Second Modification

common-mortakaz/integration-1.md

@@ -0,0 +1,23 @@
+Product 1: Jadal + Ghaymah Systems
+Integration Proposal: Jadal + Ghaymah Systems
+Product Description
+Jadal is a cloud-based sports court management platform that helps sports facility owners manage court reservations, memberships, customer information, payments, scheduling, and daily operations through a centralized dashboard. It simplifies facility management while providing customers with a smooth online booking experience.
+
+Integration with Ghaymah Systems
+Jadal can use Ghaymah Systems as its cloud infrastructure platform to improve scalability, reliability, and security.
+The proposed integration includes:
+•	Hosting Jadal's backend services on Ghaymah Compute. 
+•	Using Ghaymah Block Storage for reservation records, invoices, and uploaded documents. 
+•	Running automated backups using Ghaymah Backup. 
+•	Monitoring servers and application performance. 
+•	Scaling computing resources automatically during periods of high booking activity. 
+•	Protecting customer data through secure cloud infrastructure. 
+
+Integrating Jadal with Ghaymah Systems provides several advantages:
+•	Faster booking experience. 
+•	High system availability during peak hours. 
+•	Secure storage of reservation and payment information. 
+•	Automatic backups to reduce the risk of data loss. 
+•	Better scalability as the number of sports facilities and customers grows. 
+
+This results in a more reliable and secure platform for both facility owners and customers.

common-mortakaz/integration-2.md

@@ -0,0 +1,25 @@
+Circle Panel + Ghaymah Systems
+Product Description
+Circle Panel is an AI-native user research platform that helps organizations plan and manage user research projects. It allows teams to recruit participants, schedule interviews, collect user feedback, generate live transcripts, and produce AI-powered insights and reports from research sessions.
+
+
+Proposed Integration with Ghaymah Systems
+Circle Panel can use Ghaymah Systems as its cloud infrastructure provider.
+Integration Components
+•	Ghaymah Kubernetes to host backend services. 
+•	Ghaymah Object Storage for interview recordings and transcripts. 
+•	Ghaymah Block Storage for databases. 
+•	Ghaymah Load Balancer for high availability. 
+•	Ghaymah IAM for user authentication and access control. 
+•	Ghaymah Backup Service for disaster recovery. 
+	
+The application will upload recordings directly to Ghaymah Storage while AI services analyze transcripts and generate reports.
+
+The integration provides several benefits:
+•	Faster response time through scalable cloud infrastructure. 
+•	Secure storage of sensitive interview recordings. 
+•	Automatic backup and disaster recovery. 
+•	High availability during large research projects. 
+•	Lower operational costs due to elastic cloud resources. 
+
+Organizations can focus on research without worrying about infrastructure management.

q1-Security-Audit/q1-security-audit.md

@@ -0,0 +1,101 @@
+Task1:
+
+1. Introduction
+1.1 Objective
+The objective of this security audit is to assess the security posture of an application deployed on the Ghaymah Cloud platform. The audit focuses on five key security domains:
+•	Container Security 
+•	Network Security 
+•	OWASP Top 5 
+•	Data Security 
+•	Identity and Access Management (IAM) 
+The goal is to identify potential security weaknesses and recommend best practices to reduce security risk.
+
+
+2. Security Audit Checklist
+A. Container Security
+1. Scan Container Images for Vulnerabilities
+	All Docker images should be scanned before deployment as old packages may contain 	known CVEs.
+
+How to apply on Ghaymah
+Before deploying the image to Ghaymah:
+•	Scan image using Trivy. 
+•	Fix High and Critical vulnerabilities. 
+•	Only deploy clean image
+
+2. Run Containers as Non-root
+	Containers should never run with root privileges as if an attacker escapes the 	application, they will gain root access inside the container
+
+3. Store Secrets Securely
+	Never hardcode passwords or API keys inside the Docker image.
+How to apply on Ghaymah
+Use:
+•	Environment Variables 
+•	Secret Management 
+•	Encrypted configuration
+________________________________________
+
+
+B. Network Security
+4. Allow Only Required Ports
+	Expose only necessary ports by Configuring Security Groups / Firewall Rules
+5. Enforce HTTPS
+	All traffic must use HTTPS since it protects credentials and user data.
+How to apply it:
+	We can install an SSL certificate and redirect HTTP → HTTPS
+6. Restrict Internal Network Communication	
+	Database should never be publicly accessible we will accomplish this by Network Policies 	concept to isolate workloads.
+________________________________________
+C. OWASP Top 5
+7. Prevent Broken Access Control
+	Users should only access authorized resources by Role-Based Access Control (RBAC).
+8. Prevent Injection
+	Use parameterized queries
+9. Encrypt Sensitive Data
+	Passwords
+	       ↓
+	Hash using bcrypt
+	Sensitive files
+	       ↓
+         AES Encryption
+	   HTTPS
+	      ↓
+	     TLS
+10. Secure Configuration
+	Disable
+•	Debug Mode 
+•	Default Passwords 
+•	Directory Listing 
+	And update configuration regularly
+
+11. Keep Components Updated
+Always update:
+•	Docker Images 
+•	Libraries 
+•	Operating System 
+Use Trivy to detect outdated packages.
+________________________________________
+D. Data Security
+12. Encrypt Data at Rest
+	All stored data should be encrypted.
+E.G.
+•	Block Storage 
+•	Database 
+•	Backups 
+13. Backup Critical Data
+Implement automatic backups.
+•	Daily Backup
+•	Weekly Full Backup
+•	Off-site Backup
+________________________________________
+E. Identity & Access Management
+14. Enable Multi-Factor Authentication (MFA)
+Administrators should authenticate using
+•	Password 
+•	OTP / Authenticator App 
+________________________________________
+15. Apply Least Privilege Principle
+Every user receives only the permissions they actually need.
+
+
+
+

q2-Attack-Simulation/q2-Attack-Simulation.md

@@ -0,0 +1,140 @@
+Task2:
+
+Attack Scenario
+An attacker successfully performed a brute-force attack against the application's login API hosted on Ghaymah Cloud. 
+After compromising a valid user account, the attacker accessed sensitive customer data and exfiltrated part of the database.
+
+________________________________________
+
+
+Attack Flow
+
+Internet
+     ↓
+Recon
+     ↓
+API Discovery
+     ↓
+Brute Force
+     ↓
+Successful Login
+     ↓
+Data Access
+     ↓
+Data Exfiltration
+     ↓
+Cleanup
+________________________________________
+Root Cause Analysis
+The attack succeeded because:
+•	No Rate Limiting on the login endpoint. 
+•	Weak user password. 
+•	No Multi-Factor Authentication (MFA). 
+•	Insufficient monitoring of repeated failed logins. 
+•	Missing Web Application Firewall (WAF) protections. 
+2. Incident Response Plan
+Phase 1 – Identification
+Objectives:
+•	Confirm the brute-force attack. 
+•	Identify affected user accounts. 
+•	Determine compromised resources. 
+•	Preserve forensic evidence. 
+Actions:
+•	Review application logs. 
+•	Analyze firewall logs. 
+•	Check authentication logs. 
+•	Identify suspicious IP addresses. 
+________________________________________
+Phase 2 – Containment
+Immediate actions:
+•	Disable compromised accounts. 
+•	Block malicious IP addresses. 
+•	Enable emergency rate limiting. 
+•	Rotate exposed API tokens. 
+•	Isolate affected application containers if necessary. 
+________________________________________
+
+
+
+
+Phase 3 – Eradication
+Remove the root cause.
+Tasks:
+•	Force password reset. 
+•	Patch authentication vulnerabilities. 
+•	Remove malicious scripts. 
+•	Update security configurations. 
+•	Scan containers using Trivy. 
+________________________________________
+Phase 4 – Recovery
+Actions:
+•	Restore clean services. 
+•	Monitor user authentication. 
+•	Validate system integrity. 
+•	Notify affected customers. 
+•	Resume production gradually. 
+________________________________________
+Phase 5 – Lessons Learned
+Conduct a post-incident review.
+Questions:
+•	Why did monitoring fail? 
+•	Why wasn't MFA enabled? 
+•	Why were brute-force attempts not detected? 
+•	Which controls should be added? 
+________________________________________
+
+3. Preventing the Attack on Ghaymah Cloud
+	Network Security Controls
+		API Rate Limiting
+		E.G. Maximum 5 login attempts per minute/per IP
+
+	Web Application Firewall (WAF)
+		Configure rules to:
+•	Detect brute-force attacks. 
+•	Block suspicious IP addresses. 
+•	Prevent SQL Injection. 
+•	Prevent XSS. 
+	Firewall Rules
+		Only expose   =>  HTTPS (443) 
+		Restrict:
+•	SSH 
+•	Database ports 
+•	Internal services 
+	Network Segmentation
+		Application
+		       ↓
+	           Private Network
+		       ↓
+		Database
+		The database should never be directly accessible from the Internet.
+
+	
+
+
+	Container Security Controls
+•	Scan every Docker image before deployment. 
+•	Run containers as non-root users. 
+•	Store secrets securely. 
+•	Use read-only file systems when possible. 
+•	Apply least privilege to Kubernetes service accounts. 
+•	Continuously monitor container runtime activity. 
+________________________________________
+4. Alert Rule for Early Detection
+	Detection Logic
+		Trigger an alert if:
+			More than 10 failed logins from the same IP within 60 seconds.
+________________________________________
+Additional Detection Rules
+Alert when:
+•	Login attempts originate from multiple countries in a short time. 
+•	One account receives failed logins from multiple IPs. 
+•	Sudden spike in authentication failures. 
+•	API requests exceed expected thresholds. 
+________________________________________
+Recommendations
+•	Enable MFA for all users. 
+•	Implement account lockout after repeated failures. 
+•	Deploy a Web Application Firewall. 
+•	Use centralized logging with SIEM. 
+•	Perform continuous container vulnerability scanning. 
+•	Conduct regular penetration testing. 

q3-Privacy-Assessment/q3-Privacy-Assessment.md

@@ -0,0 +1,78 @@
+
+Task3:
+
+Executive Summary
+This report evaluates the privacy posture of mithal.space by analyzing cookies, HTTPS implementation, third-party resources, and security-related behaviors using browser developer tools.
+Overall, the website demonstrates good privacy practices by using HTTPS and showing minimal evidence of third-party tracking. However, the use of external Google resources introduces limited third-party interactions.
+________________________________________
+Cookies Analysis
+Findings
+	The inspection of mithal.space revealed no first-party cookies stored by the website.
+	No session cookies, authentication cookies, or tracking cookies belonging to the website 	were 	observed.
+	The only cookies visible in the browser belonged to external Google services and were 	
+	unrelated to mithal.space.
+Privacy Impact
+	This indicates that the website minimizes client-side tracking and does not rely on cookies for 	basic browsing functionality.
+
+Risk Level:   Very Low
+HTTPS Analysis
+Findings
+	The website uses HTTPS successfully.
+Benefits:
+•	Encrypts user traffic. 
+•	Prevents eavesdropping. 
+•	Protects search requests. 
+•	Ensures data integrity. 
+Risk Level: Very Low
+________________________________________
+Security Headers
+From the inspection: HTTPS is enabled.
+Recommendation:
+	Enable all modern security headers if any are missing.
+________________________________________
+Third-Party Resources
+	The website loads Google Fonts.
+No clear evidence of:
+•	Google Analytics 
+•	Facebook Pixel 
+•	DoubleClick 
+	was observed during the inspection.
+Privacy Impact: Low
+________________________________________
+
+Privacy Rating
+Category	Rating
+HTTPS	Excellent
+Cookies	Good
+Third-party Tracking	Good
+User Privacy	Good
+Overall	8.5 / 10
+________________________________________
+Security Improvements
+1. Add Strict Security Headers
+Implement:
+•	Content-Security-Policy 
+•	HSTS 
+•	Referrer-Policy 
+•	X-Content-Type-Options 
+
+
+2. Self-host Fonts
+Instead of loading Google Fonts,
+host fonts locally.
+Benefits
+•	Better privacy 
+•	Faster loading 
+•	No third-party requests 
+
+3. Publish Privacy Policy
+Provide transparency regarding:
+•	Cookies 
+•	Data Collection 
+•	Third-party services 
+•	Data Retention 
+________________________________________
+
+Conclusion
+	Based on the inspection, mithal.space demonstrates a generally privacy-friendly 	configuration. HTTPS is correctly implemented, and no obvious tracking frameworks 	were detected during the inspection. The primary opportunity for improvement is 	reducing reliance on third-party services (such as externally hosted fonts) and 	strengthening HTTP security headers.
+

q4-SIEM-and-Log-Analysis/q4-SIEM-and-Log-Analysis.md

@@ -0,0 +1,81 @@
+Task4:
+
+1. Python Script to Collect and Analyze Logs
+Objective
+Develop a simple SIEM (Security Information and Event Management) system that collects logs from three different sources, analyzes them, and detects suspicious activities.
+Log Sources
+The SIEM collects logs from the following sources:
+1.	System Logs (system.log) 
+•	Login attempts 
+•	User authentication 
+•	System events 
+2.	Web Server Logs (nginx.log) 
+•	HTTP requests 
+•	Status codes 
+•	Client IP addresses 
+3.	Application Logs (application.log) 
+•	Authentication failures 
+•	SQL Injection attempts 
+•	Application errors 
+
+Detection Rules
+The Python script should detect the following suspicious activities:
+Event	Severity
+Multiple failed login attempts	Medium
+SQL Injection attempts	High
+Cross-Site Scripting (XSS) attempts	High
+Port scanning	High
+Large number of HTTP 404 errors	Medium
+Root login attempts	Critical
+
+
+Detection Process
+	Read Log Files
+        	          ↓
+	Parse Log Entries
+        	          ↓
+	Match Detection Rules
+        	          ↓
+	Generate Security Alerts
+        	          ↓
+	Store Alerts in alerts.json
+
+E.G.
+•	More than 10 failed logins from the same IP within one minute → Generate a Medium Alert 
+•	Detection of SQL Injection → Generate a Critical Alert 
+________________________________________
+2. SIEM Dashboard Design
+	The dashboard provides a visual overview of security events.
+Dashboard Components
+•	Total number of alerts 
+•	Alert severity statistics 
+•	Top suspicious IP addresses 
+•	Recent security events 
+•	Alert history 
+ 
+________________________________________
+3. Deploying the SIEM on Ghaymah Cloud
+Deployment Architecture
+Log Sources       
+	Python SIEM Engine   =>   Block Storage   =>   alerts.json   =>   Web Dashboard
+Deployment Steps
+1.	Create a Virtual Machine on Ghaymah Cloud. 
+2.	Install Python and Docker. 
+3.	Upload the SIEM project. 
+4.	Mount Ghaymah Block Storage to store log files permanently. 
+5.	Run the Python monitoring script. 
+6.	Deploy the dashboard using Nginx. 
+7.	Access the dashboard through a web browser. 
+Why Use Block Storage?
+Using Ghaymah Block Storage provides:
+•	Persistent storage 
+•	Reliable log retention 
+•	Easy backup and recovery 
+•	Scalability for large log files 
+Future Improvements
+•	Integrate Elasticsearch for log indexing. 
+•	Use Grafana or Kibana for advanced visualization. 
+•	Send alerts through email or Slack. 
+•	Deploy the SIEM inside Kubernetes. 
+•	Add machine learning for anomaly detection.
+

q5-Ransomware-Disaster-Recovery/q5-Ransomware-Disaster-Recovery.txt

@@ -0,0 +1,137 @@
+Task5:
+
+Scenario
+	A ransomware attack has encrypted all files stored on Ghaymah Block Storage.
+	Users can no longer access their files, and the attacker demands payment in exchange 	for the 	decryption key.
+________________________________________
+1. Emergency Response Plan (First 60 Minutes)
+
+	0–15 Minutes: Identification & Isolation
+	Objectives
+•	Confirm that a ransomware attack has occurred. 
+•	Prevent the malware from spreading. 
+	Actions
+•	Disconnect affected virtual machines from the network. 
+•	Disable access to shared Block Storage volumes. 
+•	Block suspicious IP addresses using firewall rules. 
+•	Stop scheduled synchronization tasks. 
+•	Notify the security and incident response teams. 
+
+
+	15–30 Minutes: Investigation
+	Objectives
+	Determine the scope of the attack. 
+	Actions
+•	Review system and application logs. 
+•	Identify the ransomware entry point. 
+•	Determine which servers and storage volumes are affected. 
+•	Preserve logs and forensic evidence. 
+•	Check whether backups are intact. 
+
+	30–45 Minutes: Containment & Eradication
+	Objectives
+	Remove the ransomware and stop further encryption. 
+	Actions
+•	Isolate infected systems. 
+•	Scan all virtual machines with antivirus/EDR tools. 
+•	Remove malicious processes and scheduled tasks. 
+•	Rotate compromised credentials. 
+•	Patch exploited vulnerabilities. 
+
+	45–60 Minutes: Recovery Preparation
+	Objectives
+	Prepare for service restoration. 
+	Actions
+•	Verify the integrity of backups. 
+•	Restore critical services in a test environment.  
+•	Validate restored data.  
+•	Monitor systems for reinfection. 
+Gradually return services to production. 
+Timeline Summary
+Time	Activity
+0–15 min	Detect attack and isolate affected systems
+15–30 min	Investigate logs and identify affected resources
+30–45 min	Remove ransomware and secure infrastructure
+45–60 min	Restore from backups and validate services
+________________________________________
+
+2. Ghaymah Backup & Recovery Strategy
+
+Recovery Point Objective (RPO)
+	Definition: The maximum acceptable amount of data loss.
+	Proposed Value: 15 minutes
+	This means backups or snapshots should occur at least every 15 minutes for critical data.
+________________________________________
+Recovery Time Objective (RTO)
+	Definition: The maximum acceptable downtime before services are restored.
+	Proposed Value: 1 hour
+	Critical applications should be operational again within one hour.
+________________________________________
+Backup Strategy
+	Daily Incremental Backups
+	Capture only changes made since the previous backup.
+	Advantages:  Faster , Less storage usage 
+________________________________________
+Weekly Full Backup
+	Create a complete copy of all Block Storage volumes.
+	Advantages:  Faster restoration, Simplified disaster recovery 
+________________________________________
+Monthly Offline Backup
+	Store a copy outside the production environment.
+	Purpose: Protection against ransomware encrypting online backups. 
+________________________________________
+3-2-1 Backup Rule
+The organization should follow the 3-2-1 backup strategy:
+•	3 copies of the data (one primary + two backups). 
+•	2 different storage media (e.g., Block Storage and external storage/object storage). 
+•	1 off-site or offline backup stored separately from the production environment. 
+________________________________________
+3. Comprehensive Prevention Plan
+Identity & Access Management (IAM)
+•	Enable Multi-Factor Authentication (MFA). 
+•	Apply the Principle of Least Privilege. 
+•	Review user permissions regularly. 
+•	Rotate passwords and API keys. 
+________________________________________
+Network Security
+•	Enable firewalls. 
+•	Segment production and backup networks. 
+•	Restrict remote administration access. 
+•	Use VPN for administrative access. 
+________________________________________
+Endpoint Security
+•	Deploy Endpoint Detection and Response (EDR). 
+•	Keep operating systems and software patched. 
+•	Disable unnecessary services. 
+•	Enable application allow-listing where appropriate. 
+________________________________________
+Backup Protection
+•	Use immutable backups where possible. 
+•	Encrypt backup data. 
+•	Test backup restoration regularly. 
+•	Store backups in separate locations. 
+________________________________________
+
+Container Security
+•	Scan container images using Trivy before deployment. 
+•	Avoid running containers as root. 
+•	Store secrets securely. 
+•	Continuously monitor container activity. 
+________________________________________
+Monitoring & Detection
+•	Deploy a SIEM solution to centralize logs. 
+•	Configure alerts for: 
+o	Multiple failed logins. 
+o	Unusual file modifications. 
+o	Mass file encryption. 
+o	Privilege escalation attempts. 
+________________________________________
+Security Awareness
+•	Train employees to recognize phishing emails. 
+•	Conduct regular security awareness sessions. 
+•	Simulate phishing campaigns. 
+•	Define clear incident reporting procedures. 
+________________________________________
+Conclusion
+A successful ransomware response depends on rapid detection, immediate isolation, reliable backups, and tested recovery procedures. 
+By implementing layered security controls—including strong IAM, network segmentation, continuous monitoring, secure container practices, and a resilient backup strategy based on the 3-2-1 rule—organizations using Ghaymah Cloud can significantly reduce the impact of ransomware attacks and recover services efficiently.