added

q5-ransomware-response/prevention-plan.md

@@ -0,0 +1,167 @@
+# Comprehensive Ransomware Prevention Plan
+
+> Goal: Eliminate the key attack vectors that allow ransomware to reach and encrypt Ghaymah Block Storage.
+
+---
+
+## Prevention Layer 1: Access Control & Authentication
+
+### 1.1 Eliminate Password-Only Authentication
+- **Replace SSH passwords with SSH keys** for all server access.
+- Disable password-based SSH login:
+  ```bash
+  # /etc/ssh/sshd_config
+  PasswordAuthentication no
+  PermitRootLogin no
+  PubkeyAuthentication yes
+  ```
+- Restrict SSH access to a VPN or bastion host only.
+
+### 1.2 Enforce Multi-Factor Authentication (MFA)
+- Require MFA for:
+  - Cloud console / Ghaymah dashboard access
+  - All admin and privileged user accounts
+  - CI/CD pipeline credentials
+
+### 1.3 Principle of Least Privilege
+- Application containers and services should **never** have Block Storage mount access unless explicitly required.
+- Use separate IAM roles: one for read, one for write, none for delete by default.
+- Administrative access to cloud resources requires MFA + session time limit.
+
+---
+
+## Prevention Layer 2: Endpoint & System Hardening
+
+### 2.1 Keep Systems Patched
+```bash
+# Automate security updates (Ubuntu/Debian)
+sudo apt-get install unattended-upgrades -y
+sudo dpkg-reconfigure --priority=low unattended-upgrades
+```
+
+### 2.2 Restrict Executable Permissions
+- Mount Block Storage with `noexec` flag to prevent direct execution of files from storage:
+  ```bash
+  # /etc/fstab
+  /dev/sdb /mnt/data ext4 defaults,noexec,nosuid 0 2
+  ```
+- This means even if a ransomware binary is uploaded to Block Storage, it cannot run directly from there.
+
+### 2.3 Disable Unused Services
+```bash
+# Disable unnecessary services
+sudo systemctl disable --now telnet ftp rpcbind
+sudo ufw enable
+sudo ufw default deny incoming
+sudo ufw default allow outgoing
+sudo ufw allow 22/tcp    # SSH from known IPs only
+sudo ufw allow 443/tcp   # HTTPS
+```
+
+---
+
+## Prevention Layer 3: Network Security
+
+### 3.1 Segment the Network
+- Block Storage volumes should only be attached to authorized instances and protected from unauthorized access.
+- Use private subnets:
+  ```
+  Public subnet:  Load Balancer, API Gateway
+  Private subnet: Application Servers, Block Storage
+  Database subnet: PostgreSQL, Redis (no internet access)
+  ```
+
+### 3.2 Block Lateral Movement
+Apply Ghaymah network policies to prevent instances from communicating with each other unless explicitly needed:
+
+```yaml
+# Network policy: deny all east-west traffic by default
+# Only allow app-server → database on port 5432
+# Only allow app-server → block-storage on mount connection
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: deny-lateral-movement
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              tier: database
+      ports:
+        - port: 5432
+```
+
+### 3.3 DNS Filtering & Egress Control
+- Implement DNS-based blocking to prevent ransomware C2 (command-and-control) communication.
+- Block outbound traffic to known malicious domains using a threat intelligence feed.
+- Allow-list only required outbound destinations (e.g., update servers, CDNs).
+
+---
+
+## Prevention Layer 4: Email & Social Engineering Defense
+
+| Control | Implementation |
+|---|---|
+| Email filtering | Block executable attachments (.exe, .bat, .ps1, .vbs) |
+| Link scanning | Scan all URLs in emails before delivery |
+| Phishing simulation | Run quarterly phishing drills with staff |
+| Security awareness training | Train all employees on ransomware recognition |
+| DMARC/SPF/DKIM | Prevent email spoofing using DNS mail security records |
+
+---
+
+## Prevention Layer 5: Monitoring & Early Detection
+
+### 5.1 File Integrity Monitoring (FIM)
+Monitor Block Storage for unusual file rename patterns:
+
+```bash
+# Install auditd for file system monitoring
+sudo apt-get install auditd -y
+
+# Watch for mass file renames (ransomware signature)
+auditctl -w /mnt/data -p wra -k file_modification
+
+# Alert on rename events
+ausearch -k file_modification | grep "rename"
+```
+
+### 5.2 SIEM Alerts (from Q4)
+Configure the SIEM (`siem.py`) to detect early ransomware indicators:
+- Sudden spike in Block Storage write IOPS (>1000 writes/minute)
+- Mass file extension changes
+- New processes accessing large numbers of files in seconds
+- Outbound connections to unknown external IPs from storage-tier containers
+
+### 5.3 Immutable Block Storage Snapshots
+Configure snapshots with **Object Lock** (immutable mode) so they cannot be deleted — even by an admin account — for a defined retention period:
+```bash
+# Example command — replace with actual Ghaymah immutable storage configuration
+ghaymah-cli storage bucket set-object-lock \
+  --bucket siem-backups \
+  --mode COMPLIANCE \
+  --retention-days 30
+```
+
+---
+
+## Prevention Checklist Summary
+
+| Priority | Control | Status |
+|---|---|---|
+| 🔴 Critical | SSH key-only authentication | Implement immediately |
+| 🔴 Critical | MFA for cloud console | Implement immediately |
+| 🔴 Critical | Least-privilege IAM roles | Implement immediately |
+| 🟠 High | Automated OS patching | This week |
+| 🟠 High | Network segmentation (public/private subnets) | This week |
+| 🟠 High | `noexec` on Block Storage mounts | This week |
+| 🟠 High | Immutable backup snapshots | This week |
+| 🟡 Medium | DNS filtering / egress control | This month |
+| 🟡 Medium | File Integrity Monitoring (FIM) | This month |
+| 🟡 Medium | Phishing simulation program | This quarter |
+| 🟢 Low | Security awareness training | This quarter |