ghaymah-exam-mahmoud-secops/q5-ransomware-response/prevention-plan.md

Comprehensive Ransomware Prevention Plan

Goal: Eliminate the key attack vectors that allow ransomware to reach and encrypt Ghaymah Block Storage.

---

Prevention Layer 1: Access Control & Authentication

1.1 Eliminate Password-Only Authentication

• Replace SSH passwords with SSH keys for all server access.
• Disable password-based SSH login:

  # /etc/ssh/sshd_config
  PasswordAuthentication no
  PermitRootLogin no
  PubkeyAuthentication yes
  

• Restrict SSH access to a VPN or bastion host only.

1.2 Enforce Multi-Factor Authentication (MFA)

• Require MFA for:
  • Cloud console / Ghaymah dashboard access
  • All admin and privileged user accounts
  • CI/CD pipeline credentials

1.3 Principle of Least Privilege

• Application containers and services should never have Block Storage mount access unless explicitly required.
• Use separate IAM roles: one for read, one for write, none for delete by default.
• Administrative access to cloud resources requires MFA + session time limit.

---

Prevention Layer 2: Endpoint & System Hardening

2.1 Keep Systems Patched

# Automate security updates (Ubuntu/Debian)
sudo apt-get install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

2.2 Restrict Executable Permissions

• Mount Block Storage with noexec flag to prevent direct execution of files from storage:

  # /etc/fstab
  /dev/sdb /mnt/data ext4 defaults,noexec,nosuid 0 2
  

• This means even if a ransomware binary is uploaded to Block Storage, it cannot run directly from there.

2.3 Disable Unused Services

# Disable unnecessary services
sudo systemctl disable --now telnet ftp rpcbind
sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH from known IPs only
sudo ufw allow 443/tcp   # HTTPS

---

Prevention Layer 3: Network Security

3.1 Segment the Network

• Block Storage volumes should only be attached to authorized instances and protected from unauthorized access.
• Use private subnets:

  Public subnet:  Load Balancer, API Gateway
  Private subnet: Application Servers, Block Storage
  Database subnet: PostgreSQL, Redis (no internet access)
  

3.2 Block Lateral Movement

Apply Ghaymah network policies to prevent instances from communicating with each other unless explicitly needed:

# Network policy: deny all east-west traffic by default
# Only allow app-server → database on port 5432
# Only allow app-server → block-storage on mount connection
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-lateral-movement
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              tier: database
      ports:
        - port: 5432

3.3 DNS Filtering & Egress Control

• Implement DNS-based blocking to prevent ransomware C2 (command-and-control) communication.
• Block outbound traffic to known malicious domains using a threat intelligence feed.
• Allow-list only required outbound destinations (e.g., update servers, CDNs).

---

Prevention Layer 4: Email & Social Engineering Defense

Control	Implementation
Email filtering	Block executable attachments (.exe, .bat, .ps1, .vbs)
Link scanning	Scan all URLs in emails before delivery
Phishing simulation	Run quarterly phishing drills with staff
Security awareness training	Train all employees on ransomware recognition
DMARC/SPF/DKIM	Prevent email spoofing using DNS mail security records

---

Prevention Layer 5: Monitoring & Early Detection

5.1 File Integrity Monitoring (FIM)

Monitor Block Storage for unusual file rename patterns:

# Install auditd for file system monitoring
sudo apt-get install auditd -y

# Watch for mass file renames (ransomware signature)
auditctl -w /mnt/data -p wra -k file_modification

# Alert on rename events
ausearch -k file_modification | grep "rename"

5.2 SIEM Alerts (from Q4)

Configure the SIEM (siem.py) to detect early ransomware indicators:

• Sudden spike in Block Storage write IOPS (>1000 writes/minute)
• Mass file extension changes
• New processes accessing large numbers of files in seconds
• Outbound connections to unknown external IPs from storage-tier containers

5.3 Immutable Block Storage Snapshots

Configure snapshots with Object Lock (immutable mode) so they cannot be deleted — even by an admin account — for a defined retention period:

# Example command — replace with actual Ghaymah immutable storage configuration
ghaymah-cli storage bucket set-object-lock \
  --bucket siem-backups \
  --mode COMPLIANCE \
  --retention-days 30

---

Prevention Checklist Summary

Priority	Control	Status
🔴 Critical	SSH key-only authentication	Implement immediately
🔴 Critical	MFA for cloud console	Implement immediately
🔴 Critical	Least-privilege IAM roles	Implement immediately
🟠 High	Automated OS patching	This week
🟠 High	Network segmentation (public/private subnets)	This week
🟠 High	noexec on Block Storage mounts	This week
🟠 High	Immutable backup snapshots	This week
🟡 Medium	DNS filtering / egress control	This month
🟡 Medium	File Integrity Monitoring (FIM)	This month
🟡 Medium	Phishing simulation program	This quarter
🟢 Low	Security awareness training	This quarter