Second Modification

2026-07-28 12:32:40 +03:00
parent 5e1dc7b2dd
commit d2dbeaf675
14 changed files with 585 additions and 0 deletions
@@ -0,0 +1,23 @@
 Product 1: Jadal + Ghaymah Systems
 Integration Proposal: Jadal + Ghaymah Systems
 Product Description
 Jadal is a cloud-based sports court management platform that helps sports facility owners manage court reservations, memberships, customer information, payments, scheduling, and daily operations through a centralized dashboard. It simplifies facility management while providing customers with a smooth online booking experience.
 Integration with Ghaymah Systems
 Jadal can use Ghaymah Systems as its cloud infrastructure platform to improve scalability, reliability, and security.
 The proposed integration includes:
 •	Hosting Jadal's backend services on Ghaymah Compute. 
 •	Using Ghaymah Block Storage for reservation records, invoices, and uploaded documents. 
 •	Running automated backups using Ghaymah Backup. 
 •	Monitoring servers and application performance. 
 •	Scaling computing resources automatically during periods of high booking activity. 
 •	Protecting customer data through secure cloud infrastructure. 
 Integrating Jadal with Ghaymah Systems provides several advantages:
 •	Faster booking experience. 
 •	High system availability during peak hours. 
 •	Secure storage of reservation and payment information. 
 •	Automatic backups to reduce the risk of data loss. 
 •	Better scalability as the number of sports facilities and customers grows. 
 This results in a more reliable and secure platform for both facility owners and customers.
@@ -0,0 +1,25 @@
 Circle Panel + Ghaymah Systems
 Product Description
 Circle Panel is an AI-native user research platform that helps organizations plan and manage user research projects. It allows teams to recruit participants, schedule interviews, collect user feedback, generate live transcripts, and produce AI-powered insights and reports from research sessions.
 Proposed Integration with Ghaymah Systems
 Circle Panel can use Ghaymah Systems as its cloud infrastructure provider.
 Integration Components
 •	Ghaymah Kubernetes to host backend services. 
 •	Ghaymah Object Storage for interview recordings and transcripts. 
 •	Ghaymah Block Storage for databases. 
 •	Ghaymah Load Balancer for high availability. 
 •	Ghaymah IAM for user authentication and access control. 
 •	Ghaymah Backup Service for disaster recovery. 
 The application will upload recordings directly to Ghaymah Storage while AI services analyze transcripts and generate reports.
 The integration provides several benefits:
 •	Faster response time through scalable cloud infrastructure. 
 •	Secure storage of sensitive interview recordings. 
 •	Automatic backup and disaster recovery. 
 •	High availability during large research projects. 
 •	Lower operational costs due to elastic cloud resources. 
 Organizations can focus on research without worrying about infrastructure management.
@@ -0,0 +1,101 @@
 Task1:
 1. Introduction
 1.1 Objective
 The objective of this security audit is to assess the security posture of an application deployed on the Ghaymah Cloud platform. The audit focuses on five key security domains:
 •	Container Security 
 •	Network Security 
 •	OWASP Top 5 
 •	Data Security 
 •	Identity and Access Management (IAM) 
 The goal is to identify potential security weaknesses and recommend best practices to reduce security risk.
 2. Security Audit Checklist
 A. Container Security
 1. Scan Container Images for Vulnerabilities
 	All Docker images should be scanned before deployment as old packages may contain 	known CVEs.
 How to apply on Ghaymah
 Before deploying the image to Ghaymah:
 •	Scan image using Trivy. 
 •	Fix High and Critical vulnerabilities. 
 •	Only deploy clean image
 2. Run Containers as Non-root
 	Containers should never run with root privileges as if an attacker escapes the 	application, they will gain root access inside the container
 3. Store Secrets Securely
 	Never hardcode passwords or API keys inside the Docker image.
 How to apply on Ghaymah
 Use:
 •	Environment Variables 
 •	Secret Management 
 •	Encrypted configuration
 ________________________________________
 B. Network Security
 4. Allow Only Required Ports
 	Expose only necessary ports by Configuring Security Groups / Firewall Rules
 5. Enforce HTTPS
 	All traffic must use HTTPS since it protects credentials and user data.
 How to apply it:
 	We can install an SSL certificate and redirect HTTP → HTTPS
 6. Restrict Internal Network Communication	
 	Database should never be publicly accessible we will accomplish this by Network Policies 	concept to isolate workloads.
 ________________________________________
 C. OWASP Top 5
 7. Prevent Broken Access Control
 	Users should only access authorized resources by Role-Based Access Control (RBAC).
 8. Prevent Injection
 	Use parameterized queries
 9. Encrypt Sensitive Data
 	Passwords
 	       ↓
 	Hash using bcrypt
 	Sensitive files
 	       ↓
         AES Encryption
 	   HTTPS
 	      ↓
 	     TLS
 10. Secure Configuration
 	Disable
 •	Debug Mode 
 •	Default Passwords 
 •	Directory Listing 
 	And update configuration regularly
 11. Keep Components Updated
 Always update:
 •	Docker Images 
 •	Libraries 
 •	Operating System 
 Use Trivy to detect outdated packages.
 ________________________________________
 D. Data Security
 12. Encrypt Data at Rest
 	All stored data should be encrypted.
 E.G.
 •	Block Storage 
 •	Database 
 •	Backups 
 13. Backup Critical Data
 Implement automatic backups.
 •	Daily Backup
 •	Weekly Full Backup
 •	Off-site Backup
 ________________________________________
 E. Identity & Access Management
 14. Enable Multi-Factor Authentication (MFA)
 Administrators should authenticate using
 •	Password 
 •	OTP / Authenticator App 
 ________________________________________
 15. Apply Least Privilege Principle
 Every user receives only the permissions they actually need.
@@ -0,0 +1,140 @@
 Task2:
 Attack Scenario
 An attacker successfully performed a brute-force attack against the application's login API hosted on Ghaymah Cloud. 
 After compromising a valid user account, the attacker accessed sensitive customer data and exfiltrated part of the database.
 ________________________________________
 Attack Flow
 Internet
     ↓
 Recon
     ↓
 API Discovery
     ↓
 Brute Force
     ↓
 Successful Login
     ↓
 Data Access
     ↓
 Data Exfiltration
     ↓
 Cleanup
 ________________________________________
 Root Cause Analysis
 The attack succeeded because:
 •	No Rate Limiting on the login endpoint. 
 •	Weak user password. 
 •	No Multi-Factor Authentication (MFA). 
 •	Insufficient monitoring of repeated failed logins. 
 •	Missing Web Application Firewall (WAF) protections. 
 2. Incident Response Plan
 Phase 1 – Identification
 Objectives:
 •	Confirm the brute-force attack. 
 •	Identify affected user accounts. 
 •	Determine compromised resources. 
 •	Preserve forensic evidence. 
 Actions:
 •	Review application logs. 
 •	Analyze firewall logs. 
 •	Check authentication logs. 
 •	Identify suspicious IP addresses. 
 ________________________________________
 Phase 2 – Containment
 Immediate actions:
 •	Disable compromised accounts. 
 •	Block malicious IP addresses. 
 •	Enable emergency rate limiting. 
 •	Rotate exposed API tokens. 
 •	Isolate affected application containers if necessary. 
 ________________________________________
 Phase 3 – Eradication
 Remove the root cause.
 Tasks:
 •	Force password reset. 
 •	Patch authentication vulnerabilities. 
 •	Remove malicious scripts. 
 •	Update security configurations. 
 •	Scan containers using Trivy. 
 ________________________________________
 Phase 4 – Recovery
 Actions:
 •	Restore clean services. 
 •	Monitor user authentication. 
 •	Validate system integrity. 
 •	Notify affected customers. 
 •	Resume production gradually. 
 ________________________________________
 Phase 5 – Lessons Learned
 Conduct a post-incident review.
 Questions:
 •	Why did monitoring fail? 
 •	Why wasn't MFA enabled? 
 •	Why were brute-force attempts not detected? 
 •	Which controls should be added? 
 ________________________________________
 3. Preventing the Attack on Ghaymah Cloud
 	Network Security Controls
 		API Rate Limiting
 		E.G. Maximum 5 login attempts per minute/per IP
 	Web Application Firewall (WAF)
 		Configure rules to:
 •	Detect brute-force attacks. 
 •	Block suspicious IP addresses. 
 •	Prevent SQL Injection. 
 •	Prevent XSS. 
 	Firewall Rules
 		Only expose   =>  HTTPS (443) 
 		Restrict:
 •	SSH 
 •	Database ports 
 •	Internal services 
 	Network Segmentation
 		Application
 		       ↓
 	           Private Network
 		       ↓
 		Database
 		The database should never be directly accessible from the Internet.
 	Container Security Controls
 •	Scan every Docker image before deployment. 
 •	Run containers as non-root users. 
 •	Store secrets securely. 
 •	Use read-only file systems when possible. 
 •	Apply least privilege to Kubernetes service accounts. 
 •	Continuously monitor container runtime activity. 
 ________________________________________
 4. Alert Rule for Early Detection
 	Detection Logic
 		Trigger an alert if:
 			More than 10 failed logins from the same IP within 60 seconds.
 ________________________________________
 Additional Detection Rules
 Alert when:
 •	Login attempts originate from multiple countries in a short time. 
 •	One account receives failed logins from multiple IPs. 
 •	Sudden spike in authentication failures. 
 •	API requests exceed expected thresholds. 
 ________________________________________
 Recommendations
 •	Enable MFA for all users. 
 •	Implement account lockout after repeated failures. 
 •	Deploy a Web Application Firewall. 
 •	Use centralized logging with SIEM. 
 •	Perform continuous container vulnerability scanning. 
 •	Conduct regular penetration testing. 
@@ -0,0 +1,78 @@
 Task3:
 Executive Summary
 This report evaluates the privacy posture of mithal.space by analyzing cookies, HTTPS implementation, third-party resources, and security-related behaviors using browser developer tools.
 Overall, the website demonstrates good privacy practices by using HTTPS and showing minimal evidence of third-party tracking. However, the use of external Google resources introduces limited third-party interactions.
 ________________________________________
 Cookies Analysis
 Findings
 	The inspection of mithal.space revealed no first-party cookies stored by the website.
 	No session cookies, authentication cookies, or tracking cookies belonging to the website 	were 	observed.
 	The only cookies visible in the browser belonged to external Google services and were 	
 	unrelated to mithal.space.
 Privacy Impact
 	This indicates that the website minimizes client-side tracking and does not rely on cookies for 	basic browsing functionality.
 Risk Level:   Very Low
 HTTPS Analysis
 Findings
 	The website uses HTTPS successfully.
 Benefits:
 •	Encrypts user traffic. 
 •	Prevents eavesdropping. 
 •	Protects search requests. 
 •	Ensures data integrity. 
 Risk Level: Very Low
 ________________________________________
 Security Headers
 From the inspection: HTTPS is enabled.
 Recommendation:
 	Enable all modern security headers if any are missing.
 ________________________________________
 Third-Party Resources
 	The website loads Google Fonts.
 No clear evidence of:
 •	Google Analytics 
 •	Facebook Pixel 
 •	DoubleClick 
 	was observed during the inspection.
 Privacy Impact: Low
 ________________________________________
 Privacy Rating
 Category	Rating
 HTTPS	Excellent
 Cookies	Good
 Third-party Tracking	Good
 User Privacy	Good
 Overall	8.5 / 10
 ________________________________________
 Security Improvements
 1. Add Strict Security Headers
 Implement:
 •	Content-Security-Policy 
 •	HSTS 
 •	Referrer-Policy 
 •	X-Content-Type-Options 
 2. Self-host Fonts
 Instead of loading Google Fonts,
 host fonts locally.
 Benefits
 •	Better privacy 
 •	Faster loading 
 •	No third-party requests 
 3. Publish Privacy Policy
 Provide transparency regarding:
 •	Cookies 
 •	Data Collection 
 •	Third-party services 
 •	Data Retention 
 ________________________________________
 Conclusion
 	Based on the inspection, mithal.space demonstrates a generally privacy-friendly 	configuration. HTTPS is correctly implemented, and no obvious tracking frameworks 	were detected during the inspection. The primary opportunity for improvement is 	reducing reliance on third-party services (such as externally hosted fonts) and 	strengthening HTTP security headers.
@@ -0,0 +1,81 @@
 Task4:
 1. Python Script to Collect and Analyze Logs
 Objective
 Develop a simple SIEM (Security Information and Event Management) system that collects logs from three different sources, analyzes them, and detects suspicious activities.
 Log Sources
 The SIEM collects logs from the following sources:
 1.	System Logs (system.log) 
 •	Login attempts 
 •	User authentication 
 •	System events 
 2.	Web Server Logs (nginx.log) 
 •	HTTP requests 
 •	Status codes 
 •	Client IP addresses 
 3.	Application Logs (application.log) 
 •	Authentication failures 
 •	SQL Injection attempts 
 •	Application errors 
 Detection Rules
 The Python script should detect the following suspicious activities:
 Event	Severity
 Multiple failed login attempts	Medium
 SQL Injection attempts	High
 Cross-Site Scripting (XSS) attempts	High
 Port scanning	High
 Large number of HTTP 404 errors	Medium
 Root login attempts	Critical
 Detection Process
 	Read Log Files
        	          ↓
 	Parse Log Entries
        	          ↓
 	Match Detection Rules
        	          ↓
 	Generate Security Alerts
        	          ↓
 	Store Alerts in alerts.json
 E.G.
 •	More than 10 failed logins from the same IP within one minute → Generate a Medium Alert 
 •	Detection of SQL Injection → Generate a Critical Alert 
 ________________________________________
 2. SIEM Dashboard Design
 	The dashboard provides a visual overview of security events.
 Dashboard Components
 •	Total number of alerts 
 •	Alert severity statistics 
 •	Top suspicious IP addresses 
 •	Recent security events 
 •	Alert history 
 ________________________________________
 3. Deploying the SIEM on Ghaymah Cloud
 Deployment Architecture
 Log Sources       
 	Python SIEM Engine   =>   Block Storage   =>   alerts.json   =>   Web Dashboard
 Deployment Steps
 1.	Create a Virtual Machine on Ghaymah Cloud. 
 2.	Install Python and Docker. 
 3.	Upload the SIEM project. 
 4.	Mount Ghaymah Block Storage to store log files permanently. 
 5.	Run the Python monitoring script. 
 6.	Deploy the dashboard using Nginx. 
 7.	Access the dashboard through a web browser. 
 Why Use Block Storage?
 Using Ghaymah Block Storage provides:
 •	Persistent storage 
 •	Reliable log retention 
 •	Easy backup and recovery 
 •	Scalability for large log files 
 Future Improvements
 •	Integrate Elasticsearch for log indexing. 
 •	Use Grafana or Kibana for advanced visualization. 
 •	Send alerts through email or Slack. 
 •	Deploy the SIEM inside Kubernetes. 
 •	Add machine learning for anomaly detection.
@@ -0,0 +1,137 @@
 Task5:
 Scenario
 	A ransomware attack has encrypted all files stored on Ghaymah Block Storage.
 	Users can no longer access their files, and the attacker demands payment in exchange 	for the 	decryption key.
 ________________________________________
 1. Emergency Response Plan (First 60 Minutes)
 	0–15 Minutes: Identification & Isolation
 	Objectives
 •	Confirm that a ransomware attack has occurred. 
 •	Prevent the malware from spreading. 
 	Actions
 •	Disconnect affected virtual machines from the network. 
 •	Disable access to shared Block Storage volumes. 
 •	Block suspicious IP addresses using firewall rules. 
 •	Stop scheduled synchronization tasks. 
 •	Notify the security and incident response teams. 
 	15–30 Minutes: Investigation
 	Objectives
 	Determine the scope of the attack. 
 	Actions
 •	Review system and application logs. 
 •	Identify the ransomware entry point. 
 •	Determine which servers and storage volumes are affected. 
 •	Preserve logs and forensic evidence. 
 •	Check whether backups are intact. 
 	30–45 Minutes: Containment & Eradication
 	Objectives
 	Remove the ransomware and stop further encryption. 
 	Actions
 •	Isolate infected systems. 
 •	Scan all virtual machines with antivirus/EDR tools. 
 •	Remove malicious processes and scheduled tasks. 
 •	Rotate compromised credentials. 
 •	Patch exploited vulnerabilities. 
 	45–60 Minutes: Recovery Preparation
 	Objectives
 	Prepare for service restoration. 
 	Actions
 •	Verify the integrity of backups. 
 •	Restore critical services in a test environment.  
 •	Validate restored data.  
 •	Monitor systems for reinfection. 
 Gradually return services to production. 
 Timeline Summary
 Time	Activity
 0–15 min	Detect attack and isolate affected systems
 15–30 min	Investigate logs and identify affected resources
 30–45 min	Remove ransomware and secure infrastructure
 45–60 min	Restore from backups and validate services
 ________________________________________
 2. Ghaymah Backup & Recovery Strategy
 Recovery Point Objective (RPO)
 	Definition: The maximum acceptable amount of data loss.
 	Proposed Value: 15 minutes
 	This means backups or snapshots should occur at least every 15 minutes for critical data.
 ________________________________________
 Recovery Time Objective (RTO)
 	Definition: The maximum acceptable downtime before services are restored.
 	Proposed Value: 1 hour
 	Critical applications should be operational again within one hour.
 ________________________________________
 Backup Strategy
 	Daily Incremental Backups
 	Capture only changes made since the previous backup.
 	Advantages:  Faster , Less storage usage 
 ________________________________________
 Weekly Full Backup
 	Create a complete copy of all Block Storage volumes.
 	Advantages:  Faster restoration, Simplified disaster recovery 
 ________________________________________
 Monthly Offline Backup
 	Store a copy outside the production environment.
 	Purpose: Protection against ransomware encrypting online backups. 
 ________________________________________
 3-2-1 Backup Rule
 The organization should follow the 3-2-1 backup strategy:
 •	3 copies of the data (one primary + two backups). 
 •	2 different storage media (e.g., Block Storage and external storage/object storage). 
 •	1 off-site or offline backup stored separately from the production environment. 
 ________________________________________
 3. Comprehensive Prevention Plan
 Identity & Access Management (IAM)
 •	Enable Multi-Factor Authentication (MFA). 
 •	Apply the Principle of Least Privilege. 
 •	Review user permissions regularly. 
 •	Rotate passwords and API keys. 
 ________________________________________
 Network Security
 •	Enable firewalls. 
 •	Segment production and backup networks. 
 •	Restrict remote administration access. 
 •	Use VPN for administrative access. 
 ________________________________________
 Endpoint Security
 •	Deploy Endpoint Detection and Response (EDR). 
 •	Keep operating systems and software patched. 
 •	Disable unnecessary services. 
 •	Enable application allow-listing where appropriate. 
 ________________________________________
 Backup Protection
 •	Use immutable backups where possible. 
 •	Encrypt backup data. 
 •	Test backup restoration regularly. 
 •	Store backups in separate locations. 
 ________________________________________
 Container Security
 •	Scan container images using Trivy before deployment. 
 •	Avoid running containers as root. 
 •	Store secrets securely. 
 •	Continuously monitor container activity. 
 ________________________________________
 Monitoring & Detection
 •	Deploy a SIEM solution to centralize logs. 
 •	Configure alerts for: 
 o	Multiple failed logins. 
 o	Unusual file modifications. 
 o	Mass file encryption. 
 o	Privilege escalation attempts. 
 ________________________________________
 Security Awareness
 •	Train employees to recognize phishing emails. 
 •	Conduct regular security awareness sessions. 
 •	Simulate phishing campaigns. 
 •	Define clear incident reporting procedures. 
 ________________________________________
 Conclusion
 A successful ransomware response depends on rapid detection, immediate isolation, reliable backups, and tested recovery procedures. 
 By implementing layered security controls—including strong IAM, network segmentation, continuous monitoring, secure container practices, and a resilient backup strategy based on the 3-2-1 rule—organizations using Ghaymah Cloud can significantly reduce the impact of ransomware attacks and recover services efficiently.