sota-network-securitylisted
State-of-the-art network security as a discipline (2026) for BOTH designing/building secure networks AND auditing segmentation and exposure. Use for zero-trust architecture, network segmentation and blast-radius control, Kubernetes NetworkPolicy/CiliumNetworkPolicy depth, service mesh and mTLS, edge/ingress/egress security (WAF, egress allowlisting, metadata-endpoint blocking), DNS/TLS/PKI transport and certificate lifecycle, and remote access (WireGuard, ZTNA, bastion vs identity-aware proxy). Triggers — network security, zero trust, ZTNA, microsegmentation, east-west traffic, lateral movement, NetworkPolicy, default-deny, Cilium, Hubble, service mesh, mTLS, Istio, Linkerd, SPIFFE, ingress, egress, WAF, CRS, Coraza, egress gateway, FQDN allowlist, IMDS, 169.254.169.254, DNS firewall, DNSSEC, DoH, TLS 1.3, ACME, step-ca, private CA, WireGuard, bastion, identity-aware proxy, DDoS, segmentation audit. Owns SECURITY posture on top of cloud network setup (sota-cloud-infrastructure owns VPC/subnet/DNS setup).
martinholovsky/SOTA-skills · ★ 8 · AI & Automation · score 75
Install: claude install-skill martinholovsky/SOTA-skills
# SOTA Network Security
## Purpose
This skill encodes the 2026 state of the art for **network security as a discipline**: how to
verify rather than trust, contain blast radius, encrypt traffic in motion, control what enters and
leaves, and secure the naming and transport plumbing (DNS, TLS, PKI). Every rule exists to prevent a
real failure class — lateral movement after one foothold, plaintext credentials on the wire, an
over-broad rule that exposes a secrets store to the world, a renewal nobody automated, or an SSRF
that reaches the cloud metadata endpoint.
**Ownership — reference siblings, do not duplicate:**
- **sota-cloud-infrastructure** (rules/03 networking) owns cloud-provider network *setup*: VPC/subnet
layout, CIDR/IPAM, route tables, LB/CDN provisioning, registrar hygiene, DNS zone setup. **This
skill owns the security posture layered on top** and the on-prem / Kubernetes / mesh side.
- **sota-kubernetes** owns admission control and RBAC — *where NetworkPolicy is admitted and CNI
enforcement is wired*; this skill owns the policy *content and depth*.
- **sota-identity-access** owns SPIFFE/SPIRE workload identity issuance, ZTNA user identity, and the
identity-aware proxy's auth plane; this skill consumes those identities for network authorization.
- **sota-detection-engineering** owns network IDS (Suricata), DNS-exfil detection, and flow-log
detection content; this skill produces the telemetry (Hubble flows, flow logs) it consumes.
- **sota-sandboxing** (