security-mcp 1.1.4 → 1.3.1

package/skills/zero-trust-architect/SKILL.md

@@ -209,3 +209,112 @@ Trust model: VPC membership = trusted; external = untrusted
 - `requiredActions`: phased ZTA adoption steps
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true — ZTA is beyond standard policy coverage
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Service with IP-based trust and no mTLS — pivot directly from any pod in the VPC", "exploitHint": "kubectl exec into low-privilege pod; curl internal service without cert — if 200, IP trust confirmed exploitable" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "mTLS certificate authority", "location": "Check CA key strength, rotation schedule, and whether self-signed CAs are in use for internal mTLS" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "Any service with IMDS access and no mTLS — SSRF can retrieve instance credentials", "escalationPath": "SSRF to IMDS v1 (no token required) to IAM role credentials to lateral movement across VPC trust boundary" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["PCI DSS Req 1.3", "SOC 2 CC6.6", "NIST 800-207"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **OIDC Workload Identity Federation Audience Confusion (ATT&CK T1552.001 / Real-World: 2023 CircleCI breach):** An attacker who compromises a CI/CD OIDC token can replay it against any cloud workload identity binding that lacks a strict `sub` or `aud` claim condition. In the CircleCI incident, stolen environment secrets (equivalent to unconstrained OIDC tokens) allowed lateral movement into customer AWS accounts. Test by: forge a JWT with a valid `iss` but mismatched `sub` claim and POST it to the token exchange endpoint (`sts.amazonaws.com` / `iam.googleapis.com`) — if it returns credentials, the binding is misconfigured. Finding threshold: any workload identity binding without an exact `sub` match condition or accepting wildcard audience is a CRITICAL finding.
+
+- **eBPF Sidecar Bypass for mTLS Interception (CVE-2023-2728 / ATT&CK T1040):** A container with `CAP_BPF` or `CAP_NET_ADMIN` can attach an eBPF program to a cgroup socket that intercepts plaintext traffic before the Istio/Envoy sidecar encrypts it, silently breaking the mTLS guarantee without any `PeerAuthentication` policy change. CVE-2023-2728 demonstrated privilege escalation via Kubernetes admission bypass enabling unsafe capabilities. Test by: run `kubectl exec` into a pod and attempt `bpftool prog load` — if successful without privileged SCC/PSA, the cluster allows eBPF-based interception. Finding threshold: any pod with `CAP_BPF`, `CAP_NET_ADMIN`, or `privileged: true` in a namespace with mTLS-protected workloads is a HIGH finding.
+
+- **AI-Assisted Lateral Movement via Mesh Trust Graph Enumeration (ATT&CK T1046 / Research: "Graph-of-Thought" LLM pivot chains, 2024):** An attacker with a single compromised pod can use an LLM (GPT-4o, local Llama) to automatically enumerate all reachable services via DNS resolution, parse Kubernetes RBAC and AuthorizationPolicies from the API server (if `system:discovery` is granted), and generate a ranked list of lateral movement paths in under 60 seconds — faster than any SOC analyst can triage. This was demonstrated in academic research on LLM-assisted network reconnaissance in 2024. Test by: from a low-privilege pod, run `kubectl get authorizationpolicies -A` and `curl -k https://kubernetes.default.svc/api/v1/services` — if either succeeds without explicit binding, automated enumeration is possible. Finding threshold: any unauthenticated or over-permissive API server discovery response in a ZTA-claimed environment is a CRITICAL control failure.
+
+- **Post-Quantum Harvest-Now-Decrypt-Later Against mTLS Session Keys (NIST FIPS 203 / ATT&CK T1040):** Nation-state adversaries are actively capturing encrypted east-west traffic (Shodan-scale passive capture) with the intent to decrypt it once cryptographically relevant quantum computers (CRQCs) are available (~2028–2032). Current mTLS using ECDHE-P256 or X25519 provides no forward secrecy against a CRQC. NIST finalized ML-KEM (Kyber) as FIPS 203 in 2024 — service meshes must begin hybrid TLS migration now. Test by: `openssl s_client -connect <service>:<port>` and inspect the `Server Temp Key` line — if it shows `ECDH, P-256` or `X25519` without a PQ hybrid, the session is harvest-vulnerable. Finding threshold: any mTLS endpoint not offering a `X25519MLKEM768` or equivalent PQ hybrid cipher suite is a MEDIUM finding today, escalating to CRITICAL after 2027.
+
+- **Continuous Validation Token Replay Within Revocation Cache TTL (CWE-613 / ATT&CK T1550.001):** Even with per-request JWT validation, if the token revocation cache has a TTL of 30–300 seconds (common Redis defaults), a stolen token remains valid for the full TTL window. An attacker who exfiltrates a token via XSS or a compromised log sink has a guaranteed replay window. The `jti` (JWT ID) claim is the only reliable per-token uniqueness marker, but most implementations check only expiry. Test by: authenticate to obtain a valid JWT, call `POST /auth/logout` (or equivalent revocation), then immediately replay the same token to a protected endpoint — if it returns 200, the revocation cache is not consulted on every request. Finding threshold: any successful authenticated request using a token after explicit revocation is a HIGH finding; TTL > 60 seconds on the revocation cache is a MEDIUM finding.
+
+- **EU Cyber Resilience Act (CRA) Mandatory Attestation Gap for Service Mesh Components (Regulatory Deadline: 2027 / Supply Chain Risk):** The EU CRA (effective 2024, enforcement 2027) requires software attestation and SBOM for any "product with digital elements" — this explicitly includes service mesh control-plane and data-plane components (Istio, Envoy, Linkerd) when deployed in products sold to EU customers. Organizations without a CycloneDX or SPDX SBOM for their mesh components, and without SLSA Level 2 provenance for internal service images traversing the mesh, face regulatory non-compliance and potential market exclusion. Test by: run `syft image istio/pilot:<version> -o cyclonedx-json` and `cosign verify <image>` against the mesh control-plane image — if either fails or returns no provenance attestation, the component is CRA non-compliant. Finding threshold: any mesh component without a verifiable SBOM and SLSA L2+ attestation in a product targeting EU markets is a HIGH compliance finding with a hard 2027 deadline.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 Zero Trust attack cases that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | mTLS bypass via permissive `PERMISSIVE` mode left on one namespace | Scanners check that Istio is installed; they do not enumerate PeerAuthentication mode per namespace | `kubectl get peerauthentication -A -o json \| jq '.items[] \| select(.spec.mtls.mode != "STRICT")'` — any non-STRICT namespace is an open east-west pivot |
+| 2 | JWT `alg:none` accepted by internal service that trusts sidecar validation | Services may skip JWT verification assuming the sidecar already verified it; attacker forges token with `alg:none` and bypasses sidecar by calling the pod port directly | Port-forward directly to the container port (bypassing Istio sidecar) and send a token with `"alg":"none","typ":"JWT"` — check if the service accepts it |
+| 3 | Workload Identity federation misconfiguration allows cross-project impersonation | IAM binding `roles/iam.workloadIdentityUser` set on `allUsers` or a wildcard service account audience | `gcloud iam service-accounts get-iam-policy SA_EMAIL` — look for `allUsers` or overly broad `principalSet` in the binding condition |
+| 4 | Kubernetes NetworkPolicy allows `0.0.0.0/0` egress — microsegmentation is illusory | NetworkPolicy `ingress` rules are reviewed; `egress` rules that permit all outbound are ignored | `kubectl get networkpolicy -A -o json \| jq '.items[] \| select(.spec.egress[]?.to == null)'` — null egress selector = allow all |
+| 5 | Continuous validation middleware skipped for webhook/internal callback endpoints | Middleware chains are written for user-facing routes; internal webhook receivers and health-check endpoints are registered before the auth middleware | Enumerate all routes registered before the auth middleware chain; send unauthenticated POST to each `/webhook`, `/callback`, `/internal/*` path |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that ZTA defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to Zero Trust | Prepare Now By |
+|--------|--------------|-------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) breaks mTLS certificate chains | 2028–2032 | All TLS 1.3 session keys negotiated with ECDHE are retroactively breakable via harvest-now-decrypt-later; PKI underpinning mTLS is compromised | Inventory all internal CA and mTLS certificate algorithms; plan migration to ML-KEM (FIPS 203) hybrid TLS; begin testing TLS agility in service mesh |
+| AI-assisted lateral movement: LLM-generated pivot chains from minimal foothold | 2025–2027 (active) | Attacker with a single compromised pod can use AI to auto-enumerate misconfigured trust paths across the mesh in minutes | Assume an attacker inside the mesh has full AI-assisted enumeration; audit every AuthorizationPolicy for least-privilege completeness, not just the obvious paths |
+| Workload identity federation attacks on cloud-native CI/CD | 2025–2026 (active) | OIDC-based workload identity is the new target: compromise the OIDC issuer or misconfigure audience binding to escalate from CI runner to prod IAM role | Enforce strict `sub` and `aud` claim conditions on every workload identity binding; rotate trusted OIDC issuers list quarterly |
+| EU CRA mandatory device attestation requirements | 2026–2027 | Connected devices accessing enterprise resources must provide hardware attestation; soft device posture checks will no longer satisfy regulatory compliance | Migrate device trust from agent-reported posture to hardware-backed attestation (TPM 2.0 / Apple Secure Enclave) before CRA enforcement |
+| eBPF-based kernel exploits bypassing sidecar-based mTLS | 2026–2028 | eBPF programs with `CAP_BPF` can intercept traffic before it reaches the Istio sidecar, rendering mTLS inspection moot | Restrict `CAP_BPF` via Kubernetes admission; deploy Falco eBPF rules to detect unauthorized BPF program loads; evaluate kernel-level mTLS (WireGuard CNI) as defence-in-depth |
+| Mandatory SBOM + SLSA for service mesh components (US EO 14028 / EU CRA) | 2025–2026 (active) | Istio, Envoy, and Linkerd are in-scope for SBOM requirements; unattested mesh components in the data path are a supply-chain risk | Generate CycloneDX SBOM for all mesh control-plane and data-plane components; achieve SLSA L2 minimum for internal service images traversing the mesh |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in a Zero Trust architecture, and what to build to close each gap.
+
+**ZTA-specific gaps that MUST be checked:**
+
+- **mTLS certificate impersonation via stolen workload cert**: If a pod's private key is exfiltrated (e.g., through a container escape), the attacker can impersonate that workload identity indefinitely until cert rotation. Standard logs show valid mutual authentication — no alert fires. Need: cert lifetime monitoring (alert on any cert with TTL > 24h for workload identities); detect private key material appearing outside the expected pod filesystem path via Falco rule `(fd.name startswith "/proc/" and fd.name contains "ssl/private")`.
+- **Sidecar bypass via direct pod-to-pod IP call**: A compromised pod calling another pod's IP directly on the container port (not the mesh port) bypasses Istio entirely — the PeerAuthentication policy is never evaluated. Need: Falco or eBPF network rule alerting on any TCP connection to a pod port that does not originate from `127.0.0.1` (the sidecar) or the CNI bridge.
+- **Token replay within the continuous validation window**: A stolen JWT is valid until the next revocation check cycle. If the revocation cache TTL is 60 seconds, an attacker has a 60-second replay window per stolen token. Need: per-`jti` usage frequency monitoring — flag any `jti` value seen more than once per second across different source IPs.
+- **Gradual privilege creep through AuthorizationPolicy drift**: Individual AuthorizationPolicy changes are individually reviewed and approved, but over months the cumulative effect is a service that can call every other service in the mesh. Standard SIEM looks at individual changes, not cumulative access graphs. Need: weekly AuthorizationPolicy graph diff — compare current effective access graph to the baseline and alert on any new service-to-service path added since last week.
+- **Cross-agent ZTA attack chains invisible to individual scanners**: An IP-based trust finding from network scan + a long-lived credential finding from IAM scan = a CRITICAL lateral movement chain (pivot to trusted IP, then use long-lived credential for persistence). Neither scanner flags the chain. Need: CISO orchestrator Phase 1 synthesis — correlate all ZTA findings across agents before Phase 2 to surface compound chains.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any ZTA attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+**Mandatory ZTA attack classes — all must be covered:**
+
+| Attack Class | Patterns to Search | Files to Check |
+|---|---|---|
+| IP-based implicit trust | `req.ip`, `startsWith("10.")`, `trusted.*subnet`, `internal.*network` | All API middleware, gateway config |
+| Missing mTLS enforcement | `PeerAuthentication`, `mtls.mode`, `PERMISSIVE` | All `k8s/**/*.yaml`, Istio config |
+| Long-lived service credentials | `serviceAccountKey`, `credentials.json`, `GOOGLE_APPLICATION_CREDENTIALS` pointing to file | Dockerfile, CI config, env files |
+| Missing NetworkPolicy egress restriction | `egress: []`, null egress selector | All NetworkPolicy manifests |
+| JWT `alg:none` or weak algorithm acceptance | `alg.*none`, `algorithms.*["none"]`, `verify.*false` | All JWT validation code |
+| Continuous validation bypass | route registration before auth middleware, `/webhook`, `/internal`, `/callback` without auth | All router/server entrypoints |
+| Workload Identity audience misconfiguration | `allUsers`, wildcard `principalSet` in IAM bindings | All Terraform IAM, GCP IAM policy files |
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "IP-Based Implicit Trust", "filesReviewed": 23, "patterns": ["req.ip", "startsWith(\"10.\")", "trusted.*subnet"], "result": "CLEAN" },
+      { "class": "Missing mTLS Enforcement", "filesReviewed": 14, "patterns": ["PeerAuthentication", "mtls.mode", "PERMISSIVE"], "result": "2 findings, both fixed" }
+    ],
+    "filesReviewed": 47,
+    "negativeAssertions": ["IP-Based Implicit Trust: pattern searched across 23 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```