Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Deploying Software-Defined Perimeter · mukul975 | DecimalAI

Deploying Software Defined Perimeter

SkillScore12Maintained

deploying-software-defined-perimeter

Deploy a Software-Defined Perimeter using the CSA v2.0 specification with Single Packet Authorization, mutual TLS, and SDP controller/gateway configuration to enforce zero trust network access.

DevOpsby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/deploying-software-defined-perimeter/SKILL.md

decimalai skills pull deploying-software-defined-perimeter --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/deploying-software-defined-perimeter/SKILL.md https://app.decimal.ai/s/deploying-software-defined-perimeter/SKILL.md

Raw file: /s/deploying-software-defined-perimeter/SKILL.md ↗ · machine-readable summary at /s/deploying-software-defined-perimeter.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +8% lift · at higher cost+39% tokens0% turns12% of whole cases pass with skill (3/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-14	✗→✓	▲ Improved	—	—
case-17	✗→✓	▲ Improved	—	—
case-01	✓→✓	＝ Same ✓	—	—
case-23	✗→✗	＝ Same ✗	—	—
case-22	✗→✗	＝ Same ✗	—	—

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/deploying-software-defined-perimeter/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Deploying Software-Defined Perimeter

Prerequisites

Understanding of zero trust principles (NIST SP 800-207)
Knowledge of CSA Software-Defined Perimeter specification
Familiarity with PKI and mutual TLS authentication
Experience with network security architecture

Overview

A Software-Defined Perimeter (SDP) implements zero trust by creating a dynamically provisioned, identity-centric perimeter around individual resources. Defined by the Cloud Security Alliance (CSA), SDP makes application infrastructure invisible to unauthorized users through a "dark cloud" approach where services are hidden until authenticated and authorized. Unlike traditional VPN, SDP establishes one-to-one encrypted connections between verified users and specific applications.

This skill covers deploying SDP using the CSA v2.0 specification, implementing Single Packet Authorization (SPA), configuring the SDP controller and gateway, and validating the deployment against NIST SP 800-207 requirements.

When to Use

When deploying or configuring deploying software defined perimeter capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with zero trust architecture concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Architecture

SDP Components (CSA Specification)

┌─────────────────────┐
│ SDP Controller       │
│ - Authentication     │
│ - Authorization      │
│ - Policy management  │
│ - Key management     │
└──────────┬──────────┘
           │
    ┌──────┴──────┐
    │             │
    v             v
┌────────┐  ┌────────────┐
│ IH     │  │ AH         │
│(Client)│  │(Gateway)   │
│        │  │            │
│ SPA    │──│ Protected  │
│ mTLS   │  │ Resources  │
└────────┘  └────────────┘

IH = Initiating Host (User Device)
AH = Accepting Host (Application Gateway)
SPA = Single Packet Authorization

SDP Deployment Models

Client-to-Gateway: User device connects through SDP gateway to backend applications
Client-to-Server: Direct connection between user and application server
Server-to-Server: Workload-to-workload communication through SDP
Gateway-to-Gateway: Site-to-site connectivity replacing traditional VPN tunnels

Key Concepts

Single Packet Authorization (SPA)

SPA is a network security mechanism where the SDP gateway drops all TCP/UDP packets by default. A cryptographically signed single packet must be sent before any connection is established. The gateway validates the SPA packet, and only then opens a temporary port for the authenticated session. This makes the gateway invisible to port scanners.

Mutual TLS (mTLS)

After SPA validation, both the client and server authenticate each other using X.509 certificates. This bidirectional authentication prevents man-in-the-middle attacks and ensures both endpoints are verified.

Dynamic Provisioning

SDP connections are provisioned on-demand based on real-time policy evaluation. No persistent network tunnels exist; each session is individually authorized and encrypted.

Workflow

Phase 1: SDP Controller Deployment

Deploy SDP Controller

Install SDP controller on hardened, redundant infrastructure
Configure PKI integration for certificate issuance
Set up authentication backend (LDAP, SAML, OIDC)
Configure policy database with application definitions
Enable audit logging for all controller decisions

Configure Authentication

Integrate with enterprise IdP via SAML 2.0 or OIDC
Configure device certificate enrollment (SCEP/EST)
Enable multi-factor authentication requirements
Set up certificate revocation checking (OCSP/CRL)

Define Access Policies

Map users/groups to authorized applications
Define device posture requirements per application
Configure contextual conditions (location, time, risk level)
Set session duration and re-authentication intervals

Phase 2: SDP Gateway Deployment

Deploy Accepting Hosts (Gateways)

Install SDP gateway instances in front of protected applications
Configure default-drop firewall rules (deny all inbound)
Enable SPA listener on designated ports
Configure mTLS with controller-issued certificates
Set up health monitoring and failover

Configure Application Definitions

Register each protected application with the controller
Define backend server IPs, ports, and protocols
Configure load balancing for multi-instance applications
Set up application health checks

Phase 3: Client Deployment

Deploy Initiating Hosts (Clients)

Install SDP client software on user endpoints
Enroll device certificates through automated provisioning
Configure SPA key material distribution
Test authentication flow: SPA → mTLS → application access

Validate End-to-End Flow

Verify SPA packets are accepted by gateway
Confirm mTLS handshake succeeds with valid certificates
Test application access through the SDP tunnel
Verify unauthorized access is blocked (no SPA = invisible gateway)

Phase 4: Operational Validation

Security Testing

Port scan the SDP gateway to confirm invisibility (all ports show filtered/closed)
Attempt connection without valid SPA (must fail silently)
Test with revoked client certificate (must be denied)
Attempt lateral movement from one authorized app to another unauthorized app
Validate audit trail completeness

Monitoring and Maintenance

Configure SIEM integration for SDP controller and gateway logs
Set up alerting for failed SPA attempts and certificate errors
Establish certificate rotation schedule
Document incident response procedures for SDP events

Validation Checklist

] SDP Controller deployed with HA and audit logging
] IdP integration tested with SAML/OIDC and MFA
] SDP Gateways deployed with default-drop firewall
] SPA mechanism validated (gateway invisible to port scans)
] mTLS established between clients and gateways
] Access policies enforce least-privilege per user/app
] Device certificate enrollment automated
] Unauthorized access attempts blocked silently
] Lateral movement between apps prevented
] Logs streaming to SIEM with alerting configured
] Certificate rotation and revocation procedures tested

References

CSA Software-Defined Perimeter Architecture Guide v3
CSA SDP Specification v2.0
NIST SP 800-207: Zero Trust Architecture
CISA Zero Trust Maturity Model v2.0
fwknop: Single Packet Authorization implementation

Illustrative Want to see what deploying-software-defined-perimeter would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 01:22 UTC · 25 cases

Lift

+8%

12% vs 4%

Agent turns

1.0 vs 1.0

Tokens

+39%

2,934.84 vs 2,118.64

fail → pass · 2pass → pass · 1fail → fail · 22

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-23 We are configuring a site-to-site IPsec IKEv2 VPN tunnel between two enterprise data centers using Cisco ASA appliances. Provide the configuration steps for Phase 1 ISAKMP and Phase 2 IPsec proposal sets with pre-shared keys.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Beyond user identity and device posture, what contextual factors should the SDP controller evaluate during access policy execution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-25 We are implementing 802.1X Network Access Control (NAC) on enterprise Cisco switches using a RADIUS server and EAP-TLS. Outline the switchport configuration commands and RADIUS policy rules for dynamic VLAN assignment.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 Our team needs to deploy an SDP gateway and controller infrastructure to protect internal application servers from port scanning and unauthorized probes. I need an execution guide detailing how to set up Single Packet Authorization (SPA), configure mutual TLS handshakes between initiating endpoints and application gateways, and register backend application routes. Please structure the response as a step-by-step deployment blueprint followed by a list of post-deployment security test procedures.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-03 When an initiating client endpoint attempts to connect to an application hidden behind a dark cloud gateway, describe the exact cryptographic mechanism and network sequence that occurs before any TCP handshake is permitted.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 When deploying the central SDP Controller in Phase 1, what infrastructure and logging controls must be implemented to satisfy CSA specifications?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-24 We need to secure an internal web dashboard by putting NGINX in front of it and using oauth2_proxy for Google Workspace authentication. Provide the NGINX ingress configuration and oauth2_proxy flag settings for session cookie validation.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Two automated microservices in separate cloud environments need to communicate securely under the CSA SDP specification. Which deployment model fits this server-to-server requirement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 After Single Packet Authorization is successfully validated by the gateway, what transport-level security mechanism should be established to authenticate both the client endpoint and the gateway?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 An engineer conducts an operational test where a client device presents a certificate that has been revoked by the PKI Certificate Authority. Describe how the SDP environment must handle this connection attempt during phase 4 testing.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 An unauthorized host sends malformed packets or invalid signatures to the SPA port of an SDP gateway. How should the gateway respond to these network packets?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 In Phase 4 operational validation, what monitoring integration must be established for SDP controller and gateway security events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We are setting up an enterprise SDP Controller. The team is deciding how user identity and device state should be validated during the primary authentication phase. What protocol standard should be used for user identity, and how are client certificates distributed to endpoints?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When defining a protected application in Phase 2 on the Accepting Host gateway, what specific backend details must be registered with the central controller?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Which NIST Special Publication serves as the primary benchmark for verifying zero trust architecture requirements when deploying SDP?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 In CSA SDP terminology, what is the role and formal designation of the gateway component that protects resources and sits in front of backend applications?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are provisioning a network perimeter gateway to protect backend application servers from internet probes. Engineers suggest leaving HTTPS port 443 permanently open to listen for incoming TLS connections. How should the gateway firewall rules be configured to ensure complete cloaking against external scanners?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 A user has an active, authenticated SDP session to Access Application A. The user's device attempts to pivot directly across the network to reach Application B on the same backend gateway subnet, which the user is not authorized to access. How does the SDP architecture handle this attempt?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our enterprise wants to replace legacy site-to-site IPsec tunnels between regional branch offices and cloud VPCs using zero trust architecture principles. Which CSA SDP deployment model specifically replaces network-to-network VPN tunnels?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 During post-deployment security audit of an SDP gateway, an auditor runs a SYN port scan against the public IP address of the gateway without sending prior authorization packets. What result must the scan produce to pass the audit?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 A network architect asks whether SDP maintains persistent network tunnels between endpoints and application gateways similar to site-to-site VPNs. Explain how SDP provisions and tears down connectivity.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 In Phase 3 client deployment, what components must be distributed and verified on user endpoints before initiating connections to protected gateways?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When implementing the Software-Defined Perimeter architecture according to Cloud Security Alliance recommendations outlined in this deployment workflow, which specification version is used?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 In CSA SDP terminology, what is the formal designation given to the user endpoint device that requests access to protected application infrastructure?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 When defining access policies on the central controller during Phase 1, what operational parameters must be configured regarding session lifecycle?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +8 percentage points is the difference between those two pass rates over the 25 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4%
Pass rate with the skill: 12%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 01:22 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run12

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+23% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

Deploying Software Defined Perimeter

SkillSafety

Source

Deploying Software-Defined Perimeter

Prerequisites

Overview

When to Use

Prerequisites

Architecture

SDP Components (CSA Specification)

SDP Deployment Models

Key Concepts

Single Packet Authorization (SPA)

Mutual TLS (mTLS)

Dynamic Provisioning

Workflow

Phase 1: SDP Controller Deployment

Phase 2: SDP Gateway Deployment

Phase 3: Client Deployment

Phase 4: Operational Validation

Validation Checklist

References

How this skill was measured

Related skills