security-hardening_skill

Overview

This skill reduces attack surface across OS, container, cloud, network, and database layers using CIS Benchmarks and zero-trust principles. It provides automated scanning, prescriptive hardening actions, and continuous verification to support production hardening and compliance. Use it to enforce least-privilege, default-deny policies, and defense-in-depth controls across your infrastructure.

How this skill works

The skill inspects configuration and runtime posture using CIS benchmark tooling and a suite of scanners (Trivy, kube-bench, docker-bench-security, Checkov, Prowler). It applies layer-specific hardening patterns (kernel tuning, non-root containers, IAM least privilege, network default-deny, DB encryption) and generates audit reports. Integration points include CI/CD pipelines for automated scans, policy engines (OPA/Gatekeeper, Kyverno) for enforcement, and cloud posture tools for continuous monitoring.

When to use it

• Before deploying production services or exposing systems to the internet
• When preparing for compliance audits (SOC 2, PCI-DSS, HIPAA, FedRAMP)
• After vulnerability scans or penetration tests reveal configuration issues
• To implement zero-trust architecture and least-privilege access
• When automating security baselines across containers, cloud, and IaC

Best practices

• Prioritize internet-facing systems and sensitive-data systems first
• Start with default-deny and explicitly allow necessary traffic and actions
• Enforce least privilege via RBAC/IAM and narrow database roles
• Automate scanning and remediation in CI/CD to avoid manual drift
• Verify hardening continuously with scheduled scans and alerting

Example use cases

• Harden a Kubernetes cluster: run kube-bench, enforce PodSecurity and network policies, and integrate Kyverno
• Lock down container images: adopt Chainguard or Distroless bases, run Trivy in CI, and set read-only filesystems
• Secure cloud accounts: apply IAM least privilege, block public S3 access, and run Prowler or ScoutSuite
• Apply OS baseline: use Ansible to enforce CIS sysctl, SSH hardening, and SELinux/AppArmor
• Prepare for compliance: aggregate CIS and vulnerability reports into a compliance dashboard