accounts
+□ Preserve evidence before changes
+```
+
+**Commands:**
+```bash
+# Network isolation
+iptables -I INPUT -s <malicious-ip> -j DROP
+iptables -I OUTPUT -d <malicious-ip> -j DROP
+
+# Account disable
+usermod -L <username>
+passwd -l <username>
+
+# Service isolation
+systemctl stop <compromised-service>
+```
+
+### 3. Investigation (1-4 hours)
+
+```
+□ Collect evidence (logs, memory, disk)
+□ Identify attack vector
+□ Determine scope of compromise
+□ Document findings in timeline
+```
+
+**Log Sources:**
+- Authentication: /var/log/auth.log, CloudTrail
+- Application: Application logs, APM
+- Network: Firewall logs, VPC Flow Logs
+- System: syslog, journald
+
+### 4. Eradication (1-24 hours)
+
+```
+□ Remove malware/backdoors
+□ Patch vulnerabilities
+□ Reset compromised credentials
+□ Update security controls
+□ Verify complete removal
+```
+
+### 5. Recovery (1-48 hours)
+
+```
+□ Restore systems from clean backups
+□ Validate system integrity
+□ Monitor for re-infection
+□ Gradually restore services
+□ Communicate status updates
+```
+
+### 6. Post-Incident (1-2 weeks)
+
+```
+□ Conduct blameless post-mortem
+□ Document lessons learned
+□ Create action items
+□ Update runbooks and detection
+□ Report to stakeholders
+□ File regulatory notifications (if required)
+```
+
+## Communication Templates
+
+### Internal Notification
+```
+SECURITY INCIDENT - [SEV LEVEL]
+
+Status: Active/Contained/Resolved
+Incident Commander: [Name]
+Channel: #incident-YYYY-MM-DD
+
+Summary: [Brief description]
+
+Impact:
+- Systems: [List]
+- Data: [Type if applicable]
+- Users: [Count/scope]
+
+Current Actions:
+- [Action 1]
+- [Action 2]
+
+Next Update: [Time]
+```
+
+### External Notification (if required)
+```
+Subject: Security Incident Notification
+
+We are writing to inform you of a security incident 
+that occurred on [DATE].
+
+What Happened: [Description]
+Data Involved: [Types]
+Actions Taken: [Response measures]
+What You Can Do: [Recommendations]
+Contact: [Security team contact]
+```
+
+## Escalation Contacts
+
+| Role | Primary | Secondary |
+|------|---------|-----------|
+| Incident Commander | [Name] | [Name] |
+| Security Lead | [Name] | [Name] |
+| Engineering Lead | [Name] | [Name] |
+| Legal/Compliance | [Name] | [Name] |
+| Communications | [Name] | [Name] |
+| Executive Sponsor | [Name] | [Name] |

security/operations/incident-response/references/ioc-hunting.md

@@ -0,0 +1,149 @@
+# Indicator of Compromise (IOC) Hunting Guide
+
+## Common IOC Types
+
+| Type | Description | Example |
+|------|-------------|---------|
+| IP Address | Malicious source/destination | 192.168.1.100 |
+| Domain | C2 or phishing domain | malware.evil.com |
+| File Hash | Malware signature | SHA256:abc123... |
+| File Path | Suspicious file location | /tmp/.hidden |
+| Process | Malicious process name | cryptominer |
+| User | Compromised account | admin |
+
+## Log Hunting Queries
+
+### SSH Brute Force Detection
+```bash
+# Failed SSH attempts
+grep "Failed password" /var/log/auth.log | \
+  awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head
+
+# Successful logins after failures
+grep -E "Accepted|Failed" /var/log/auth.log | \
+  grep -B5 "Accepted" | grep "Failed"
+```
+
+### Suspicious Process Activity
+```bash
+# Processes running from /tmp
+ps aux | grep -E "^.*/tmp/|^.*/dev/shm/"
+
+# Hidden processes
+ps aux | awk '$11 ~ /^\./'
+
+# Processes with deleted binaries
+ls -la /proc/*/exe 2>/dev/null | grep deleted
+
+# Unusual parent-child relationships
+ps -eo pid,ppid,cmd | grep -E "bash.*-c|sh.*-c"
+```
+
+### Network IOCs
+```bash
+# Connections to known bad ports
+ss -anp | grep -E ":4444|:5555|:6666|:31337"
+
+# Outbound connections from unusual processes
+ss -anp | grep -v -E "chrome|firefox|curl|wget" | grep ESTAB
+
+# DNS queries to suspicious domains
+grep -E "query.*\.(tk|ml|ga|cf|gq)$" /var/log/syslog
+
+# Large outbound transfers
+ss -anp | awk '$3 > 1000000'
+```
+
+### File System IOCs
+```bash
+# Recently modified files in sensitive locations
+find /etc /usr/bin /usr/sbin -mtime -1 -ls 2>/dev/null
+
+# Files with suspicious permissions
+find / -perm -4000 -o -perm -2000 -ls 2>/dev/null
+
+# Hidden files
+find / -name ".*" -type f -ls 2>/dev/null | head -50
+
+# World-writable files
+find / -perm -002 -type f -ls 2>/dev/null
+```
+
+### User Activity IOCs
+```bash
+# Recent sudo usage
+grep sudo /var/log/auth.log | tail -50
+
+# Users logged in from multiple IPs
+last | awk '{print $1, $3}' | sort | uniq -c | sort -rn
+
+# SSH keys added recently
+find /home -name "authorized_keys" -mtime -7 -ls
+
+# Unusual cron jobs
+for user in $(cut -d: -f1 /etc/passwd); do
+  crontab -l -u $user 2>/dev/null | grep -v "^#"
+done
+```
+
+## AWS CloudTrail Hunting
+
+```bash
+# Console logins from unusual locations
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
+  --query 'Events[*].[CloudTrailEvent]' --output text | jq '.'
+
+# Root account usage
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=Username,AttributeValue=root
+
+# Security group changes
+aws cloudtrail lookup-events \
+  --lookup-attributes AttributeKey=EventName,AttributeValue=AuthorizeSecurityGroupIngress
+```
+
+## YARA Rule Example
+
+```yara
+rule Suspicious_Shell_Script {
+    meta:
+        description = "Detects suspicious shell scripts"
+        severity = "medium"
+    strings:
+        $s1 = "curl" ascii
+        $s2 = "wget" ascii
+        $s3 = "/dev/tcp/" ascii
+        $s4 = "base64 -d" ascii
+        $s5 = "chmod +x" ascii
+    condition:
+        3 of them
+}
+```
+
+## Response Actions
+
+### Block IOC
+```bash
+# Block IP
+iptables -I INPUT -s <IP> -j DROP
+iptables -I OUTPUT -d <IP> -j DROP
+
+# Block domain (via hosts)
+echo "127.0.0.1 malicious.domain.com" >> /etc/hosts
+
+# Kill process
+kill -9 <PID>
+```
+
+### Preserve Evidence
+```bash
+# Capture process memory
+gcore <PID>
+
+# Copy suspicious file
+cp --preserve=all /path/to/file /evidence/
+
+# Capture network traffic
+tcpdump -i any -w /evidence/capture.pcap &
+```

security/operations/incident-response/scripts/collect-evidence.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+# Security Incident Evidence Collection Script
+# Usage: ./collect-evidence.sh [incident-id]
+
+set -euo pipefail
+
+INCIDENT_ID="${1:-incident-$(date +%Y%m%d-%H%M%S)}"
+EVIDENCE_DIR="/tmp/evidence-$INCIDENT_ID"
+HOSTNAME=$(hostname)
+
+mkdir -p "$EVIDENCE_DIR"
+
+echo "========================================="
+echo "Security Incident Evidence Collection"
+echo "Incident ID: $INCIDENT_ID"
+echo "Host: $HOSTNAME"
+echo "Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
+echo "Output: $EVIDENCE_DIR"
+echo "========================================="
+echo ""
+
+# Create metadata file
+cat > "$EVIDENCE_DIR/metadata.txt" << EOF
+Incident ID: $INCIDENT_ID
+Collection Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')
+Hostname: $HOSTNAME
+Kernel: $(uname -a)
+Collector: $(whoami)
+EOF
+
+# System information
+echo "Collecting system information..."
+mkdir -p "$EVIDENCE_DIR/system"
+uname -a > "$EVIDENCE_DIR/system/uname.txt"
+cat /etc/os-release > "$EVIDENCE_DIR/system/os-release.txt" 2>/dev/null || true
+uptime > "$EVIDENCE_DIR/system/uptime.txt"
+date -u > "$EVIDENCE_DIR/system/date.txt"
+
+# Running processes
+echo "Collecting process information..."
+mkdir -p "$EVIDENCE_DIR/processes"
+ps auxf > "$EVIDENCE_DIR/processes/ps-auxf.txt"
+ps -eo pid,ppid,user,cmd --sort=-pid > "$EVIDENCE_DIR/processes/ps-sorted.txt"
+pstree -p > "$EVIDENCE_DIR/processes/pstree.txt" 2>/dev/null || true
+
+# Network connections
+echo "Collecting network information..."
+mkdir -p "$EVIDENCE_DIR/network"
+ss -tlnp > "$EVIDENCE_DIR/network/listening-tcp.txt"
+ss -ulnp > "$EVIDENCE_DIR/network/listening-udp.txt"
+ss -anp > "$EVIDENCE_DIR/network/all-connections.txt"
+ip addr > "$EVIDENCE_DIR/network/ip-addr.txt"
+ip route > "$EVIDENCE_DIR/network/ip-route.txt"
+iptables -L -n -v > "$EVIDENCE_DIR/network/iptables.txt" 2>/dev/null || true
+cat /etc/hosts > "$EVIDENCE_DIR/network/hosts.txt"
+
+# User information
+echo "Collecting user information..."
+mkdir -p "$EVIDENCE_DIR/users"
+cat /etc/passwd > "$EVIDENCE_DIR/users/passwd.txt"
+cat /etc/group > "$EVIDENCE_DIR/users/group.txt"
+who > "$EVIDENCE_DIR/users/who.txt"
+w > "$EVIDENCE_DIR/users/w.txt"
+last -100 > "$EVIDENCE_DIR/users/last.txt"
+lastlog > "$EVIDENCE_DIR/users/lastlog.txt" 2>/dev/null || true
+
+# Authentication logs
+echo "Collecting authentication logs..."
+mkdir -p "$EVIDENCE_DIR/logs"
+tail -1000 /var/log/auth.log > "$EVIDENCE_DIR/logs/auth.log" 2>/dev/null || true
+tail -1000 /var/log/secure > "$EVIDENCE_DIR/logs/secure.log" 2>/dev/null || true
+tail -1000 /var/log/syslog > "$EVIDENCE_DIR/logs/syslog.txt" 2>/dev/null || true
+journalctl -u sshd --since "1 day ago" > "$EVIDENCE_DIR/logs/sshd.log" 2>/dev/null || true
+
+# Scheduled tasks
+echo "Collecting scheduled tasks..."
+mkdir -p "$EVIDENCE_DIR/scheduled"
+crontab -l > "$EVIDENCE_DIR/scheduled/crontab-current.txt" 2>/dev/null || true
+ls -la /etc/cron.* > "$EVIDENCE_DIR/scheduled/cron-dirs.txt" 2>/dev/null || true
+cat /etc/crontab > "$EVIDENCE_DIR/scheduled/etc-crontab.txt" 2>/dev/null || true
+systemctl list-timers > "$EVIDENCE_DIR/scheduled/systemd-timers.txt" 2>/dev/null || true
+
+# File system
+echo "Collecting filesystem information..."
+mkdir -p "$EVIDENCE_DIR/filesystem"
+df -h > "$EVIDENCE_DIR/filesystem/df.txt"
+mount > "$EVIDENCE_DIR/filesystem/mounts.txt"
+find /tmp /var/tmp -type f -mtime -1 -ls > "$EVIDENCE_DIR/filesystem/recent-tmp.txt" 2>/dev/null || true
+
+# Package hashes
+echo "Collecting hash information..."
+if command -v sha256sum &>/dev/null; then
+    find /usr/bin /usr/sbin -type f -executable 2>/dev/null | head -100 | xargs sha256sum > "$EVIDENCE_DIR/filesystem/binary-hashes.txt" 2>/dev/null || true
+fi
+
+# Create archive
+echo ""
+echo "Creating evidence archive..."
+ARCHIVE="/tmp/$INCIDENT_ID-evidence.tar.gz"
+tar -czf "$ARCHIVE" -C /tmp "evidence-$INCIDENT_ID"
+
+echo ""
+echo "========================================="
+echo "Evidence collection complete"
+echo "Archive: $ARCHIVE"
+echo "Size: $(du -h "$ARCHIVE" | cut -f1)"
+echo ""
+echo "SHA256: $(sha256sum "$ARCHIVE" | cut -d' ' -f1)"
+echo "========================================="

security/operations/penetration-testing/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: penetration-testing
+description: Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Penetration Testing
+
+Validate security controls through authorized testing.
+
+## Phases
+
+```yaml
+pentest_phases:
+  1_reconnaissance:
+    - Passive information gathering
+    - DNS enumeration
+    - Network mapping
+    
+  2_scanning:
+    - Port scanning
+    - Service identification
+    - Vulnerability scanning
+    
+  3_exploitation:
+    - Attempt exploitation
+    - Verify vulnerabilities
+    - Document findings
+    
+  4_post_exploitation:
+    - Privilege escalation
+    - Lateral movement
+    - Data access
+    
+  5_reporting:
+    - Document findings
+    - Risk assessment
+    - Remediation recommendations
+```
+
+## Reconnaissance
+
+```bash
+# DNS enumeration
+dig example.com ANY
+host -l example.com
+
+# Subdomain discovery
+subfinder -d example.com
+
+# WHOIS
+whois example.com
+```
+
+## Scanning
+
+```bash
+# Port scan
+nmap -sV -sC -p- target.com
+
+# Web scanning
+nikto -h https://target.com
+dirb https://target.com
+
+# Vulnerability scan
+nmap --script vuln target.com
+```
+
+## Web Testing
+
+```bash
+# SQL injection test
+sqlmap -u "http://target.com/page?id=1"
+
+# XSS testing
+# Use Burp Suite or manual testing
+
+# Directory traversal
+curl "http://target.com/file?path=../../../etc/passwd"
+```
+
+## Rules of Engagement
+
+```yaml
+scope:
+  in_scope:
+    - target.com
+    - api.target.com
+  out_of_scope:
+    - production-db.target.com
+    - third-party services
+  
+  testing_window: "Weekdays 2-6 AM UTC"
+  emergency_contact: "security@target.com"
+```
+
+## Best Practices
+
+- Always get written authorization
+- Define clear scope
+- Document everything
+- Report critical findings immediately
+- Safe exploitation techniques only
+
+## Related Skills
+
+- [dast-scanning](../../scanning/dast-scanning/) - Automated testing
+- [vulnerability-scanning](../../scanning/vulnerability-scanning/) - Vulnerability discovery

security/operations/security-automation/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: security-automation
+description: Automate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR capabilities. Use when scaling security operations or implementing DevSecOps.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Security Automation
+
+Automate security operations for scale and efficiency.
+
+## Security Pipeline
+
+```yaml
+# .github/workflows/security.yml
+name: Security Pipeline
+
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Secret Scanning
+        uses: trufflesecurity/trufflehog@main
+        
+      - name: SAST
+        uses: returntocorp/semgrep-action@v1
+        
+      - name: Dependency Scan
+        run: npm audit --audit-level=high
+        
+      - name: Container Scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          
+      - name: Compliance Check
+        run: |
+          checkov -d . --framework terraform
+```
+
+## Automated Remediation
+
+```python
+# Auto-remediation script
+def remediate_public_s3(bucket_name):
+    """Remove public access from S3 bucket."""
+    s3 = boto3.client('s3')
+    s3.put_public_access_block(
+        Bucket=bucket_name,
+        PublicAccessBlockConfiguration={
+            'BlockPublicAcls': True,
+            'IgnorePublicAcls': True,
+            'BlockPublicPolicy': True,
+            'RestrictPublicBuckets': True
+        }
+    )
+```
+
+## SOAR Integration
+
+```yaml
+playbook:
+  name: Suspicious Login Response
+  trigger: alert.type == "suspicious_login"
+  actions:
+    - enrich_ip:
+        source: threat_intel
+    - if_condition: ip.is_malicious
+      then:
+        - block_ip:
+            firewall: cloudflare
+        - disable_user:
+            duration: 1h
+        - notify:
+            channel: security
+        - create_ticket:
+            priority: high
+```
+
+## Compliance as Code
+
+```python
+# Checkov custom check
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+class S3Encryption(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure S3 bucket has encryption enabled"
+        id = "CUSTOM_S3_1"
+        supported_resources = ['aws_s3_bucket']
+        super().__init__(name=name, id=id, ...)
+    
+    def scan_resource_conf(self, conf):
+        if 'server_side_encryption_configuration' in conf:
+            return CheckResult.PASSED
+        return CheckResult.FAILED
+```
+
+## Best Practices
+
+- Start with high-impact automations
+- Test in staging first
+- Include manual review gates
+- Monitor automation effectiveness
+- Regular rule updates
+
+## Related Skills
+
+- [github-actions](../../../devops/ci-cd/github-actions/) - CI/CD automation
+- [policy-as-code](../../../compliance/governance/policy-as-code/) - Policy enforcement

security/operations/threat-modeling/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: threat-modeling
+description: Conduct threat modeling using STRIDE methodology. Identify threats, assess risks, and design security controls. Use when designing secure systems or assessing application security.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Threat Modeling
+
+Identify and mitigate security threats during system design.
+
+## STRIDE Methodology
+
+| Threat | Description | Mitigation |
+|--------|-------------|------------|
+| **S**poofing | Pretending to be someone else | Authentication |
+| **T**ampering | Modifying data | Integrity controls |
+| **R**epudiation | Denying actions | Audit logging |
+| **I**nformation Disclosure | Data exposure | Encryption |
+| **D**enial of Service | Making service unavailable | Rate limiting |
+| **E**levation of Privilege | Gaining higher access | Authorization |
+
+## Process
+
+```yaml
+steps:
+  1_scope:
+    - Define system boundaries
+    - Identify assets
+    - Document data flows
+    
+  2_diagram:
+    - Create data flow diagrams
+    - Identify trust boundaries
+    - Mark entry points
+    
+  3_identify:
+    - Apply STRIDE to each component
+    - List potential threats
+    - Document attack vectors
+    
+  4_assess:
+    - Rate likelihood and impact
+    - Prioritize by risk score
+    
+  5_mitigate:
+    - Design countermeasures
+    - Accept/transfer risks
+    - Document decisions
+```
+
+## Data Flow Diagram
+
+```
+[External User] --> |HTTPS| --> [Load Balancer]
+                                      |
+                                      v
+                               [Web Server]
+                                      |
+                              [Trust Boundary]
+                                      |
+                                      v
+                                [App Server] --> [Database]
+```
+
+## Threat Cards
+
+```yaml
+threat:
+  id: T001
+  name: SQL Injection
+  category: Tampering
+  component: Database queries
+  likelihood: High
+  impact: Critical
+  mitigations:
+    - Parameterized queries
+    - Input validation
+    - WAF rules
+  status: Mitigated
+```
+
+## Best Practices
+
+- Integrate into SDLC
+- Review on architecture changes
+- Include development team
+- Document all decisions
+- Regular reassessment
+
+## Related Skills
+
+- [sast-scanning](../../scanning/sast-scanning/) - Code analysis
+- [penetration-testing](../penetration-testing/) - Validation

security/operations/threat-modeling/references/threat-model-template.md

@@ -0,0 +1,100 @@
+# Threat Modeling Template
+
+## 1. System Overview
+
+### Description
+[Brief description of the system being modeled]
+
+### Architecture Diagram
+```
+[ASCII diagram or link to diagram]
+
++--------+     +--------+     +--------+
+| Client | --> |  API   | --> |   DB   |
++--------+     +--------+     +--------+
+```
+
+### Components
+| Component | Description | Technology |
+|-----------|-------------|------------|
+| Frontend | Web UI | React |
+| API | REST API | Node.js |
+| Database | Data storage | PostgreSQL |
+
+### Data Flows
+| # | From | To | Data | Protocol |
+|---|------|----|----- |----------|
+| 1 | Client | API | User requests | HTTPS |
+| 2 | API | DB | Queries | TCP/TLS |
+
+## 2. Trust Boundaries
+
+```
+                 INTERNET
+                    |
+    ================|================  Trust Boundary 1
+                    |
+               [ WAF/LB ]
+                    |
+    ================|================  Trust Boundary 2
+                    |
+              [ API Server ]
+                    |
+    ================|================  Trust Boundary 3
+                    |
+              [ Database ]
+```
+
+## 3. Threat Identification (STRIDE)
+
+### Spoofing
+| ID | Threat | Component | Mitigation |
+|----|--------|-----------|------------|
+| S1 | Session hijacking | API | Use secure cookies, short TTL |
+| S2 | API impersonation | Client | Certificate pinning |
+
+### Tampering
+| ID | Threat | Component | Mitigation |
+|----|--------|-----------|------------|
+| T1 | Request modification | API | Input validation, signing |
+| T2 | Data modification | DB | Access controls, audit logs |
+
+### Repudiation
+| ID | Threat | Component | Mitigation |
+|----|--------|-----------|------------|
+| R1 | Action denial | API | Comprehensive logging |
+
+### Information Disclosure
+| ID | Threat | Component | Mitigation |
+|----|--------|-----------|------------|
+| I1 | Data leak | API | Encryption, access controls |
+| I2 | Error messages | All | Generic error responses |
+
+### Denial of Service
+| ID | Threat | Component | Mitigation |
+|----|--------|-----------|------------|
+| D1 | Resource exhaustion | API | Rate limiting, auto-scaling |
+
+### Elevation of Privilege
+| ID | Threat | Component | Mitigation |
+|----|--------|-----------|------------|
+| E1 | IDOR | API | Authorization checks |
+| E2 | SQL injection | DB | Parameterized queries |
+
+## 4. Risk Assessment
+
+| Threat ID | Likelihood | Impact | Risk | Priority |
+|-----------|------------|--------|------|----------|
+| S1 | Medium | High | High | P1 |
+| E2 | Low | Critical | High | P1 |
+
+## 5. Mitigations
+
+| Threat ID | Mitigation | Status | Owner |
+|-----------|------------|--------|-------|
+| S1 | Implement secure session management | In Progress | Auth Team |
+| E2 | Use ORM with parameterized queries | Done | Backend Team |
+
+## 6. Residual Risks
+
+[List any accepted risks with justification]