110 أسطر
5.0 KiB
Markdown
110 أسطر
5.0 KiB
Markdown
# ghaymah-exam-mahmoud-secops
|
|
|
|
**Candidate:** Mahmoud
|
|
**Track:** SecOps
|
|
**Platform:** ghaymah.systems
|
|
|
|
---
|
|
|
|
## Repository Structure
|
|
|
|
```
|
|
ghaymah-exam-mahmoud-secops/
|
|
├── q1-security-audit/
|
|
│ ├── security-checklist.md # 15-item checklist (Container, Network, OWASP, Data, IAM)
|
|
│ └── security-audit.sh # Bash script: scans ports, SSL, file permissions
|
|
├── q2-attack-simulation/
|
|
│ ├── incident-response.md # Full Q2: timeline, IR plan, prevention, alert rules
|
|
│ └── alert-rule.yml # Deployable Prometheus alert rules for brute force detection
|
|
├── q3-privacy-assessment/
|
|
│ ├── privacy-report.md # mithal.space assessment: headers, cookies, trackers, comparison
|
|
│ └── screenshots/ # Browser screenshots taken during inspection
|
|
│ ├── homepage.png
|
|
│ ├── https-certificate.png
|
|
│ └── search-results.png
|
|
├── q4-siem/
|
|
│ ├── siem.py # Python log analyzer: auth, nginx, app logs → alerts.json
|
|
│ ├── dashboard.html # Near-real-time alert dashboard (dark theme, no dependencies)
|
|
│ ├── deploy-guide.md # Deployment on Ghaymah Block Storage via systemd
|
|
│ └── alerts.json # Generated alert output (created at runtime)
|
|
├── q5-ransomware-response/
|
|
│ ├── emergency-plan.md # 60-minute ransomware response playbook
|
|
│ ├── backup-recovery-strategy.md # RPO/RTO targets + 3-2-1 rule implementation
|
|
│ └── prevention-plan.md # 5-layer prevention: auth, hardening, network, email, monitoring
|
|
├── common-mortakaz/
|
|
│ ├── Integration-1.md # SIEM ↔ Alerting integration
|
|
│ └── Integration-2.md # Backup ↔ Incident Response integration
|
|
├── common-qabilah/
|
|
│ └── qabilah-profile.txt # Candidate profile
|
|
└── README.md
|
|
```
|
|
|
|
---
|
|
|
|
## Questions Summary
|
|
|
|
### Q1 — Security Audit for ghaymah.systems
|
|
- 15-item security checklist across 5 domains (Container, Network, OWASP, Data, IAM)
|
|
- Bash script that automatically scans: open ports, SSL certificate validity, sensitive file permissions
|
|
|
|
**Run the audit:**
|
|
```bash
|
|
chmod +x q1-security-audit/security-audit.sh
|
|
./q1-security-audit/security-audit.sh ghaymah.systems 443 .
|
|
```
|
|
|
|
---
|
|
|
|
### Q2 — Attack Simulation & Incident Response
|
|
- **Scenario:** Brute force on `/api/v1/auth/login` → successful login → data exfiltration
|
|
- All deliverables consolidated in `incident-response.md`:
|
|
- Timeline: T+00:00 (recon) → T+01:00 (credential found) → T+01:15 (exfiltration) → T+03:00 (detection)
|
|
- 5-phase IR plan: Identification → Containment → Eradication → Recovery → Lessons Learned
|
|
- Prevention: rate limiting, WAF, Kubernetes NetworkPolicy, container hardening, MFA
|
|
- `alert-rule.yml`: deployable Prometheus rules detecting brute force and anomalous data exports
|
|
|
|
---
|
|
|
|
### Q3 — Privacy Assessment of mithal.space
|
|
- Inspected via browser DevTools (Network, Application, Security tabs)
|
|
- **Findings:** HTTPS enforced ✅, no cookies ✅, no tracking scripts ✅, HSTS missing ❌
|
|
- **Privacy score: 8/10 — Strong**
|
|
- Compared to DuckDuckGo and Google Search
|
|
- 3 recommended improvements: add HSTS, self-host Google Fonts, tighten CSP (remove `'unsafe-inline'`)
|
|
|
|
---
|
|
|
|
### Q4 — Lightweight SIEM Log Analyzer
|
|
- `siem.py`: reads `auth.log`, `nginx/access.log`, `app/application.log`; detects SSH brute force, HTTP flooding, SQL injection, JWT abuse, and critical application errors
|
|
- Outputs `alerts.json` consumed by the dashboard
|
|
- `dashboard.html`: near-real-time dark-mode dashboard (30s refresh) with severity stats, IP threat map, activity feed
|
|
- Deployment: systemd service + Ghaymah Block Storage for log persistence + backup strategy
|
|
|
|
**Run locally (demo mode):**
|
|
```bash
|
|
cd q4-siem
|
|
python3 siem.py # Generates alerts.json
|
|
# Open dashboard.html in browser
|
|
```
|
|
|
|
---
|
|
|
|
### Q5 — Ransomware Response Plan
|
|
- **Scenario:** All Block Storage files encrypted with ransom message
|
|
- Emergency plan: detect → isolate → take forensic snapshot → restore from clean backup → communicate
|
|
- Backup strategy: RPO=1h, RTO=4h, 3-2-1 rule (live volume + hourly Object Storage backups + offsite weekly)
|
|
- Prevention: 5 layers — access control, system hardening, network segmentation, email filtering, integrity monitoring
|
|
|
|
---
|
|
|
|
## How to Use This Repository
|
|
|
|
| Need | File |
|
|
|---|---|
|
|
| Run an automated security scan | `q1-security-audit/security-audit.sh` |
|
|
| Respond to an active API attack | `q2-attack-simulation/incident-response.md` |
|
|
| Set up brute-force alerting | `q2-attack-simulation/alert-rule.yml` |
|
|
| Review site privacy posture | `q3-privacy-assessment/privacy-report.md` |
|
|
| Deploy a SIEM system | `q4-siem/siem.py` + `q4-siem/deploy-guide.md` |
|
|
| Respond to ransomware now | `q5-ransomware-response/emergency-plan.md` |
|
|
| Set up backup strategy | `q5-ransomware-response/backup-recovery-strategy.md` | |