added

README.md

@@ -1 +1,110 @@
-# ghaymah-exam-mahmoud-secops
+# ghaymah-exam-mahmoud-secops
+
+**Candidate:** Mahmoud  
+**Track:** SecOps  
+**Platform:** ghaymah.systems  
+
+---
+
+## Repository Structure
+
+```
+ghaymah-exam-mahmoud-secops/
+├── q1-security-audit/
+│   ├── security-checklist.md        # 15-item checklist (Container, Network, OWASP, Data, IAM)
+│   └── security-audit.sh            # Bash script: scans ports, SSL, file permissions
+├── q2-attack-simulation/
+│   ├── incident-response.md         # Full Q2: timeline, IR plan, prevention, alert rules
+│   └── alert-rule.yml               # Deployable Prometheus alert rules for brute force detection
+├── q3-privacy-assessment/
+│   ├── privacy-report.md            # mithal.space assessment: headers, cookies, trackers, comparison
+│   └── screenshots/                 # Browser screenshots taken during inspection
+│       ├── homepage.png
+│       ├── https-certificate.png
+│       └── search-results.png
+├── q4-siem/
+│   ├── siem.py                      # Python log analyzer: auth, nginx, app logs → alerts.json
+│   ├── dashboard.html               # Near-real-time alert dashboard (dark theme, no dependencies)
+│   ├── deploy-guide.md              # Deployment on Ghaymah Block Storage via systemd
+│   └── alerts.json                  # Generated alert output (created at runtime)
+├── q5-ransomware-response/
+│   ├── emergency-plan.md            # 60-minute ransomware response playbook
+│   ├── backup-recovery-strategy.md  # RPO/RTO targets + 3-2-1 rule implementation
+│   └── prevention-plan.md           # 5-layer prevention: auth, hardening, network, email, monitoring
+├── common-mortakaz/
+│   ├── Integration-1.md             # SIEM ↔ Alerting integration
+│   └── Integration-2.md             # Backup ↔ Incident Response integration
+├── common-qabilah/
+│   └── qabilah-profile.txt          # Candidate profile
+└── README.md
+```
+
+---
+
+## Questions Summary
+
+### Q1 — Security Audit for ghaymah.systems
+- 15-item security checklist across 5 domains (Container, Network, OWASP, Data, IAM)
+- Bash script that automatically scans: open ports, SSL certificate validity, sensitive file permissions
+
+**Run the audit:**
+```bash
+chmod +x q1-security-audit/security-audit.sh
+./q1-security-audit/security-audit.sh ghaymah.systems 443 .
+```
+
+---
+
+### Q2 — Attack Simulation & Incident Response
+- **Scenario:** Brute force on `/api/v1/auth/login` → successful login → data exfiltration
+- All deliverables consolidated in `incident-response.md`:
+  - Timeline: T+00:00 (recon) → T+01:00 (credential found) → T+01:15 (exfiltration) → T+03:00 (detection)
+  - 5-phase IR plan: Identification → Containment → Eradication → Recovery → Lessons Learned
+  - Prevention: rate limiting, WAF, Kubernetes NetworkPolicy, container hardening, MFA
+- `alert-rule.yml`: deployable Prometheus rules detecting brute force and anomalous data exports
+
+---
+
+### Q3 — Privacy Assessment of mithal.space
+- Inspected via browser DevTools (Network, Application, Security tabs)
+- **Findings:** HTTPS enforced ✅, no cookies ✅, no tracking scripts ✅, HSTS missing ❌
+- **Privacy score: 8/10 — Strong**
+- Compared to DuckDuckGo and Google Search
+- 3 recommended improvements: add HSTS, self-host Google Fonts, tighten CSP (remove `'unsafe-inline'`)
+
+---
+
+### Q4 — Lightweight SIEM Log Analyzer
+- `siem.py`: reads `auth.log`, `nginx/access.log`, `app/application.log`; detects SSH brute force, HTTP flooding, SQL injection, JWT abuse, and critical application errors
+- Outputs `alerts.json` consumed by the dashboard
+- `dashboard.html`: near-real-time dark-mode dashboard (30s refresh) with severity stats, IP threat map, activity feed
+- Deployment: systemd service + Ghaymah Block Storage for log persistence + backup strategy
+
+**Run locally (demo mode):**
+```bash
+cd q4-siem
+python3 siem.py        # Generates alerts.json
+# Open dashboard.html in browser
+```
+
+---
+
+### Q5 — Ransomware Response Plan
+- **Scenario:** All Block Storage files encrypted with ransom message
+- Emergency plan: detect → isolate → take forensic snapshot → restore from clean backup → communicate
+- Backup strategy: RPO=1h, RTO=4h, 3-2-1 rule (live volume + hourly Object Storage backups + offsite weekly)
+- Prevention: 5 layers — access control, system hardening, network segmentation, email filtering, integrity monitoring
+
+---
+
+## How to Use This Repository
+
+| Need | File |
+|---|---|
+| Run an automated security scan | `q1-security-audit/security-audit.sh` |
+| Respond to an active API attack | `q2-attack-simulation/incident-response.md` |
+| Set up brute-force alerting | `q2-attack-simulation/alert-rule.yml` |
+| Review site privacy posture | `q3-privacy-assessment/privacy-report.md` |
+| Deploy a SIEM system | `q4-siem/siem.py` + `q4-siem/deploy-guide.md` |
+| Respond to ransomware now | `q5-ransomware-response/emergency-plan.md` |
+| Set up backup strategy | `q5-ransomware-response/backup-recovery-strategy.md` |