ghaymah-exam-mahmoud-secops/README.md

ghaymah-exam-mahmoud-secops

Candidate: Mahmoud
Track: SecOps
Platform: ghaymah.systems

---

Repository Structure

ghaymah-exam-mahmoud-secops/
├── q1-security-audit/
│   ├── security-checklist.md        # 15-item checklist (Container, Network, OWASP, Data, IAM)
│   └── security-audit.sh            # Bash script: scans ports, SSL, file permissions
├── q2-attack-simulation/
│   ├── incident-response.md         # Full Q2: timeline, IR plan, prevention, alert rules
│   └── alert-rule.yml               # Deployable Prometheus alert rules for brute force detection
├── q3-privacy-assessment/
│   ├── privacy-report.md            # mithal.space assessment: headers, cookies, trackers, comparison
│   └── screenshots/                 # Browser screenshots taken during inspection
│       ├── homepage.png
│       ├── https-certificate.png
│       └── search-results.png
├── q4-siem/
│   ├── siem.py                      # Python log analyzer: auth, nginx, app logs → alerts.json
│   ├── dashboard.html               # Near-real-time alert dashboard (dark theme, no dependencies)
│   ├── deploy-guide.md              # Deployment on Ghaymah Block Storage via systemd
│   └── alerts.json                  # Generated alert output (created at runtime)
├── q5-ransomware-response/
│   ├── emergency-plan.md            # 60-minute ransomware response playbook
│   ├── backup-recovery-strategy.md  # RPO/RTO targets + 3-2-1 rule implementation
│   └── prevention-plan.md           # 5-layer prevention: auth, hardening, network, email, monitoring
├── common-mortakaz/
│   ├── Integration-1.md             # SIEM ↔ Alerting integration
│   └── Integration-2.md             # Backup ↔ Incident Response integration
├── common-qabilah/
│   └── qabilah-profile.txt          # Candidate profile
└── README.md

---

Questions Summary

Q1 — Security Audit for ghaymah.systems

• 15-item security checklist across 5 domains (Container, Network, OWASP, Data, IAM)
• Bash script that automatically scans: open ports, SSL certificate validity, sensitive file permissions

Run the audit:

chmod +x q1-security-audit/security-audit.sh
./q1-security-audit/security-audit.sh ghaymah.systems 443 .

---

Q2 — Attack Simulation & Incident Response

• Scenario: Brute force on /api/v1/auth/login → successful login → data exfiltration
• All deliverables consolidated in incident-response.md:
  • Timeline: T+00:00 (recon) → T+01:00 (credential found) → T+01:15 (exfiltration) → T+03:00 (detection)
  • 5-phase IR plan: Identification → Containment → Eradication → Recovery → Lessons Learned
  • Prevention: rate limiting, WAF, Kubernetes NetworkPolicy, container hardening, MFA
• alert-rule.yml: deployable Prometheus rules detecting brute force and anomalous data exports

---

Q3 — Privacy Assessment of mithal.space

• Inspected via browser DevTools (Network, Application, Security tabs)
• Findings: HTTPS enforced ✅, no cookies ✅, no tracking scripts ✅, HSTS missing ❌
• Privacy score: 8/10 — Strong
• Compared to DuckDuckGo and Google Search
• 3 recommended improvements: add HSTS, self-host Google Fonts, tighten CSP (remove 'unsafe-inline')

---

Q4 — Lightweight SIEM Log Analyzer

• siem.py: reads auth.log, nginx/access.log, app/application.log; detects SSH brute force, HTTP flooding, SQL injection, JWT abuse, and critical application errors
• Outputs alerts.json consumed by the dashboard
• dashboard.html: near-real-time dark-mode dashboard (30s refresh) with severity stats, IP threat map, activity feed
• Deployment: systemd service + Ghaymah Block Storage for log persistence + backup strategy

Run locally (demo mode):

cd q4-siem
python3 siem.py        # Generates alerts.json
# Open dashboard.html in browser

---

Q5 — Ransomware Response Plan

• Scenario: All Block Storage files encrypted with ransom message
• Emergency plan: detect → isolate → take forensic snapshot → restore from clean backup → communicate
• Backup strategy: RPO=1h, RTO=4h, 3-2-1 rule (live volume + hourly Object Storage backups + offsite weekly)
• Prevention: 5 layers — access control, system hardening, network segmentation, email filtering, integrity monitoring

---

How to Use This Repository

Need	File
Run an automated security scan	q1-security-audit/security-audit.sh
Respond to an active API attack	q2-attack-simulation/incident-response.md
Set up brute-force alerting	q2-attack-simulation/alert-rule.yml
Review site privacy posture	q3-privacy-assessment/privacy-report.md
Deploy a SIEM system	q4-siem/siem.py + q4-siem/deploy-guide.md
Respond to ransomware now	q5-ransomware-response/emergency-plan.md
Set up backup strategy	q5-ransomware-response/backup-recovery-strategy.md