ghaymah-exam-mahmoud-secops/q5-ransomware-response/prevention-plan.md

# Comprehensive Ransomware Prevention Plan

> Goal: Eliminate the key attack vectors that allow ransomware to reach and encrypt Ghaymah Block Storage.

---

## Prevention Layer 1: Access Control & Authentication

### 1.1 Eliminate Password-Only Authentication
- **Replace SSH passwords with SSH keys** for all server access.
- Disable password-based SSH login:
  ```bash
  # /etc/ssh/sshd_config
  PasswordAuthentication no
  PermitRootLogin no
  PubkeyAuthentication yes
  ```
- Restrict SSH access to a VPN or bastion host only.

### 1.2 Enforce Multi-Factor Authentication (MFA)
- Require MFA for:
  - Cloud console / Ghaymah dashboard access
  - All admin and privileged user accounts
  - CI/CD pipeline credentials

### 1.3 Principle of Least Privilege
- Application containers and services should **never** have Block Storage mount access unless explicitly required.
- Use separate IAM roles: one for read, one for write, none for delete by default.
- Administrative access to cloud resources requires MFA + session time limit.

---

## Prevention Layer 2: Endpoint & System Hardening

### 2.1 Keep Systems Patched
```bash
# Automate security updates (Ubuntu/Debian)
sudo apt-get install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
```

### 2.2 Restrict Executable Permissions
- Mount Block Storage with `noexec` flag to prevent direct execution of files from storage:
  ```bash
  # /etc/fstab
  /dev/sdb /mnt/data ext4 defaults,noexec,nosuid 0 2
  ```
- This means even if a ransomware binary is uploaded to Block Storage, it cannot run directly from there.

### 2.3 Disable Unused Services
```bash
# Disable unnecessary services
sudo systemctl disable --now telnet ftp rpcbind
sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH from known IPs only
sudo ufw allow 443/tcp   # HTTPS
```

---

## Prevention Layer 3: Network Security

### 3.1 Segment the Network
- Block Storage volumes should only be attached to authorized instances and protected from unauthorized access.
- Use private subnets:
  ```
  Public subnet:  Load Balancer, API Gateway
  Private subnet: Application Servers, Block Storage
  Database subnet: PostgreSQL, Redis (no internet access)
  ```

### 3.2 Block Lateral Movement
Apply Ghaymah network policies to prevent instances from communicating with each other unless explicitly needed:

```yaml
# Network policy: deny all east-west traffic by default
# Only allow app-server → database on port 5432
# Only allow app-server → block-storage on mount connection
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-lateral-movement
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              tier: database
      ports:
        - port: 5432
```

### 3.3 DNS Filtering & Egress Control
- Implement DNS-based blocking to prevent ransomware C2 (command-and-control) communication.
- Block outbound traffic to known malicious domains using a threat intelligence feed.
- Allow-list only required outbound destinations (e.g., update servers, CDNs).

---

## Prevention Layer 4: Email & Social Engineering Defense

| Control | Implementation |
|---|---|
| Email filtering | Block executable attachments (.exe, .bat, .ps1, .vbs) |
| Link scanning | Scan all URLs in emails before delivery |
| Phishing simulation | Run quarterly phishing drills with staff |
| Security awareness training | Train all employees on ransomware recognition |
| DMARC/SPF/DKIM | Prevent email spoofing using DNS mail security records |

---

## Prevention Layer 5: Monitoring & Early Detection

### 5.1 File Integrity Monitoring (FIM)
Monitor Block Storage for unusual file rename patterns:

```bash
# Install auditd for file system monitoring
sudo apt-get install auditd -y

# Watch for mass file renames (ransomware signature)
auditctl -w /mnt/data -p wra -k file_modification

# Alert on rename events
ausearch -k file_modification | grep "rename"
```

### 5.2 SIEM Alerts (from Q4)
Configure the SIEM (`siem.py`) to detect early ransomware indicators:
- Sudden spike in Block Storage write IOPS (>1000 writes/minute)
- Mass file extension changes
- New processes accessing large numbers of files in seconds
- Outbound connections to unknown external IPs from storage-tier containers

### 5.3 Immutable Block Storage Snapshots
Configure snapshots with **Object Lock** (immutable mode) so they cannot be deleted — even by an admin account — for a defined retention period:
```bash
# Example command — replace with actual Ghaymah immutable storage configuration
ghaymah-cli storage bucket set-object-lock \
  --bucket siem-backups \
  --mode COMPLIANCE \
  --retention-days 30
```

---

## Prevention Checklist Summary

| Priority | Control | Status |
|---|---|---|
| 🔴 Critical | SSH key-only authentication | Implement immediately |
| 🔴 Critical | MFA for cloud console | Implement immediately |
| 🔴 Critical | Least-privilege IAM roles | Implement immediately |
| 🟠 High | Automated OS patching | This week |
| 🟠 High | Network segmentation (public/private subnets) | This week |
| 🟠 High | `noexec` on Block Storage mounts | This week |
| 🟠 High | Immutable backup snapshots | This week |
| 🟡 Medium | DNS filtering / egress control | This month |
| 🟡 Medium | File Integrity Monitoring (FIM) | This month |
| 🟡 Medium | Phishing simulation program | This quarter |
| 🟢 Low | Security awareness training | This quarter |