diff --git a/common-mortakaz/integration-1.md b/common-mortakaz/integration-1.md new file mode 100644 index 0000000..4ff0eb6 --- /dev/null +++ b/common-mortakaz/integration-1.md @@ -0,0 +1,23 @@ +Product 1: Jadal + Ghaymah Systems +Integration Proposal: Jadal + Ghaymah Systems +Product Description +Jadal is a cloud-based sports court management platform that helps sports facility owners manage court reservations, memberships, customer information, payments, scheduling, and daily operations through a centralized dashboard. It simplifies facility management while providing customers with a smooth online booking experience. + +Integration with Ghaymah Systems +Jadal can use Ghaymah Systems as its cloud infrastructure platform to improve scalability, reliability, and security. +The proposed integration includes: +• Hosting Jadal's backend services on Ghaymah Compute. +• Using Ghaymah Block Storage for reservation records, invoices, and uploaded documents. +• Running automated backups using Ghaymah Backup. +• Monitoring servers and application performance. +• Scaling computing resources automatically during periods of high booking activity. +• Protecting customer data through secure cloud infrastructure. + +Integrating Jadal with Ghaymah Systems provides several advantages: +• Faster booking experience. +• High system availability during peak hours. +• Secure storage of reservation and payment information. +• Automatic backups to reduce the risk of data loss. +• Better scalability as the number of sports facilities and customers grows. + +This results in a more reliable and secure platform for both facility owners and customers. diff --git a/common-mortakaz/integration-2.md b/common-mortakaz/integration-2.md new file mode 100644 index 0000000..0eefdfe --- /dev/null +++ b/common-mortakaz/integration-2.md @@ -0,0 +1,25 @@ +Circle Panel + Ghaymah Systems +Product Description +Circle Panel is an AI-native user research platform that helps organizations plan and manage user research projects. It allows teams to recruit participants, schedule interviews, collect user feedback, generate live transcripts, and produce AI-powered insights and reports from research sessions. + + +Proposed Integration with Ghaymah Systems +Circle Panel can use Ghaymah Systems as its cloud infrastructure provider. +Integration Components +• Ghaymah Kubernetes to host backend services. +• Ghaymah Object Storage for interview recordings and transcripts. +• Ghaymah Block Storage for databases. +• Ghaymah Load Balancer for high availability. +• Ghaymah IAM for user authentication and access control. +• Ghaymah Backup Service for disaster recovery. + +The application will upload recordings directly to Ghaymah Storage while AI services analyze transcripts and generate reports. + +The integration provides several benefits: +• Faster response time through scalable cloud infrastructure. +• Secure storage of sensitive interview recordings. +• Automatic backup and disaster recovery. +• High availability during large research projects. +• Lower operational costs due to elastic cloud resources. + +Organizations can focus on research without worrying about infrastructure management. diff --git a/common-qabilah/README.md b/common-qabilah/qabilah-profile.txt similarity index 100% rename from common-qabilah/README.md rename to common-qabilah/qabilah-profile.txt diff --git a/q1-Security-Audit/SecOps Assessment Task1.docx b/q1-Security-Audit/SecOps Assessment Task1.docx deleted file mode 100644 index 6555a37..0000000 Binary files a/q1-Security-Audit/SecOps Assessment Task1.docx and /dev/null differ diff --git a/q1-Security-Audit/SecOps Assessment Task1.pdf b/q1-Security-Audit/SecOps Assessment Task1.pdf deleted file mode 100644 index a9e4cde..0000000 Binary files a/q1-Security-Audit/SecOps Assessment Task1.pdf and /dev/null differ diff --git a/q1-Security-Audit/q1-security-audit.md b/q1-Security-Audit/q1-security-audit.md new file mode 100644 index 0000000..134a600 --- /dev/null +++ b/q1-Security-Audit/q1-security-audit.md @@ -0,0 +1,101 @@ +Task1: + +1. Introduction +1.1 Objective +The objective of this security audit is to assess the security posture of an application deployed on the Ghaymah Cloud platform. The audit focuses on five key security domains: +• Container Security +• Network Security +• OWASP Top 5 +• Data Security +• Identity and Access Management (IAM) +The goal is to identify potential security weaknesses and recommend best practices to reduce security risk. + + +2. Security Audit Checklist +A. Container Security +1. Scan Container Images for Vulnerabilities + All Docker images should be scanned before deployment as old packages may contain known CVEs. + +How to apply on Ghaymah +Before deploying the image to Ghaymah: +• Scan image using Trivy. +• Fix High and Critical vulnerabilities. +• Only deploy clean image + +2. Run Containers as Non-root + Containers should never run with root privileges as if an attacker escapes the application, they will gain root access inside the container + +3. Store Secrets Securely + Never hardcode passwords or API keys inside the Docker image. +How to apply on Ghaymah +Use: +• Environment Variables +• Secret Management +• Encrypted configuration +________________________________________ + + +B. Network Security +4. Allow Only Required Ports + Expose only necessary ports by Configuring Security Groups / Firewall Rules +5. Enforce HTTPS + All traffic must use HTTPS since it protects credentials and user data. +How to apply it: + We can install an SSL certificate and redirect HTTP → HTTPS +6. Restrict Internal Network Communication + Database should never be publicly accessible we will accomplish this by Network Policies concept to isolate workloads. +________________________________________ +C. OWASP Top 5 +7. Prevent Broken Access Control + Users should only access authorized resources by Role-Based Access Control (RBAC). +8. Prevent Injection + Use parameterized queries +9. Encrypt Sensitive Data + Passwords + ↓ + Hash using bcrypt + Sensitive files + ↓ + AES Encryption + HTTPS + ↓ + TLS +10. Secure Configuration + Disable +• Debug Mode +• Default Passwords +• Directory Listing + And update configuration regularly + +11. Keep Components Updated +Always update: +• Docker Images +• Libraries +• Operating System +Use Trivy to detect outdated packages. +________________________________________ +D. Data Security +12. Encrypt Data at Rest + All stored data should be encrypted. +E.G. +• Block Storage +• Database +• Backups +13. Backup Critical Data +Implement automatic backups. +• Daily Backup +• Weekly Full Backup +• Off-site Backup +________________________________________ +E. Identity & Access Management +14. Enable Multi-Factor Authentication (MFA) +Administrators should authenticate using +• Password +• OTP / Authenticator App +________________________________________ +15. Apply Least Privilege Principle +Every user receives only the permissions they actually need. + + + + diff --git a/q2-Attack-Simulation/SecOps Assessment.docx b/q2-Attack-Simulation/SecOps Assessment.docx deleted file mode 100644 index 70ba451..0000000 Binary files a/q2-Attack-Simulation/SecOps Assessment.docx and /dev/null differ diff --git a/q2-Attack-Simulation/q2-Attack-Simulation.md b/q2-Attack-Simulation/q2-Attack-Simulation.md new file mode 100644 index 0000000..7689642 --- /dev/null +++ b/q2-Attack-Simulation/q2-Attack-Simulation.md @@ -0,0 +1,140 @@ +Task2: + +Attack Scenario +An attacker successfully performed a brute-force attack against the application's login API hosted on Ghaymah Cloud. +After compromising a valid user account, the attacker accessed sensitive customer data and exfiltrated part of the database. + +________________________________________ + + +Attack Flow + +Internet + ↓ +Recon + ↓ +API Discovery + ↓ +Brute Force + ↓ +Successful Login + ↓ +Data Access + ↓ +Data Exfiltration + ↓ +Cleanup +________________________________________ +Root Cause Analysis +The attack succeeded because: +• No Rate Limiting on the login endpoint. +• Weak user password. +• No Multi-Factor Authentication (MFA). +• Insufficient monitoring of repeated failed logins. +• Missing Web Application Firewall (WAF) protections. +2. Incident Response Plan +Phase 1 – Identification +Objectives: +• Confirm the brute-force attack. +• Identify affected user accounts. +• Determine compromised resources. +• Preserve forensic evidence. +Actions: +• Review application logs. +• Analyze firewall logs. +• Check authentication logs. +• Identify suspicious IP addresses. +________________________________________ +Phase 2 – Containment +Immediate actions: +• Disable compromised accounts. +• Block malicious IP addresses. +• Enable emergency rate limiting. +• Rotate exposed API tokens. +• Isolate affected application containers if necessary. +________________________________________ + + + + +Phase 3 – Eradication +Remove the root cause. +Tasks: +• Force password reset. +• Patch authentication vulnerabilities. +• Remove malicious scripts. +• Update security configurations. +• Scan containers using Trivy. +________________________________________ +Phase 4 – Recovery +Actions: +• Restore clean services. +• Monitor user authentication. +• Validate system integrity. +• Notify affected customers. +• Resume production gradually. +________________________________________ +Phase 5 – Lessons Learned +Conduct a post-incident review. +Questions: +• Why did monitoring fail? +• Why wasn't MFA enabled? +• Why were brute-force attempts not detected? +• Which controls should be added? +________________________________________ + +3. Preventing the Attack on Ghaymah Cloud + Network Security Controls + API Rate Limiting + E.G. Maximum 5 login attempts per minute/per IP + + Web Application Firewall (WAF) + Configure rules to: +• Detect brute-force attacks. +• Block suspicious IP addresses. +• Prevent SQL Injection. +• Prevent XSS. + Firewall Rules + Only expose => HTTPS (443) + Restrict: +• SSH +• Database ports +• Internal services + Network Segmentation + Application + ↓ + Private Network + ↓ + Database + The database should never be directly accessible from the Internet. + + + + + Container Security Controls +• Scan every Docker image before deployment. +• Run containers as non-root users. +• Store secrets securely. +• Use read-only file systems when possible. +• Apply least privilege to Kubernetes service accounts. +• Continuously monitor container runtime activity. +________________________________________ +4. Alert Rule for Early Detection + Detection Logic + Trigger an alert if: + More than 10 failed logins from the same IP within 60 seconds. +________________________________________ +Additional Detection Rules +Alert when: +• Login attempts originate from multiple countries in a short time. +• One account receives failed logins from multiple IPs. +• Sudden spike in authentication failures. +• API requests exceed expected thresholds. +________________________________________ +Recommendations +• Enable MFA for all users. +• Implement account lockout after repeated failures. +• Deploy a Web Application Firewall. +• Use centralized logging with SIEM. +• Perform continuous container vulnerability scanning. +• Conduct regular penetration testing. diff --git a/q3-Privacy-Assessment/SecOps Assessmen1.docx b/q3-Privacy-Assessment/SecOps Assessmen1.docx deleted file mode 100644 index d8398c4..0000000 Binary files a/q3-Privacy-Assessment/SecOps Assessmen1.docx and /dev/null differ diff --git a/q3-Privacy-Assessment/q3-Privacy-Assessment.md b/q3-Privacy-Assessment/q3-Privacy-Assessment.md new file mode 100644 index 0000000..3c3e774 --- /dev/null +++ b/q3-Privacy-Assessment/q3-Privacy-Assessment.md @@ -0,0 +1,78 @@ + +Task3: + +Executive Summary +This report evaluates the privacy posture of mithal.space by analyzing cookies, HTTPS implementation, third-party resources, and security-related behaviors using browser developer tools. +Overall, the website demonstrates good privacy practices by using HTTPS and showing minimal evidence of third-party tracking. However, the use of external Google resources introduces limited third-party interactions. +________________________________________ +Cookies Analysis +Findings + The inspection of mithal.space revealed no first-party cookies stored by the website. + No session cookies, authentication cookies, or tracking cookies belonging to the website were observed. + The only cookies visible in the browser belonged to external Google services and were + unrelated to mithal.space. +Privacy Impact + This indicates that the website minimizes client-side tracking and does not rely on cookies for basic browsing functionality. + +Risk Level: Very Low +HTTPS Analysis +Findings + The website uses HTTPS successfully. +Benefits: +• Encrypts user traffic. +• Prevents eavesdropping. +• Protects search requests. +• Ensures data integrity. +Risk Level: Very Low +________________________________________ +Security Headers +From the inspection: HTTPS is enabled. +Recommendation: + Enable all modern security headers if any are missing. +________________________________________ +Third-Party Resources + The website loads Google Fonts. +No clear evidence of: +• Google Analytics +• Facebook Pixel +• DoubleClick + was observed during the inspection. +Privacy Impact: Low +________________________________________ + +Privacy Rating +Category Rating +HTTPS Excellent +Cookies Good +Third-party Tracking Good +User Privacy Good +Overall 8.5 / 10 +________________________________________ +Security Improvements +1. Add Strict Security Headers +Implement: +• Content-Security-Policy +• HSTS +• Referrer-Policy +• X-Content-Type-Options + + +2. Self-host Fonts +Instead of loading Google Fonts, +host fonts locally. +Benefits +• Better privacy +• Faster loading +• No third-party requests + +3. Publish Privacy Policy +Provide transparency regarding: +• Cookies +• Data Collection +• Third-party services +• Data Retention +________________________________________ + +Conclusion + Based on the inspection, mithal.space demonstrates a generally privacy-friendly configuration. HTTPS is correctly implemented, and no obvious tracking frameworks were detected during the inspection. The primary opportunity for improvement is reducing reliance on third-party services (such as externally hosted fonts) and strengthening HTTP security headers. + diff --git a/q4-SIEM-and-Log-Analysis/SecOps Assessmen1.docx b/q4-SIEM-and-Log-Analysis/SecOps Assessmen1.docx deleted file mode 100644 index 742cc0a..0000000 Binary files a/q4-SIEM-and-Log-Analysis/SecOps Assessmen1.docx and /dev/null differ diff --git a/q4-SIEM-and-Log-Analysis/q4-SIEM-and-Log-Analysis.md b/q4-SIEM-and-Log-Analysis/q4-SIEM-and-Log-Analysis.md new file mode 100644 index 0000000..09c9eef --- /dev/null +++ b/q4-SIEM-and-Log-Analysis/q4-SIEM-and-Log-Analysis.md @@ -0,0 +1,81 @@ +Task4: + +1. Python Script to Collect and Analyze Logs +Objective +Develop a simple SIEM (Security Information and Event Management) system that collects logs from three different sources, analyzes them, and detects suspicious activities. +Log Sources +The SIEM collects logs from the following sources: +1. System Logs (system.log) +• Login attempts +• User authentication +• System events +2. Web Server Logs (nginx.log) +• HTTP requests +• Status codes +• Client IP addresses +3. Application Logs (application.log) +• Authentication failures +• SQL Injection attempts +• Application errors + +Detection Rules +The Python script should detect the following suspicious activities: +Event Severity +Multiple failed login attempts Medium +SQL Injection attempts High +Cross-Site Scripting (XSS) attempts High +Port scanning High +Large number of HTTP 404 errors Medium +Root login attempts Critical + + +Detection Process + Read Log Files + ↓ + Parse Log Entries + ↓ + Match Detection Rules + ↓ + Generate Security Alerts + ↓ + Store Alerts in alerts.json + +E.G. +• More than 10 failed logins from the same IP within one minute → Generate a Medium Alert +• Detection of SQL Injection → Generate a Critical Alert +________________________________________ +2. SIEM Dashboard Design + The dashboard provides a visual overview of security events. +Dashboard Components +• Total number of alerts +• Alert severity statistics +• Top suspicious IP addresses +• Recent security events +• Alert history + +________________________________________ +3. Deploying the SIEM on Ghaymah Cloud +Deployment Architecture +Log Sources + Python SIEM Engine => Block Storage => alerts.json => Web Dashboard +Deployment Steps +1. Create a Virtual Machine on Ghaymah Cloud. +2. Install Python and Docker. +3. Upload the SIEM project. +4. Mount Ghaymah Block Storage to store log files permanently. +5. Run the Python monitoring script. +6. Deploy the dashboard using Nginx. +7. Access the dashboard through a web browser. +Why Use Block Storage? +Using Ghaymah Block Storage provides: +• Persistent storage +• Reliable log retention +• Easy backup and recovery +• Scalability for large log files +Future Improvements +• Integrate Elasticsearch for log indexing. +• Use Grafana or Kibana for advanced visualization. +• Send alerts through email or Slack. +• Deploy the SIEM inside Kubernetes. +• Add machine learning for anomaly detection. + diff --git a/q5-Ransomware-Disaster-Recovery/SecOps Assessment.docx b/q5-Ransomware-Disaster-Recovery/SecOps Assessment.docx deleted file mode 100644 index b07cb3b..0000000 Binary files a/q5-Ransomware-Disaster-Recovery/SecOps Assessment.docx and /dev/null differ diff --git a/q5-Ransomware-Disaster-Recovery/q5-Ransomware-Disaster-Recovery.txt b/q5-Ransomware-Disaster-Recovery/q5-Ransomware-Disaster-Recovery.txt new file mode 100644 index 0000000..1b65dd2 --- /dev/null +++ b/q5-Ransomware-Disaster-Recovery/q5-Ransomware-Disaster-Recovery.txt @@ -0,0 +1,137 @@ +Task5: + +Scenario + A ransomware attack has encrypted all files stored on Ghaymah Block Storage. + Users can no longer access their files, and the attacker demands payment in exchange for the decryption key. +________________________________________ +1. Emergency Response Plan (First 60 Minutes) + + 0–15 Minutes: Identification & Isolation + Objectives +• Confirm that a ransomware attack has occurred. +• Prevent the malware from spreading. + Actions +• Disconnect affected virtual machines from the network. +• Disable access to shared Block Storage volumes. +• Block suspicious IP addresses using firewall rules. +• Stop scheduled synchronization tasks. +• Notify the security and incident response teams. + + + 15–30 Minutes: Investigation + Objectives + Determine the scope of the attack. + Actions +• Review system and application logs. +• Identify the ransomware entry point. +• Determine which servers and storage volumes are affected. +• Preserve logs and forensic evidence. +• Check whether backups are intact. + + 30–45 Minutes: Containment & Eradication + Objectives + Remove the ransomware and stop further encryption. + Actions +• Isolate infected systems. +• Scan all virtual machines with antivirus/EDR tools. +• Remove malicious processes and scheduled tasks. +• Rotate compromised credentials. +• Patch exploited vulnerabilities. + + 45–60 Minutes: Recovery Preparation + Objectives + Prepare for service restoration. + Actions +• Verify the integrity of backups. +• Restore critical services in a test environment. +• Validate restored data. +• Monitor systems for reinfection. +Gradually return services to production. +Timeline Summary +Time Activity +0–15 min Detect attack and isolate affected systems +15–30 min Investigate logs and identify affected resources +30–45 min Remove ransomware and secure infrastructure +45–60 min Restore from backups and validate services +________________________________________ + +2. Ghaymah Backup & Recovery Strategy + +Recovery Point Objective (RPO) + Definition: The maximum acceptable amount of data loss. + Proposed Value: 15 minutes + This means backups or snapshots should occur at least every 15 minutes for critical data. +________________________________________ +Recovery Time Objective (RTO) + Definition: The maximum acceptable downtime before services are restored. + Proposed Value: 1 hour + Critical applications should be operational again within one hour. +________________________________________ +Backup Strategy + Daily Incremental Backups + Capture only changes made since the previous backup. + Advantages: Faster , Less storage usage +________________________________________ +Weekly Full Backup + Create a complete copy of all Block Storage volumes. + Advantages: Faster restoration, Simplified disaster recovery +________________________________________ +Monthly Offline Backup + Store a copy outside the production environment. + Purpose: Protection against ransomware encrypting online backups. +________________________________________ +3-2-1 Backup Rule +The organization should follow the 3-2-1 backup strategy: +• 3 copies of the data (one primary + two backups). +• 2 different storage media (e.g., Block Storage and external storage/object storage). +• 1 off-site or offline backup stored separately from the production environment. +________________________________________ +3. Comprehensive Prevention Plan +Identity & Access Management (IAM) +• Enable Multi-Factor Authentication (MFA). +• Apply the Principle of Least Privilege. +• Review user permissions regularly. +• Rotate passwords and API keys. +________________________________________ +Network Security +• Enable firewalls. +• Segment production and backup networks. +• Restrict remote administration access. +• Use VPN for administrative access. +________________________________________ +Endpoint Security +• Deploy Endpoint Detection and Response (EDR). +• Keep operating systems and software patched. +• Disable unnecessary services. +• Enable application allow-listing where appropriate. +________________________________________ +Backup Protection +• Use immutable backups where possible. +• Encrypt backup data. +• Test backup restoration regularly. +• Store backups in separate locations. +________________________________________ + +Container Security +• Scan container images using Trivy before deployment. +• Avoid running containers as root. +• Store secrets securely. +• Continuously monitor container activity. +________________________________________ +Monitoring & Detection +• Deploy a SIEM solution to centralize logs. +• Configure alerts for: +o Multiple failed logins. +o Unusual file modifications. +o Mass file encryption. +o Privilege escalation attempts. +________________________________________ +Security Awareness +• Train employees to recognize phishing emails. +• Conduct regular security awareness sessions. +• Simulate phishing campaigns. +• Define clear incident reporting procedures. +________________________________________ +Conclusion +A successful ransomware response depends on rapid detection, immediate isolation, reliable backups, and tested recovery procedures. +By implementing layered security controls—including strong IAM, network segmentation, continuous monitoring, secure container practices, and a resilient backup strategy based on the 3-2-1 rule—organizations using Ghaymah Cloud can significantly reduce the impact of ransomware attacks and recover services efficiently.