# ghaymah-exam-mahmoud-secops

**Candidate:** Mahmoud  
**Track:** SecOps  
**Platform:** ghaymah.systems  

---

## Repository Structure

```
ghaymah-exam-mahmoud-secops/
├── q1-security-audit/
│   ├── security-checklist.md        # 15-item checklist (Container, Network, OWASP, Data, IAM)
│   └── security-audit.sh            # Bash script: scans ports, SSL, file permissions
├── q2-attack-simulation/
│   ├── incident-response.md         # Full Q2: timeline, IR plan, prevention, alert rules
│   └── alert-rule.yml               # Deployable Prometheus alert rules for brute force detection
├── q3-privacy-assessment/
│   ├── privacy-report.md            # mithal.space assessment: headers, cookies, trackers, comparison
│   └── screenshots/                 # Browser screenshots taken during inspection
│       ├── homepage.png
│       ├── https-certificate.png
│       └── search-results.png
├── q4-siem/
│   ├── siem.py                      # Python log analyzer: auth, nginx, app logs → alerts.json
│   ├── dashboard.html               # Near-real-time alert dashboard (dark theme, no dependencies)
│   ├── deploy-guide.md              # Deployment on Ghaymah Block Storage via systemd
│   └── alerts.json                  # Generated alert output (created at runtime)
├── q5-ransomware-response/
│   ├── emergency-plan.md            # 60-minute ransomware response playbook
│   ├── backup-recovery-strategy.md  # RPO/RTO targets + 3-2-1 rule implementation
│   └── prevention-plan.md           # 5-layer prevention: auth, hardening, network, email, monitoring
├── common-mortakaz/
│   ├── Integration-1.md             # SIEM ↔ Alerting integration
│   └── Integration-2.md             # Backup ↔ Incident Response integration
├── common-qabilah/
│   └── qabilah-profile.txt          # Candidate profile
└── README.md
```

---

## Questions Summary

### Q1 — Security Audit for ghaymah.systems
- 15-item security checklist across 5 domains (Container, Network, OWASP, Data, IAM)
- Bash script that automatically scans: open ports, SSL certificate validity, sensitive file permissions

**Run the audit:**
```bash
chmod +x q1-security-audit/security-audit.sh
./q1-security-audit/security-audit.sh ghaymah.systems 443 .
```

---

### Q2 — Attack Simulation & Incident Response
- **Scenario:** Brute force on `/api/v1/auth/login` → successful login → data exfiltration
- All deliverables consolidated in `incident-response.md`:
  - Timeline: T+00:00 (recon) → T+01:00 (credential found) → T+01:15 (exfiltration) → T+03:00 (detection)
  - 5-phase IR plan: Identification → Containment → Eradication → Recovery → Lessons Learned
  - Prevention: rate limiting, WAF, Kubernetes NetworkPolicy, container hardening, MFA
- `alert-rule.yml`: deployable Prometheus rules detecting brute force and anomalous data exports

---

### Q3 — Privacy Assessment of mithal.space
- Inspected via browser DevTools (Network, Application, Security tabs)
- **Findings:** HTTPS enforced ✅, no cookies ✅, no tracking scripts ✅, HSTS missing ❌
- **Privacy score: 8/10 — Strong**
- Compared to DuckDuckGo and Google Search
- 3 recommended improvements: add HSTS, self-host Google Fonts, tighten CSP (remove `'unsafe-inline'`)

---

### Q4 — Lightweight SIEM Log Analyzer
- `siem.py`: reads `auth.log`, `nginx/access.log`, `app/application.log`; detects SSH brute force, HTTP flooding, SQL injection, JWT abuse, and critical application errors
- Outputs `alerts.json` consumed by the dashboard
- `dashboard.html`: near-real-time dark-mode dashboard (30s refresh) with severity stats, IP threat map, activity feed
- Deployment: systemd service + Ghaymah Block Storage for log persistence + backup strategy

**Run locally (demo mode):**
```bash
cd q4-siem
python3 siem.py        # Generates alerts.json
# Open dashboard.html in browser
```

---

### Q5 — Ransomware Response Plan
- **Scenario:** All Block Storage files encrypted with ransom message
- Emergency plan: detect → isolate → take forensic snapshot → restore from clean backup → communicate
- Backup strategy: RPO=1h, RTO=4h, 3-2-1 rule (live volume + hourly Object Storage backups + offsite weekly)
- Prevention: 5 layers — access control, system hardening, network segmentation, email filtering, integrity monitoring

---

## How to Use This Repository

| Need | File |
|---|---|
| Run an automated security scan | `q1-security-audit/security-audit.sh` |
| Respond to an active API attack | `q2-attack-simulation/incident-response.md` |
| Set up brute-force alerting | `q2-attack-simulation/alert-rule.yml` |
| Review site privacy posture | `q3-privacy-assessment/privacy-report.md` |
| Deploy a SIEM system | `q4-siem/siem.py` + `q4-siem/deploy-guide.md` |
| Respond to ransomware now | `q5-ransomware-response/emergency-plan.md` |
| Set up backup strategy | `q5-ransomware-response/backup-recovery-strategy.md` |