[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFT29ES3J8GEWRQZPBHDHJ":3,"skill-same:01M6AFT29ES3J8GEWRQZPBHDHJ":125},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":76,"commitSha":77,"skillDirectory":78,"forksCount":79,"repositoryHtmlUrl":80,"repositoryHomepageUrl":81,"ownerHtmlUrl":82,"ownerBlogUrl":83,"ownerDescription":84,"updatedAt":85,"install":86,"resources":99},"01M6AFT29ES3J8GEWRQZPBHDHJ","performing-gcp-security-assessment-with-forseti",null,"Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security Command Center, and gcloud CLI to audit IAM policies, firewall rules, storage permissions, and compliance against CIS GCP Foundations Benchmark.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-gcp-security-assessment-with-forseti\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"performing gcp security assessment with forseti","security","gcp","assessment","benchmark","forseti","t1078","firewall","iam","cloud-security","audit","permissions","google","pr","storage","security command center","cybersecurity","google cloud","gcloud","cli","2026-11-10 10:12:30",false,"---\nname: performing-gcp-security-assessment-with-forseti\ndescription: 'Performing comprehensive security assessments of Google Cloud Platform\n  environments using Forseti Security, Security Command Center, and gcloud CLI to\n  audit IAM policies, firewall rules, storage permissions, and compliance against\n  CIS GCP Foundations Benchmark.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- gcp\n- forseti\n- security-command-center\n- iam-audit\n- cis-benchmark\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.7\n- MAP-5.1\n- MANAGE-2.4\n- GOVERN-1.1\n- GOVERN-4.2\natlas_techniques:\n- AML.T0070\n- AML.T0066\n- AML.T0082\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n---\n\n# Performing GCP Security Assessment with Forseti\n\n## When to Use\n\n- When conducting periodic security assessments of GCP organizations and projects\n- When onboarding new GCP projects and establishing security baselines\n- When compliance mandates CIS GCP Foundations Benchmark evaluation\n- When auditing IAM bindings, firewall rules, and storage ACLs across multiple GCP projects\n- When building continuous security monitoring for GCP infrastructure\n\n**Do not use** as a replacement for GCP Security Command Center Premium for real-time threat detection, for application-level vulnerability scanning (use Web Security Scanner), or for GKE-specific security (use GKE Security Posture).\n\n## Prerequisites\n\n- GCP Organization with Organization Admin or Security Admin IAM role\n- gcloud CLI authenticated with sufficient permissions (`roles\u002Fsecuritycenter.admin`, `roles\u002Fiam.securityReviewer`)\n- Security Command Center (SCC) enabled at the organization level\n- ScoutSuite installed for multi-cloud comparison (`pip install scoutsuite`)\n- Python 3.8+ for custom audit scripts using google-cloud-asset and google-cloud-securitycenter libraries\n\n## Workflow\n\n### Step 1: Enable Security Command Center and Asset Inventory\n\nEnable SCC and set up Cloud Asset Inventory for comprehensive resource visibility.\n\n```bash\n# Enable Security Command Center API\ngcloud services enable securitycenter.googleapis.com \\\n  --project=PROJECT_ID\n\n# Enable Cloud Asset API\ngcloud services enable cloudasset.googleapis.com \\\n  --project=PROJECT_ID\n\n# List all assets in the organization\ngcloud asset search-all-resources \\\n  --scope=organizations\u002FORG_ID \\\n  --asset-types=\"compute.googleapis.com\u002FInstance,storage.googleapis.com\u002FBucket,iam.googleapis.com\u002FServiceAccount\" \\\n  --format=\"table(name, assetType, location, project)\"\n\n# Export asset inventory to BigQuery for analysis\ngcloud asset export \\\n  --organization=ORG_ID \\\n  --output-bigquery-force \\\n  --output-bigquery-dataset=projects\u002FPROJECT_ID\u002Fdatasets\u002Fasset_inventory \\\n  --output-bigquery-table=resources \\\n  --content-type=resource\n```\n\n### Step 2: Audit IAM Policies and Bindings\n\nReview IAM policies across the organization for overly permissive bindings, primitive roles, and service account misuse.\n\n```bash\n# List all IAM policy bindings at org level\ngcloud organizations get-iam-policy ORG_ID \\\n  --format=json > org-iam-policy.json\n\n# Find all users with Owner or Editor roles across projects\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:roles\u002Fowner OR policy:roles\u002Feditor\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n\n# Identify service accounts with admin roles\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy.bindings.members:serviceAccount AND policy:roles\u002Fowner\" \\\n  --format=json\n\n# Check for allUsers or allAuthenticatedUsers bindings (public access)\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:allUsers OR policy:allAuthenticatedUsers\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n\n# List service account keys older than 90 days\ngcloud iam service-accounts keys list \\\n  --iam-account=SA_EMAIL \\\n  --managed-by=user \\\n  --format=\"table(name,validAfterTime,validBeforeTime)\"\n```\n\n### Step 3: Assess Firewall Rules and Network Configuration\n\nAudit VPC firewall rules for overly permissive ingress rules, missing logging, and network exposure.\n\n```bash\n# List all firewall rules allowing ingress from 0.0.0.0\u002F0\ngcloud compute firewall-rules list \\\n  --filter=\"direction=INGRESS AND sourceRanges=0.0.0.0\u002F0\" \\\n  --format=\"table(name, network, allowed, sourceRanges, targetTags)\"\n\n# Find firewall rules allowing all protocols\u002Fports\ngcloud compute firewall-rules list \\\n  --filter=\"direction=INGRESS AND allowed[].IPProtocol=all\" \\\n  --format=\"table(name, network, sourceRanges, targetTags)\"\n\n# Check for SSH (22) and RDP (3389) open to internet\ngcloud compute firewall-rules list \\\n  --filter=\"direction=INGRESS AND sourceRanges=0.0.0.0\u002F0 AND (allowed[].ports=22 OR allowed[].ports=3389)\" \\\n  --format=\"table(name, network, allowed, sourceRanges)\"\n\n# Audit VPC flow log configuration\ngcloud compute networks subnets list \\\n  --format=\"table(name, region, enableFlowLogs, logConfig.aggregationInterval)\"\n```\n\n### Step 4: Audit Cloud Storage Bucket Permissions\n\nCheck for publicly accessible storage buckets and missing encryption configurations.\n\n```bash\n# List all buckets in a project\ngsutil ls -p PROJECT_ID\n\n# Check bucket IAM for public access\nfor bucket in $(gsutil ls -p PROJECT_ID); do\n  echo \"=== $bucket ===\"\n  gsutil iam get \"$bucket\" | grep -E \"allUsers|allAuthenticatedUsers\" && \\\n    echo \"  WARNING: PUBLIC ACCESS DETECTED\" || \\\n    echo \"  OK: No public access\"\ndone\n\n# Check bucket encryption configuration\nfor bucket in $(gsutil ls -p PROJECT_ID); do\n  echo \"=== $bucket ===\"\n  gsutil kms encryption \"$bucket\" 2>\u002Fdev\u002Fnull || echo \"  Using Google-managed encryption\"\ndone\n\n# Check uniform bucket-level access enforcement\nfor bucket in $(gsutil ls -p PROJECT_ID); do\n  gsutil uniformbucketlevelaccess get \"$bucket\"\ndone\n```\n\n### Step 5: Run ScoutSuite for Comprehensive Assessment\n\nExecute ScoutSuite for an automated multi-check security assessment of the GCP environment.\n\n```bash\n# Run ScoutSuite against GCP\npython3 -m ScoutSuite gcp \\\n  --user-account \\\n  --all-projects \\\n  --report-dir .\u002Fscoutsuite-gcp-report\n\n# Run with service account credentials\npython3 -m ScoutSuite gcp \\\n  --service-account \u002Fpath\u002Fto\u002Fservice-account-key.json \\\n  --all-projects \\\n  --report-dir .\u002Fscoutsuite-gcp-report\n\n# Open the HTML report\nopen .\u002Fscoutsuite-gcp-report\u002Fgcp-report.html\n```\n\n### Step 6: Query Security Command Center Findings\n\nRetrieve and analyze SCC findings for vulnerabilities, misconfigurations, and threats.\n\n```bash\n# List active SCC findings\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND severity=\\\"CRITICAL\\\"\" \\\n  --format=\"table(finding.category, finding.severity, finding.resourceName, finding.eventTime)\"\n\n# List findings by category\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND category=\\\"PUBLIC_BUCKET_ACL\\\"\" \\\n  --format=json\n\n# Get finding statistics grouped by category\ngcloud scc findings group ORG_ID \\\n  --group-by=\"category\" \\\n  --filter=\"state=\\\"ACTIVE\\\"\"\n\n# List compliance violations from SCC\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND sourceProperties.compliance_standard=\\\"CIS\\\"\" \\\n  --format=\"table(finding.category, finding.severity, finding.resourceName)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Security Command Center | GCP-native security and risk management platform that provides asset inventory, vulnerability detection, and threat monitoring |\n| Forseti Security | Open-source GCP security toolkit (now deprecated in favor of SCC) that provided inventory, scanning, enforcement, and notification capabilities |\n| Cloud Asset Inventory | GCP service that provides a complete inventory of cloud resources with metadata, IAM policies, and org policy configurations |\n| CIS GCP Foundations Benchmark | Security best practice guidelines from Center for Internet Security specific to Google Cloud Platform configuration |\n| Uniform Bucket-Level Access | GCP storage setting that disables legacy ACLs and enforces access exclusively through IAM policies for consistent access control |\n| Organization Policy | GCP constraint-based governance mechanism that restricts resource configurations across the organization hierarchy |\n\n## Tools & Systems\n\n- **Security Command Center**: GCP-native CSPM providing asset inventory, vulnerability findings, and compliance scoring\n- **ScoutSuite**: Multi-cloud security auditing tool with comprehensive GCP checks for IAM, compute, storage, and networking\n- **gcloud CLI**: Primary command-line interface for querying GCP resource configurations and security settings\n- **Cloud Asset Inventory**: API for searching and exporting resource metadata and IAM policies across GCP projects\n- **Forseti Security**: Legacy open-source GCP security toolkit, superseded by SCC but still referenced in compliance frameworks\n\n## Common Scenarios\n\n### Scenario: Assessing a Newly Acquired GCP Organization\n\n**Context**: After a company acquisition, the security team needs to assess the security posture of the acquired company's GCP organization with 30+ projects.\n\n**Approach**:\n1. Enable Cloud Asset API and export full resource inventory to BigQuery for analysis\n2. Run `gcloud asset search-all-iam-policies` to find all Owner\u002FEditor bindings and public access grants\n3. Audit firewall rules across all projects for overly permissive ingress from `0.0.0.0\u002F0`\n4. Check all storage buckets for public access using `gsutil iam get`\n5. Run ScoutSuite for a comprehensive automated assessment with HTML report\n6. Enable SCC and review all CRITICAL and HIGH findings\n7. Generate a risk-prioritized remediation roadmap for the integration team\n\n**Pitfalls**: GCP IAM bindings are inherited from organization to folder to project. A permissive binding at the organization level affects all downstream projects. Always audit IAM at every level of the hierarchy, not just at the project level.\n\n## Output Format\n\n```\nGCP Security Assessment Report\n=================================\nOrganization: acme-acquired-org (ORG_ID: 123456789)\nProjects Assessed: 34\nAssessment Date: 2026-02-23\nStandards: CIS GCP Foundations 2.0\n\nIAM FINDINGS:\n  Users with Owner role at org level:       3\n  Service accounts with Editor role:        12\n  Resources with allUsers binding:           5\n  Service account keys > 90 days:           18\n\nNETWORK FINDINGS:\n  Firewall rules allowing 0.0.0.0\u002F0:       14\n  SSH open to internet:                      7\n  RDP open to internet:                      2\n  Subnets without VPC flow logs:            22\n\nSTORAGE FINDINGS:\n  Publicly accessible buckets:               5\n  Buckets without CMEK encryption:          28\n  Buckets without uniform access:           15\n\nCRITICAL FINDINGS: 12\nHIGH FINDINGS: 34\nMEDIUM FINDINGS: 78\nLOW FINDINGS: 145\n\nTOP REMEDIATION PRIORITIES:\n  1. Remove allUsers bindings from 5 storage buckets (CRITICAL)\n  2. Restrict 0.0.0.0\u002F0 firewall rules to specific CIDRs (HIGH)\n  3. Rotate 18 service account keys older than 90 days (HIGH)\n  4. Enable VPC flow logs on 22 subnets (MEDIUM)\n```\n","# Performing GCP Security Assessment with Forseti\n\n## When to Use\n\n- When conducting periodic security assessments of GCP organizations and projects\n- When onboarding new GCP projects and establishing security baselines\n- When compliance mandates CIS GCP Foundations Benchmark evaluation\n- When auditing IAM bindings, firewall rules, and storage ACLs across multiple GCP projects\n- When building continuous security monitoring for GCP infrastructure\n\n**Do not use** as a replacement for GCP Security Command Center Premium for real-time threat detection, for application-level vulnerability scanning (use Web Security Scanner), or for GKE-specific security (use GKE Security Posture).\n\n## Prerequisites\n\n- GCP Organization with Organization Admin or Security Admin IAM role\n- gcloud CLI authenticated with sufficient permissions (`roles\u002Fsecuritycenter.admin`, `roles\u002Fiam.securityReviewer`)\n- Security Command Center (SCC) enabled at the organization level\n- ScoutSuite installed for multi-cloud comparison (`pip install scoutsuite`)\n- Python 3.8+ for custom audit scripts using google-cloud-asset and google-cloud-securitycenter libraries\n\n## Workflow\n\n### Step 1: Enable Security Command Center and Asset Inventory\n\nEnable SCC and set up Cloud Asset Inventory for comprehensive resource visibility.\n\n```bash\n# Enable Security Command Center API\ngcloud services enable securitycenter.googleapis.com \\\n  --project=PROJECT_ID\n\n# Enable Cloud Asset API\ngcloud services enable cloudasset.googleapis.com \\\n  --project=PROJECT_ID\n\n# List all assets in the organization\ngcloud asset search-all-resources \\\n  --scope=organizations\u002FORG_ID \\\n  --asset-types=\"compute.googleapis.com\u002FInstance,storage.googleapis.com\u002FBucket,iam.googleapis.com\u002FServiceAccount\" \\\n  --format=\"table(name, assetType, location, project)\"\n\n# Export asset inventory to BigQuery for analysis\ngcloud asset export \\\n  --organization=ORG_ID \\\n  --output-bigquery-force \\\n  --output-bigquery-dataset=projects\u002FPROJECT_ID\u002Fdatasets\u002Fasset_inventory \\\n  --output-bigquery-table=resources \\\n  --content-type=resource\n```\n\n### Step 2: Audit IAM Policies and Bindings\n\nReview IAM policies across the organization for overly permissive bindings, primitive roles, and service account misuse.\n\n```bash\n# List all IAM policy bindings at org level\ngcloud organizations get-iam-policy ORG_ID \\\n  --format=json > org-iam-policy.json\n\n# Find all users with Owner or Editor roles across projects\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:roles\u002Fowner OR policy:roles\u002Feditor\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n\n# Identify service accounts with admin roles\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy.bindings.members:serviceAccount AND policy:roles\u002Fowner\" \\\n  --format=json\n\n# Check for allUsers or allAuthenticatedUsers bindings (public access)\ngcloud asset search-all-iam-policies \\\n  --scope=organizations\u002FORG_ID \\\n  --query=\"policy:allUsers OR policy:allAuthenticatedUsers\" \\\n  --format=\"table(resource, policy.bindings.role, policy.bindings.members)\"\n\n# List service account keys older than 90 days\ngcloud iam service-accounts keys list \\\n  --iam-account=SA_EMAIL \\\n  --managed-by=user \\\n  --format=\"table(name,validAfterTime,validBeforeTime)\"\n```\n\n### Step 3: Assess Firewall Rules and Network Configuration\n\nAudit VPC firewall rules for overly permissive ingress rules, missing logging, and network exposure.\n\n```bash\n# List all firewall rules allowing ingress from 0.0.0.0\u002F0\ngcloud compute firewall-rules list \\\n  --filter=\"direction=INGRESS AND sourceRanges=0.0.0.0\u002F0\" \\\n  --format=\"table(name, network, allowed, sourceRanges, targetTags)\"\n\n# Find firewall rules allowing all protocols\u002Fports\ngcloud compute firewall-rules list \\\n  --filter=\"direction=INGRESS AND allowed[].IPProtocol=all\" \\\n  --format=\"table(name, network, sourceRanges, targetTags)\"\n\n# Check for SSH (22) and RDP (3389) open to internet\ngcloud compute firewall-rules list \\\n  --filter=\"direction=INGRESS AND sourceRanges=0.0.0.0\u002F0 AND (allowed[].ports=22 OR allowed[].ports=3389)\" \\\n  --format=\"table(name, network, allowed, sourceRanges)\"\n\n# Audit VPC flow log configuration\ngcloud compute networks subnets list \\\n  --format=\"table(name, region, enableFlowLogs, logConfig.aggregationInterval)\"\n```\n\n### Step 4: Audit Cloud Storage Bucket Permissions\n\nCheck for publicly accessible storage buckets and missing encryption configurations.\n\n```bash\n# List all buckets in a project\ngsutil ls -p PROJECT_ID\n\n# Check bucket IAM for public access\nfor bucket in $(gsutil ls -p PROJECT_ID); do\n  echo \"=== $bucket ===\"\n  gsutil iam get \"$bucket\" | grep -E \"allUsers|allAuthenticatedUsers\" && \\\n    echo \"  WARNING: PUBLIC ACCESS DETECTED\" || \\\n    echo \"  OK: No public access\"\ndone\n\n# Check bucket encryption configuration\nfor bucket in $(gsutil ls -p PROJECT_ID); do\n  echo \"=== $bucket ===\"\n  gsutil kms encryption \"$bucket\" 2>\u002Fdev\u002Fnull || echo \"  Using Google-managed encryption\"\ndone\n\n# Check uniform bucket-level access enforcement\nfor bucket in $(gsutil ls -p PROJECT_ID); do\n  gsutil uniformbucketlevelaccess get \"$bucket\"\ndone\n```\n\n### Step 5: Run ScoutSuite for Comprehensive Assessment\n\nExecute ScoutSuite for an automated multi-check security assessment of the GCP environment.\n\n```bash\n# Run ScoutSuite against GCP\npython3 -m ScoutSuite gcp \\\n  --user-account \\\n  --all-projects \\\n  --report-dir .\u002Fscoutsuite-gcp-report\n\n# Run with service account credentials\npython3 -m ScoutSuite gcp \\\n  --service-account \u002Fpath\u002Fto\u002Fservice-account-key.json \\\n  --all-projects \\\n  --report-dir .\u002Fscoutsuite-gcp-report\n\n# Open the HTML report\nopen .\u002Fscoutsuite-gcp-report\u002Fgcp-report.html\n```\n\n### Step 6: Query Security Command Center Findings\n\nRetrieve and analyze SCC findings for vulnerabilities, misconfigurations, and threats.\n\n```bash\n# List active SCC findings\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND severity=\\\"CRITICAL\\\"\" \\\n  --format=\"table(finding.category, finding.severity, finding.resourceName, finding.eventTime)\"\n\n# List findings by category\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND category=\\\"PUBLIC_BUCKET_ACL\\\"\" \\\n  --format=json\n\n# Get finding statistics grouped by category\ngcloud scc findings group ORG_ID \\\n  --group-by=\"category\" \\\n  --filter=\"state=\\\"ACTIVE\\\"\"\n\n# List compliance violations from SCC\ngcloud scc findings list ORG_ID \\\n  --filter=\"state=\\\"ACTIVE\\\" AND sourceProperties.compliance_standard=\\\"CIS\\\"\" \\\n  --format=\"table(finding.category, finding.severity, finding.resourceName)\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Security Command Center | GCP-native security and risk management platform that provides asset inventory, vulnerability detection, and threat monitoring |\n| Forseti Security | Open-source GCP security toolkit (now deprecated in favor of SCC) that provided inventory, scanning, enforcement, and notification capabilities |\n| Cloud Asset Inventory | GCP service that provides a complete inventory of cloud resources with metadata, IAM policies, and org policy configurations |\n| CIS GCP Foundations Benchmark | Security best practice guidelines from Center for Internet Security specific to Google Cloud Platform configuration |\n| Uniform Bucket-Level Access | GCP storage setting that disables legacy ACLs and enforces access exclusively through IAM policies for consistent access control |\n| Organization Policy | GCP constraint-based governance mechanism that restricts resource configurations across the organization hierarchy |\n\n## Tools & Systems\n\n- **Security Command Center**: GCP-native CSPM providing asset inventory, vulnerability findings, and compliance scoring\n- **ScoutSuite**: Multi-cloud security auditing tool with comprehensive GCP checks for IAM, compute, storage, and networking\n- **gcloud CLI**: Primary command-line interface for querying GCP resource configurations and security settings\n- **Cloud Asset Inventory**: API for searching and exporting resource metadata and IAM policies across GCP projects\n- **Forseti Security**: Legacy open-source GCP security toolkit, superseded by SCC but still referenced in compliance frameworks\n\n## Common Scenarios\n\n### Scenario: Assessing a Newly Acquired GCP Organization\n\n**Context**: After a company acquisition, the security team needs to assess the security posture of the acquired company's GCP organization with 30+ projects.\n\n**Approach**:\n1. Enable Cloud Asset API and export full resource inventory to BigQuery for analysis\n2. Run `gcloud asset search-all-iam-policies` to find all Owner\u002FEditor bindings and public access grants\n3. Audit firewall rules across all projects for overly permissive ingress from `0.0.0.0\u002F0`\n4. Check all storage buckets for public access using `gsutil iam get`\n5. Run ScoutSuite for a comprehensive automated assessment with HTML report\n6. Enable SCC and review all CRITICAL and HIGH findings\n7. Generate a risk-prioritized remediation roadmap for the integration team\n\n**Pitfalls**: GCP IAM bindings are inherited from organization to folder to project. A permissive binding at the organization level affects all downstream projects. Always audit IAM at every level of the hierarchy, not just at the project level.\n\n## Output Format\n\n```\nGCP Security Assessment Report\n=================================\nOrganization: acme-acquired-org (ORG_ID: 123456789)\nProjects Assessed: 34\nAssessment Date: 2026-02-23\nStandards: CIS GCP Foundations 2.0\n\nIAM FINDINGS:\n  Users with Owner role at org level:       3\n  Service accounts with Editor role:        12\n  Resources with allUsers binding:           5\n  Service account keys > 90 days:           18\n\nNETWORK FINDINGS:\n  Firewall rules allowing 0.0.0.0\u002F0:       14\n  SSH open to internet:                      7\n  RDP open to internet:                      2\n  Subnets without VPC flow logs:            22\n\nSTORAGE FINDINGS:\n  Publicly accessible buckets:               5\n  Buckets without CMEK encryption:          28\n  Buckets without uniform access:           15\n\nCRITICAL FINDINGS: 12\nHIGH FINDINGS: 34\nMEDIUM FINDINGS: 78\nLOW FINDINGS: 145\n\nTOP REMEDIATION PRIORITIES:\n  1. Remove allUsers bindings from 5 storage buckets (CRITICAL)\n  2. Restrict 0.0.0.0\u002F0 firewall rules to specific CIDRs (HIGH)\n  3. Rotate 18 service account keys older than 90 days (HIGH)\n  4. Enable VPC flow logs on 22 subnets (MEDIUM)\n```\n",{"name":5,"tags":49,"author":53,"domain":40,"license":15,"version":54,"nist_csf":55,"subdomain":33,"description":60,"nist_ai_rmf":61,"mitre_attack":67,"atlas_techniques":72},[33,26,29,50,51,52],"security-command-center","iam-audit","cis-benchmark","mahipal","1.0",[56,57,58,59],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security Command Center, and gcloud CLI to audit IAM policies, firewall rules, storage permissions, and compliance against CIS GCP Foundations Benchmark.\n",[62,63,64,65,66],"MEASURE-2.7","MAP-5.1","MANAGE-2.4","GOVERN-1.1","GOVERN-4.2",[68,69,70,71],"T1078.004","T1530","T1537","T1580",[73,74,75],"AML.T0070","AML.T0066","AML.T0082","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-gcp-security-assessment-with-forseti",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":87,"prompt":97,"zipAvailable":98},[88,91,94],{"tool":89,"command":90},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-gcp-security-assessment-with-forseti",{"tool":92,"command":93},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-gcp-security-assessment-with-forseti",{"tool":95,"command":96},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-gcp-security-assessment-with-forseti","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-gcp-security-assessment-with-forseti\u002FSKILL.md",true,[100,105,111,115,119],{"path":101,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-gcp-security-assessment-with-forseti\u002FLICENSE",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"reference\u002Ftemplates.md","REFERENCE","参考文档",2280,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdoc-writer\u002Freference\u002Ftemplates.md",{"path":112,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":113,"sourceHtmlUrl":114},"reference\u002Fwriting-principles.md",1207,"https:\u002F\u002Fgithub.com\u002Finernoro\u002Fprd_agent\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdoc-writer\u002Freference\u002Fwriting-principles.md",{"path":116,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":117,"sourceHtmlUrl":118},"references\u002Fapi-reference.md",1949,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-gcp-security-assessment-with-forseti\u002Freferences\u002Fapi-reference.md",{"path":120,"resourceType":121,"resourceTypeDesc":122,"sizeBytes":123,"sourceHtmlUrl":124},"scripts\u002Fagent.py","SCRIPT","脚本",7307,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-gcp-security-assessment-with-forseti\u002Fscripts\u002Fagent.py",[126,151,175,202,228,255],{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[132],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,135,136,137,25,40,138,139,37,140,141,142,143,144,145,146,147,148,149,150],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":158,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[157],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[159,147,160,161,25,162,40,37,163,164,165,166,167,168,169,170,171,172,173,174],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":185,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[181,184],{"categoryNo":182,"categoryName":183,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[169,186,187,188,189,40,190,191,163,192,193,194,195,196,197,30,198,199,200,201],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":209,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[208],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[210,211,212,40,213,214,215,216,217,218,219,220,221,222,223,224,166,225,226,227],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":235,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[234],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[236,237,238,40,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":262,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[261],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[25,263,40,264,265,266,267,268,269,270,271,30,272,198,273,274,275,276,277,278],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]