--- name: Security & Compliance slug: security-compliance category: DevOps description: Security & Compliance guides security planning, threat modeling, incident response, and audit preparation for frameworks like SOC2, ISO27001, GDPR, and HIPAA. Use it to design, harden, monitor, and improve secure systems throughout the SDLC. github: "https://github.com/sangrokjung/claude-forge/tree/main/skills/security-compliance" language: Shell stars: 806 forks: 175 install: "npx degit https://github.com/sangrokjung/claude-forge/tree/main/skills/security-compliance ~/.claude/skills/security-compliance" installs_to: ~/.claude/skills/security-compliance source_path: skills/security-compliance/SKILL.md collection_size: 25 category_size: 798 collection_url: "https://dirskills.com/collections/sangrokjung/claude-forge" added: 2026-08-22T05:22:20.045Z last_synced: 2026-08-22T05:22:20.045Z canonical_url: "https://dirskills.com/skills/security-compliance" --- # Security & Compliance Security & Compliance guides security planning, threat modeling, incident response, and audit preparation for frameworks like SOC2, ISO27001, GDPR, and HIPAA. Use it to design, harden, monitor, and improve secure systems throughout the SDLC. **Install:** ```bash npx degit https://github.com/sangrokjung/claude-forge/tree/main/skills/security-compliance ~/.claude/skills/security-compliance ``` ## README # Security & Compliance Expert ## Core Principles ### 1. Defense in Depth Apply multiple layers of security controls so that if one fails, others provide protection. Never rely on a single security mechanism. ### 2. Zero Trust Architecture Never trust, always verify. Assume breach and verify every access request regardless of location or network. ### 3. Least Privilege Grant the minimum access necessary for users and systems to perform their functions. Regularly review and revoke unused permissions. ### 4. Security by Design Integrate security requirements from the earliest stages of system design, not as an afterthought. ### 5. Continuous Monitoring Implement ongoing monitoring and alerting to detect anomalies and security events in real-time. ### 6. Risk-Based Approach Prioritize security efforts based on risk assessment, focusing resources on the most critical assets and likely threats. ### 7. Compliance as Foundation Use compliance frameworks as a baseline, but go beyond minimum requirements to achieve actual security. ### 8. Incident Readiness Prepare for security incidents through planning, testing, and regular tabletop exercises. Assume compromise will occur. --- ## Security & Compliance Lifecycle ### Phase 1: Assess & Plan **Objective**: Understand current security posture and compliance requirements **Activities**: - Conduct security assessments and gap analysis - Identify compliance requirements (SOC2, ISO27001, GDPR, HIPAA, PCI-DSS) - Perform risk assessments and threat modeling - Define security policies and standards - Establish security governance structure - Create security roadmap with prioritized initiatives **Deliverables**: - Risk register with prioritized risks - Compliance gap analysis report - Security architecture documentation - Security policies and procedures - Security roadmap and budget ### Phase 2: Design & Architect **Objective**: Design secure systems and architectures **Activities**: - Design defense-in-depth architectures - Implement Zero Trust network architecture - Design identity and access management (IAM) systems - Architect data protection and encryption solutions - Design secure CI/CD pipelines - Create threat models for applications and systems - Define security controls and compensating controls **Deliverables**: - Security architecture diagrams - Threat models (STRIDE, PASTA, or attack trees) - Data flow diagrams with security boundaries - Encryption and key management design - IAM design with RBAC/ABAC models - Security control matrix ### Phase 3: Implement & Harden **Objective**: Deploy security controls and harden systems **Activities**: - Implement security controls (preventive, detective, corrective) - Configure security tools (SIEM, EDR, CASB, WAF, IDS/IPS) - Harden operating systems and applications - Implement encryption at rest and in transit - Deploy multi-factor authentication (MFA) - Configure logging and monitoring - Implement data loss prevention (DLP) - Set up vulnerability management program **Deliverables**: - Hardening baselines and configuration standards - Deployed security tools and controls - Encryption implementation - MFA deployment - Security monitoring dashboards - Vulnerability management procedures ### Phase 4: Monitor & Detect **Objective**: Continuously monitor for threats and anomalies **Activities**: - Monitor security logs and events (SIEM) - Analyze security alerts and anomalies - Conduct threat hunting - Perform vulnerability scanning and penetration testing - Monitor compliance controls - Track security metrics and KPIs - Review access logs and privileged account activity - Analyze threat intelligence feeds **Deliverables**: - Security operations center (SOC) runbooks - Alert triage and escalation procedures - Threat hunting playbooks - Vulnerability scan reports - Penetration test reports - Security metrics dashboard - Compliance monitoring reports ### Phase 5: Respond & Recover **Objective**: Respond to security incidents and recover operations **Activities**: - Execute incident response plan - Contain and eradicate threats - Perform forensic analysis - Recover affected systems - Conduct post-incident reviews - Update security controls based on lessons learned - Report incidents to stakeholders and regulators - Improve detection rules and response procedures **Deliverables**: - Incident response reports - Forensic analysis findings - Root cause analysis - Remediation plans - Updated incident response playbooks - Regulatory breach notifications (if required) - Post-incident review and recommendations ### Phase 6: Audit & Improve **Objective**: Validate compliance and continuously improve security **Activities**: - Conduct internal audits - Prepare for external audits (SOC2, ISO27001) - Perform compliance assessments - Review and update security policies - Conduct security training and awareness programs - Perform tabletop exercises and disaster recovery drills - Update risk assessments - Implement security improvements **Deliverables**: - Audit reports (internal and external) - SOC2 Type II report - ISO27001 certification - Compliance attestations - Updated policies and procedures - Training completion metrics - Tabletop exercise results - Continuous improvement plan --- ## Decision Frameworks ### 1. Risk Assessment Framework **When to use**: Evaluating security risks and prioritizing mitigation efforts **Process**: ``` 1. Identify Assets - What systems, data, and services need protection? - What is the business value of each asset? - Who are the asset owners? 2. Identify Threats - What threat actors might target these assets? (nation-state, cybercriminals, insiders) - What are their motivations? (financial gain, espionage, disruption) - What are current threat trends? 3. Identify Vulnerabilities - What weaknesses exist in systems or processes? - What security controls are missing or ineffective? - What are known CVEs affecting your systems? 4. Calculate Risk Risk = Likelihood × Impact Likelihood scale (1-5): 1 = Rare (< 5% chance in 1 year) 2 = Unlikely (5-25%) 3 = Possible (25-50%) 4 = Likely (50-75%) 5 = Almost Certain (> 75%) Impact scale (1-5): 1 = Minimal (< $10K loss, no data breach) 2 = Minor ($10K-$100K, limited data exposure) 3 = Moderate ($100K-$1M, significant data breach) 4 = Major ($1M-$10M, extensive data breach, regulatory fines) 5 = Catastrophic (> $10M, business-threatening) Risk Score = Likelihood × Impact (max 25) 5. Prioritize Risks - Critical: Risk score 15-25 (immediate action) - High: Risk score 10-14 (action within 30 days) - Medium: Risk score 5-9 (action within 90 days) - Low: Risk score 1-4 (monitor and accept) 6. Determine Risk Response - Mitigate: Implement controls to reduce risk - Accept: Document acceptance if risk is within tolerance - Transfer: Use insurance or third-party services - Avoid: Eliminate the activity that creates risk ``` **Output**: Risk register with prioritized risks and mitigation plans ### 2. Security Control Selection **When to use**: Choosing appropriate security controls for identified risks **Framework**: Use NIST CSF categories or CIS Controls ``` NIST CSF Functions: 1. Identify (ID) - Asset Management - Risk Assessment - Governance 2. Protect (PR) - Access Control - Data Security - Protective Technology 3. Detect (DE) - Anomalies and Events - Security Monitoring - Detection Processes 4. Respond (RS) - Response Planning - Communications - Analysis and Mitigation 5. Recover (RC) - Recovery Planning - Improvements - Communications Control Types: - Preventive: Stop incidents before they occur (MFA, firewalls, encryption) - Detective: Identify incidents when they occur (SIEM, IDS, log monitoring) - Corrective: Fix issues after detection (patching, incident response) - Deterrent: Discourage attackers (security policies, warnings) - Compensating: Alternative controls when primary controls aren't feasible Selection Criteria: 1. Does it address the identified risk? 2. Is it cost-effective? (Control cost < Risk value) 3. Is it technically feasible? 4. Does it meet compliance requirements? 5. Can we maintain and monitor it? ``` ### 3. Compliance Framework Selection **When to use**: Determining which compliance frameworks to implement **Decision Tree**: ``` What type of organization are you? ├─ SaaS/Cloud Service Provider │ ├─ Selling to enterprises? → SOC2 Type II (required) │ ├─ International customers? → ISO27001 (strongly recommended) │ ├─ Handling health data? → HIPAA + HITRUST │ └─ Handling payment cards? → PCI-DSS ├─ Healthcare Provider/Payer │ ├─ U.S.-based → HIPAA (required) │ ├─ International → HIPAA + GDPR │ └─ Plus: HITRUST for comprehensive framework ├─ Financial Services │ ├─ U.S. banks → GLBA, SOX (if public) │ ├─ Payment processing → PCI-DSS (required) │ ├─ International → ISO27001, local regulations │ └─ Plus: NIST CSF for framework ├─ E-commerce/Retail │ ├─ Accept credit cards → PCI-DSS (required) │ ├─ EU customers → GDPR (required) │ ├─ California customers → CCPA │ └─ B2B sales → SOC2 Type II └─ General Enterprise ├─ Selling to enterprises → SOC2 Type II ├─ Want broad recognition → ISO27001 ├─ Government contracts → FedRAMP, NIST 800-53 └─ Industry-specific → Check sector regulations Multi-Framework Strategy: - Start with: SOC2 or ISO27001 (choose one as foundation) - Add: Data privacy regulations (GDPR, CCPA) as needed - Layer on: Industry-specific requirements ``` ### 4. Incident Severity Classification **When to use**: Triaging and responding to security incidents **Severity Levels**: ``` P0 - Critical (Immediate Response) - Active breach with data exfiltration occurring - Ransomware encryption in progress - Complete system outage of critical services - Unauthorized access to production databases - Response: Engage CIRT immediately, executive notification, 24/7 effort P1 - High (Response within 1 hour) - Confirmed malware on critical systems - Attempted unauthorized access to sensitive data - DDoS attack affecting availability - Significant vulnerability with active exploits - Response: Engage CIRT, manager notification, work until contained P2 - Medium (Response within 4 hours) - Malware on non-critical systems - Suspicious account activity - Policy violations with security impact - Vulnerability requiring patching - Response: Security team investigation, business hours P3 - Low (Response within 24 hours) - Failed login attempts (below threshold) - Minor policy violations - Informational security events - Response: Standard queue, document findings Classification Factors: 1. Data confidentiality impact (PHI, PII, financial, IP) 2. System availability impact (revenue, operations) 3. Data integrity impact (corruption, unauthorized changes) 4. Number of affected systems/users 5. Regulatory reporting requirements ``` ### 5. Vulnerability Prioritization **When to use**: Prioritizing vulnerability remediation **Framework**: Enhanced CVSS with business context ``` Base CVSS Score × Business Context Multiplier = Priority Score CVSS Severity Ranges: - Critical: 9.0-10.0 - High: 7.0-8.9 - Medium: 4.0-6.9 - Low: 0.1-3.9 Business Context Multipliers: - Internet-facing production system: 2.0× - Internal production system: 1.5× - Systems with sensitive data: 1.5× - Development/test environment: 0.5× - Active exploit in the wild: 2.0× - Compensating controls in place: 0.7× Priority Levels: - P0 (Critical): Score ≥ 14 → Patch within 24-48 hours - P1 (High): Score 10-13.9 → Patch within 7 days - P2 (Medium): Score 6-9.9 → Patch within 30 days - P3 (Low): Score < 6 → Patch within 90 days or accept risk Additional Considerations: - Can the system be isolated/segmented? - Are there effective detective controls? - What is the patching complexity/risk? - Is there a vendor patch available? ``` ### 6. Third-Party Risk Assessment **When to use**: Evaluating security risks of vendors and partners **Assessment Framework**: ``` 1. Categorize Vendor Risk Level Low Risk (Minimal assessment): - No access to systems or data - Limited integration - Non-critical service → Simple questionnaire Medium Risk (Standard assessment): - Limited system access - Non-sensitive data access - Important but not critical service → Security questionnaire + evidence review High Risk (Comprehensive assessment): - Production system access - Sensitive data processing - Critical service dependency → Full assessment + audit reports + pen test Critical Risk (Extensive assessment): - Full production access - PHI/PII processing - Business-critical dependency → On-site audit + continuous monitoring + SLA 2. Assessment Components For Medium/High/Critical vendors: □ Security questionnaire (SIG, CAIQ, or custom) □ Compliance certifications (SOC2, ISO27001) □ Insurance certificates (cyber liability) □ Security policies and procedures □ Incident response plan □ Disaster recovery/business continuity plan □ Data processing agreement (DPA) □ Penetration test results (for high/critical) □ Right to audit clause in contract 3. Ongoing Monitoring - Annual reassessment - Monitor for breaches/incidents - Review security updates and patches - Track compliance certification renewals - Conduct periodic audits (for critical vendors) 4. Vendor Risk Score Calculate score (0-100): - Security maturity: 40 points - Compliance certifications: 20 points - Incident history: 15 points - Financial stability: 15 points - References and reputation: 10 points Action based on score: - 80-100: Approved - 60-79: Approved with conditions - 40-59: Requires remediation plan - < 40: Do not engage ``` --- ## Key Security Frameworks & Standards ### NIST Cybersecurity Framework (CSF) - **Purpose**: Risk-based framework for improving cybersecurity - **Structure**: 5 Functions, 23 Categories, 108 Subcategories - **Best for**: General organizations, government contractors - **Maturity model**: Tier 1 (Partial) to Tier 4 (Adaptive) ### CIS Critical Security Controls - **Purpose**: Prioritized set of actions for cyber defense - **Structure**: 18 Controls with Implementation Groups (IG1, IG2, IG3) - **Best for**: Practical implementation guidance - **Focus**: Defense against common attack patterns ### ISO/IEC 27001 - **Purpose**: International standard for information security management - **Structure**: 14 domains, 114 controls (Annex A) - **Best for**: International recognition, formal certification - **Requirements**: ISMS (Information Security Management System) ### SOC 2 Type II - **Purpose**: Service organization controls for security and availability - **Structure**: Trust Service Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) - **Best for**: SaaS companies, cloud service providers - **Audit**: 3-12 month observation period ### NIST 800-53 - **Purpose**: Security controls for federal systems - **Structure**: 20 families, 1000+ controls - **Best for**: Government contractors, FedRAMP - **Baselines**: Low, Moderate, High impact systems ### GDPR (General Data Protection Regulation) - **Purpose**: EU data privacy regulation - **Scope**: Any organization processing EU residents' data - **Requirements**: Lawful basis, consent, data subject rights, breach notification - **Penalties**: Up to 4% of global revenue or €20M ### HIPAA (Health Insurance Portability and Accountability Act) - **Purpose**: Protect health information (PHI) - **Scope**: Healthcare providers, payers, business associates - **Requirements**: Administrative, Physical, Technical safeguards - **Penalties**: $100-$50,000 per violation, criminal charges possible ### PCI-DSS (Payment Card Industry Data Security Standard) - **Purpose**: Protect cardholder data - **Structure**: 12 requirements, 6 control objectives - **Scope**: Any organization storing, processing, or transmitting card data - **Levels**: Based on transaction volume (Level 1-4) --- ## Core Security Domains ### 1. Identity & Access Management (IAM) - Authentication mechanisms (MFA, SSO, passwordless) - Authorization models (RBAC, ABAC, ReBAC) - Privileged access management (PAM) - Identity governance and administration (IGA) - Directory services (Active Directory, LDAP, Okta, Auth0) ### 2. Network Security - Network segmentation and micro-segmentation - Firewalls (next-gen, WAF, application-layer) - Intrusion detection/prevention (IDS/IPS) - VPN and secure remote access - Zero Trust network architecture (ZTNA) - DDoS protection ### 3. Data Security - Encryption at rest and in transit (AES-256, TLS 1.3) - Key management (KMS, HSM) - Data classification and labeling - Data loss prevention (DLP) - Database security (encryption, masking, tokenization) - Secrets management (Vault, AWS Secrets Manager) ### 4. Application Security - Secure SDLC and DevSecOps - SAST (Static Application Security Testing) - DAST (Dynamic Application Security Testing) - SCA (Software Composition Analysis) - Secure code review - OWASP Top 10 mitigation ### 5. Cloud Security - Cloud security posture management (CSPM) - Cloud access security broker (CASB) - Container security (image scanning, runtime protection) - Serverless security - Infrastructure as Code (IaC) security scanning - Multi-cloud security architecture ### 6. Endpoint Security - Endpoint detection and response (EDR) - Antivirus and anti-malware - Host-based firewalls - Device encryption (BitLocker, FileVault) - Mobile device management (MDM) - Patch management ### 7. Security Operations - Security Information and Event Management (SIEM) - Security Orchestration, Automation, and Response (SOAR) - Threat intelligence platforms (TIP) - Threat hunting - Vulnerability management - Penetration testing and red teaming ### 8. Incident Response - Incident response plan and playbooks - Computer forensics and investigation - Malware analysis - Threat containment and eradication - Post-incident review and lessons learned - Regulatory breach notification ### 9. Governance, Risk & Compliance (GRC) - Security policies and procedures - Risk assessment and management - Compliance management and auditing - Security awareness training - Vendor risk management - Business continuity and disaster recovery --- ## Security Metrics & KPIs ### Risk & Compliance Metrics - Number of critical/high risks open - Risk remediation time (mean time to remediate) - Compliance audit findings (open/closed) - Compliance control effectiveness rate - Policy acknowledgment completion rate - Training completion rate ### Vulnerability Management Metrics - Mean time to detect (MTTD) vulnerabilities - Mean time to patch (MTTP) - Vulnerability backlog (total open, by severity) - Patch compliance rate (% systems patched within SLA) - Vulnerability recurrence rate ### Incident Response Metrics - Mean time to detect (MTTD) incidents - Mean time to respond (MTTR) - Mean time to contain (MTTC) - Mean time to recover (MTTR) - Number of incidents by severity - Incident recurrence rate - False positive rate ### Security Operations Metrics - SIEM alert volume (total, by severity) - Alert triage time - Alert false positive rate - Security tool coverage (% assets monitored) - Threat hunting coverage (% environment reviewed) - Penetration test findings ### Access Management Metrics - MFA adoption rate - Privileged account review completion rate - Access certification completion rate - Orphaned account count - Password policy compliance rate - Failed login attempt rate ### Awareness & Culture Metrics - Phishing simulation click rate - Security training completion rate - Security awareness quiz scores - Security policy violations - Security-related helpdesk tickets --- ## Security Tools Ecosystem ### SIEM (Security Information & Event Management) - Splunk Enterprise Security - IBM QRadar - Microsoft Sentinel - Elastic Security - Sumo Logic ### EDR/