Security Hardening

What it does

This skill automates server configuration changes to minimize vulnerabilities by applying industry best practices and threat intelligence. It focuses on proactive reduction of attack surfaces across various infrastructure layers, including operating systems, containers, cloud configurations, networks, and databases. The skill utilizes CIS Benchmarks and zero-trust principles to enforce security controls and least privilege access.

When to use it

• Hardening production infrastructure before deployment.
• Meeting compliance requirements such as SOC 2, PCI-DSS, HIPAA, or FedRAMP.
• Implementing a zero-trust security architecture.
• Reducing risks associated with container or cloud misconfigurations.
• Preparing for security audits or penetration tests.

Key capabilities

• Operating System Hardening (Linux): Kernel parameter tuning, SSH hardening, user/group management, file system permissions, service minimization, SELinux/AppArmor enforcement.
• Container Hardening: Minimal base images, non-root execution, read-only filesystems, Seccomp/AppArmor profiles, resource limits, Pod Security Standards enforcement.
• Cloud Configuration Hardening: IAM least privilege, MFA enforcement, network security group configuration, encryption at rest and in transit, CSPM integration.
• Network Hardening: Default-deny policies, network segmentation, TLS/mTLS enforcement, DNS security (DNSSEC, filtering).
• Database Hardening: Authentication hardening, connection encryption, audit logging enablement, role-based permissions.

Example prompts

• "Harden the Linux operating system on this server."
• "Apply CIS benchmark settings to our container deployment."
• "Enforce least privilege IAM policies for cloud resources."
• "Review and harden database network access controls."

Tips & gotchas

• The skill applies configuration changes based on industry standards, so review the proposed modifications before implementation.
• Ensure you have appropriate permissions to modify system configurations.
• This skill focuses on configuration hardening; it does not replace other security measures like vulnerability scanning or intrusion detection systems.