Use this skill when you need cloud security architecture (AWS/Azure/GCP), on-premises security hardening, IAM strategy (RBAC, ABAC, PAM), network security design, data center security, encryption implementation, database security, SSL/TLS certificate management, or infrastructure security posture assessment. Trigger for infrastructure deployments, cloud migrations, network redesigns, or identity governance programs.
npx claudepluginhub aviskaar/open-org --plugin infrastructure-security# Infrastructure Security — VP Infrastructure Security ## Role VP Infrastructure Security owns the end-to-end security of all technology infrastructure: cloud environments, on-premises data centers, network architecture, identity and access management, data protection, and encryption. This skill applies Zero Trust principles across every layer of the infrastructure stack. --- ## Phase 1 — Infrastructure Security Architecture ### Zero Trust Architecture (ZTA) Principles **ZTA implementation pillars:** | Pillar | Controls | |---|---| | Identity | MFA, conditional access, identity gov...
/SKILLGuides implementation of defense-in-depth security architectures, compliance (SOC2, ISO27001, GDPR, HIPAA), threat modeling, risk assessments, SecOps, incident response, and SDLC security integration.
/SKILLEvaluates LLMs on 60+ benchmarks (MMLU, HumanEval, GSM8K) using lm-eval harness. Provides CLI commands for HuggingFace/vLLM models, task lists, and evaluation checklists.
/SKILLApplies systematic debugging strategies to track down bugs, performance issues, and unexpected behavior using checklists, scientific method, and testing techniques.
/SKILLSummarizes content from URLs, local files, podcasts, and YouTube videos. Extracts transcripts with --extract-only flag. Supports AI models, lengths, and JSON output.
/SKILLRuns `yarn extract-errors` on React project to detect new error messages needing codes, reports them, and verifies existing codes are up to date.
/SKILLManages major dependency upgrades via compatibility analysis, staged rollouts with npm/yarn, and testing for frameworks like React.
VP Infrastructure Security owns the end-to-end security of all technology infrastructure: cloud environments, on-premises data centers, network architecture, identity and access management, data protection, and encryption. This skill applies Zero Trust principles across every layer of the infrastructure stack.
Never Trust. Always Verify. Assume Breach.
1. Verify explicitly — authenticate and authorize every request
2. Least privilege access — just-in-time, just-enough access
3. Assume breach — minimize blast radius, encrypt all, log all
ZTA implementation pillars:
| Pillar | Controls |
|---|---|
| Identity | MFA, conditional access, identity governance |
| Device | EDR, device compliance, managed endpoints |
| Network | Micro-segmentation, ZTNA, SD-WAN |
| Application | WAF, API gateway, SAST/DAST |
| Data | Classification, DLP, encryption, RMS |
| Infrastructure | Hardened configs, IaC security scanning |
| Visibility | SIEM, UEBA, full packet capture |
Delegate detailed implementation to network-data-security and iam-specialist.
| Control | AWS | Azure | GCP |
|---|---|---|---|
| Root/Global Admin | Locked, MFA, no daily use | Emergency access only | Org admin MFA enforced |
| IAM | Roles only, no long-term keys | Managed Identities | Service Accounts, Workload Identity |
| Network | VPC with private subnets | VNet, Private Endpoints | VPC, Private Service Connect |
| Logging | CloudTrail all regions | Azure Monitor, Activity Log | Cloud Audit Logs |
| Encryption | KMS-managed CMKs | Azure Key Vault | Cloud KMS |
| Secrets | AWS Secrets Manager | Azure Key Vault | Secret Manager |
| Container | ECS/EKS with IRSA | AKS with managed identity | GKE with Workload Identity |
OS Hardening:
- CIS Benchmark Level 1 applied to all servers
- Remove all unnecessary services and packages
- Disable root login; use sudo with MFA
- Password policy: min 14 chars, complexity, no reuse (last 12)
- Automatic security patches: critical <24h, high <72h, medium <30 days
- Host-based firewall: deny all inbound, whitelist required ports
- File integrity monitoring: AIDE/Tripwire on critical paths
iam-specialist)| Model | Use Case | Implementation |
|---|---|---|
| RBAC (Role-Based) | Standard user access | Job function roles, group-based assignment |
| ABAC (Attribute-Based) | Dynamic, context-aware access | Policy engine (OPA, Cedar), attribute tags |
| RBA (Risk-Based Access) | Adaptive authentication | Risk scoring engine, step-up auth triggers |
| PBAC (Policy-Based) | Fine-grained API/data access | OPA, XACML, Cedar policies |
IAM governance requirements:
Minimum standard: AES-256-GCM
Key management: HSM-backed KMS (FIPS 140-2 Level 3 minimum)
Key rotation: Annual minimum; automated where supported
Scope: All databases, object storage, file systems, backups, laptops
Database: TDE (Transparent Data Encryption) enabled by default
Laptops: Full-disk encryption (BitLocker/FileVault) + key escrow
Backups: Encrypted with separate key from primary data
Minimum: TLS 1.2; TLS 1.3 preferred; SSLv3/TLS 1.0/1.1 disabled everywhere
Certificates: Public CA for external; internal PKI for internal services
Certificate mgmt: Automated renewal (Let's Encrypt/ACME or enterprise CA)
mTLS: Required for all service-to-service communication in microservices
SSH: Ed25519 keys minimum; RSA 4096 acceptable; password auth disabled
PGP/S-MIME: For email encryption of sensitive communications
Secrets in transit: Never in URLs, logs, or headers — use body or vault references
Session tokens: 8h max (re-auth required after); 30 min idle timeout
API access tokens: 1h max for user-delegated; 24h for service-to-service
OAuth access tokens: 15 min (short-lived); refresh tokens: 7 days, single-use
JWT TTL: 15 min; never >1h without explicit CISO exception
Password reset tokens: 15 min, single-use
MFA OTP codes: 30 seconds (TOTP); 5-minute window max
Temp credentials (cloud): 1h max; 15 min for high-risk operations
Certificate validity: 1 year max (TLS); 3 years max (internal CA)
Delegate detailed implementation to network-data-security.
Zone Architecture:
├── Internet DMZ (public-facing, heavily monitored)
├── Application Zone (web servers, APIs, load balancers)
├── Data Zone (databases, data warehouses, message queues)
├── Management Zone (monitoring, logging, PAM, secrets vault)
├── Development Zone (isolated from production; no cross-contamination)
└── OT/IoT Zone (air-gapped or heavily segmented)
Enforce across all database platforms (SQL, NoSQL, NewSQL, Data Lakes):
Access Controls:
- Application service accounts: read-only or scoped write; never DBA privileges
- DBA access: PAM-vaulted, session recorded, JIT only
- No shared database credentials between applications
- Row-level security (RLS) for multi-tenant data isolation
Encryption:
- TDE enabled on all databases
- Column-level encryption for PII/PHI fields (SSN, DOB, payment data)
- Encrypted backups with key separation from primary
Auditing:
- Database activity monitoring (DAM): log all DML/DDL on sensitive tables
- Failed login attempts: alert after 5 consecutive failures
- Privileged query logging: all SELECT on sensitive tables logged with user + timestamp
- Data export logging: bulk exports require approval and are logged
Patching:
- Critical CVEs: patch within 72h or implement compensating control
- High CVEs: patch within 30 days
- Version management: no EOL database versions in production