أنهيت الإمتحان

q1-security-audit/Bash Script/Ghaymah_Script_Documentation.md

@@ -0,0 +1,29 @@
+# Ghaymah Systems
+## Automated Security Script Documentation & Baseline Mapping
+
+### Overview
+This document provides a technical breakdown of the `ghaymah-audit.sh` bash script. It explains how each block of code functions and maps directly to the rules defined in the 15-point Ghaymah Cloud Infrastructure Security Baseline.
+
+### 1. Permissions Check (صلاحيات)
+**Technical Code Explanation:**
+The script utilizes the built-in Bash variable `$EUID` (Effective User ID) to evaluate the execution privileges. In Linux architectures, the root (administrator) user is always assigned an ID of 0. By evaluating the condition `[ "$EUID" -eq 0 ]`, the script can definitively determine if the environment is running with maximum privileges.
+
+**Connection to Ghaymah Baseline:**
+* **Rule 2.2 (Isolate Workloads - Rootless & Read-Only):** This check directly enforces our container security policy. Containers and workloads deployed on Ghaymah must run as non-root users. Blocking root execution prevents "container escape" vulnerabilities, protecting the underlying host nodes.
+* **Rule 1.2 (Just-in-Time Privileges):** It also aligns with the principle of least privilege, ensuring scripts and automation tools do not operate with standing root access.
+
+### 2. Open Ports Check (منافذ)
+**Technical Code Explanation:**
+The script uses network diagnostic commands (`ss -tuln` or `netstat -tuln`) to list all active, listening network ports on the machine without resolving DNS names (for speed). It pipes (`|`) this output into the `grep -E ':(22)\s'` command. This isolates the output to check specifically for Port 22, which is the default listening port for SSH (Secure Shell).
+
+**Connection to Ghaymah Baseline:**
+* **Rule 3.1 (Zero Trust Micro-segmentation):** By verifying that SSH is not exposed, we enforce our network isolation policies. Management ports should never be publicly exposed; access must be gated through Zero Trust Network Access (ZTNA).
+* **Rule 5.3 (Prevent Security Misconfiguration):** Leaving default management ports open is a critical OWASP misconfiguration. This check serves as an automated guardrail against deployment errors.
+
+### 3. SSL/TLS Certificate Check (SSL)
+**Technical Code Explanation:**
+The script chains several tools to validate cryptographic health. It uses `openssl s_client -connect` to ping the domain on port 443 (HTTPS) and download the live SSL certificate. It passes this to `openssl x509 -enddate` to extract the expiration date. Finally, it uses the `date +%s` command to convert both the expiration date and the current date into "Epoch time" (seconds elapsed since January 1, 1970). Comparing these two integers allows the script to accurately determine if the certificate has expired.
+
+**Connection to Ghaymah Baseline:**
+* **Rule 4.1 (Universal KMS Encryption & TLS 1.3):** This maps directly to our data security mandates. Data in transit must be encrypted. An expired certificate breaks the trust chain and compromises the encrypted tunnel, violating our security SLA.
+* **Rule 3.3 (Enforce mTLS):** Secure inter-service communication relies on valid certificates. This check ensures that the foundational layer for mutual TLS remains active and trusted.

q1-security-audit/Bash Script/System Check Bash Code.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+
+# ==============================================================================
+# Ghaymah Systems - Automated Security Baseline Checker
+# Description: Validates Permissions, Open Ports, and SSL Configuration.
+# ==============================================================================
+
+# Output Colors for readability
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+DOMAIN="ghaymah.systems"
+
+echo -e "${YELLOW}====================================================${NC}"
+echo -e "${YELLOW}       Ghaymah Systems - Security Audit Script      ${NC}"
+echo -e "${YELLOW}====================================================${NC}\n"
+
+# ------------------------------------------------------------------------------
+# 1. PERMISSIONS CHECK (صلاحيات)
+# Ensures the script/container is not running with root privileges (Rule 2.2)
+# ------------------------------------------------------------------------------
+echo -e "[1] Checking System Permissions (Least Privilege / Rootless)..."
+if [ "$EUID" -eq 0 ]; then
+  echo -e "  ${RED}[FAILED]${NC} Environment is running as root (UID 0). This violates Ghaymah's rootless container policy."
+else
+  echo -e "  ${GREEN}[PASSED]${NC} Environment is running as a non-root user (UID $EUID)."
+fi
+echo ""
+
+# ------------------------------------------------------------------------------
+# 2. PORTS CHECK (منافذ)
+# Checks if SSH (Port 22) is actively listening, which should be disabled (Rule 3.1)
+# ------------------------------------------------------------------------------
+echo -e "[2] Checking Exposed Ports (Zero Trust Network)..."
+# Using 'ss' or 'netstat' to check for port 22 listening state
+if command -v ss &> /dev/null; then
+    PORT_CHECK=$(ss -tuln | grep -E ':(22)\s')
+elif command -v netstat &> /dev/null; then
+    PORT_CHECK=$(netstat -tuln | grep -E ':(22)\s')
+else
+    PORT_CHECK="Command not found, skipping."
+    echo -e "  ${YELLOW}[WARNING]${NC} Neither 'ss' nor 'netstat' is installed to check ports."
+fi
+
+if [[ -n "$PORT_CHECK" && "$PORT_CHECK" != "Command not found, skipping." ]]; then
+  echo -e "  ${RED}[FAILED]${NC} Unauthorized open port detected (Port 22/SSH is listening)!"
+  echo "$PORT_CHECK"
+elif [[ "$PORT_CHECK" == "" ]]; then
+  echo -e "  ${GREEN}[PASSED]${NC} No unauthorized management ports (like SSH) are exposed."
+fi
+echo ""
+
+# ------------------------------------------------------------------------------
+# 3. SSL/TLS CERTIFICATE CHECK (SSL)
+# Checks if the target domain has a valid, non-expired SSL certificate (Rule 3.3/4.1)
+# ------------------------------------------------------------------------------
+echo -e "[3] Checking SSL Certificate Validity for $DOMAIN..."
+if command -v openssl &> /dev/null; then
+    # Fetch the expiration date of the SSL certificate
+    EXPIRATION_DATE=$(echo | openssl s_client -servername "$DOMAIN" -connect "$DOMAIN":443 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
+    
+    if [ -n "$EXPIRATION_DATE" ]; then
+        # Convert dates to seconds since epoch for comparison
+        EXP_SECONDS=$(date -d "$EXPIRATION_DATE" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$EXPIRATION_DATE" +%s)
+        CURRENT_SECONDS=$(date +%s)
+        
+        if [ "$EXP_SECONDS" -lt "$CURRENT_SECONDS" ]; then
+            echo -e "  ${RED}[FAILED]${NC} The SSL certificate for $DOMAIN has EXPIRED on $EXPIRATION_DATE."
+        else
+            echo -e "  ${GREEN}[PASSED]${NC} SSL Certificate is valid. Expires on: $EXPIRATION_DATE."
+        fi
+    else
+        echo -e "  ${RED}[FAILED]${NC} Could not retrieve SSL certificate. Is the domain reachable over port 443?"
+    fi
+else
+    echo -e "  ${YELLOW}[WARNING]${NC} 'openssl' command is not installed. Cannot verify SSL."
+fi
+
+echo -e "\n${YELLOW}====================================================${NC}"
+echo -e "${YELLOW}                  Audit Complete                    ${NC}"
+echo -e "${YELLOW}====================================================${NC}"

q1-security-audit/Ghaymah_Security_Checklist.md

@@ -0,0 +1,92 @@
+# Ghaymah Systems - Cloud Infrastructure Security Checklist
+## Comprehensive 15-Point Security Baseline based on CISA, NIST, CIS, and OWASP
+
+### Executive Summary
+As a Cloud Security Architect designing the security posture for Ghaymah (ghaymah.systems), this framework is engineered specifically for our architecture as a leading cloud provider. Given our scale and the direct infrastructure access we provide, our threat landscape is complex. This 15-point master policy provides 90%+ coverage against the most critical cloud attack vectors by integrating strict guidelines from CISA, NIST, CIS, and OWASP.
+
+### 1. Identity & Access Management (IAM)
+The control plane is the perimeter of the cloud. If our IAM is compromised, the entire Ghaymah infrastructure falls.
+
+#### 1.1. Enforce Phishing-Resistant MFA & Context-Aware Access
+* **Rule:** Mandate FIDO2/WebAuthn hardware security keys and block SMS-based MFA for administrative and production access.
+* **Why for Ghaymah:** Ghaymah engineers possess the 'keys to the kingdom.' Standard MFA is vulnerable to SIM swapping and fatigue attacks.
+* **Source:** CISA Zero Trust Maturity Model / NIST SP 800-63B
+
+#### 1.2. Implement Just-in-Time (JIT) Privileges and Zero Standing Access
+* **Rule:** Eliminate persistent standing privileges. Access must be temporary, time-bound (e.g., 1-4 hours), and heavily logged.
+* **Why for Ghaymah:** Drastically reduces the blast radius if an engineer's workstation is compromised.
+* **Source:** CISA Cloud Security Technical Reference Architecture
+
+#### 1.3. Centralize Secrets Management & Prohibit Hardcoded Credentials
+* **Rule:** Use a centralized secrets vault with auto-rotation (30-90 days). Never hardcode API keys or credentials in code or containers.
+* **Why for Ghaymah:** Protects our CI/CD pipelines and internal repositories from supply-chain credential leaks.
+* **Source:** NIST SP 800-53 / CIS Controls v8
+
+### 2. Container & Kubernetes Security
+Ghaymah provides container orchestration and rapid deployments. We must secure the container lifecycle from build to runtime.
+
+#### 2.1. Enforce Immutable, Signed Container Images
+* **Rule:** Mandate image scanning in CI/CD (block critical CVEs) and enforce cryptographic signatures (e.g., Cosign) before deployment.
+* **Why for Ghaymah:** Prevents software supply chain attacks and ensures only trusted code runs on our multi-tenant nodes.
+* **Source:** NIST SP 800-190 / CISA Supply Chain Guidelines
+
+#### 2.2. Isolate Workloads (Rootless & Read-Only)
+* **Rule:** Run containers as non-root users, enforce read-only filesystems, and drop unnecessary Linux capabilities.
+* **Why for Ghaymah:** Our primary defense against 'container escape' vulnerabilities, preventing tenants from compromising the underlying host node.
+* **Source:** CIS Kubernetes & Docker Benchmarks
+
+#### 2.3. Continuous Runtime Security & eBPF
+* **Rule:** Deploy eBPF-based runtime monitoring (e.g., Falco/Cilium) to detect anomalous behavior (unexpected shells, outbound connections) in real-time.
+* **Why for Ghaymah:** Pre-deployment scanning misses zero-days. Runtime monitoring catches active exploitation.
+* **Source:** CISA Cloud Security TRA / CIS Benchmarks
+
+### 3. Network Security & Cloud Edge
+
+#### 3.1. Zero Trust Micro-segmentation
+* **Rule:** Isolate environments (Prod, Staging, Mgmt) in separate VPCs. Enforce strict egress filtering and default-deny network policies.
+* **Why for Ghaymah:** Prevents lateral movement. If a tenant application is breached, the attacker cannot pivot to internal Ghaymah management planes.
+* **Source:** NIST SP 800-207 / CISA Zero Trust Maturity Model
+
+#### 3.2. DDoS Mitigation and WAF at the Edge
+* **Rule:** Route all external traffic through edge protection featuring L3/L4 DDoS mitigation and a WAF configured with OWASP Core Rule Sets.
+* **Why for Ghaymah:** Ensures 99.9% uptime and protects our infrastructure and clients from volumetric and application-layer attacks.
+* **Source:** CISA Shields Up / OWASP Framework
+
+#### 3.3. Enforce mTLS & ZTNA
+* **Rule:** Use mTLS for all inter-service communication. Replace traditional VPNs with Zero Trust Network Access (ZTNA) for administrative access.
+* **Why for Ghaymah:** Secures internal APIs and ensures administrative access is verified continuously at the identity and device level, not just network location.
+* **Source:** DoD Zero Trust Architecture / NIST SP 800-52
+
+### 4. Data Protection & Governance
+
+#### 4.1. Envelope Encryption with Customer-Managed Keys (CMK)
+* **Rule:** Enforce AES-256 encryption at rest. Provide CMK options so clients control their cryptographic keys.
+* **Why for Ghaymah:** Guarantees data sovereignty and privacy. Even compromised Ghaymah admin accounts cannot read client plaintext data.
+* **Source:** CSA Cloud Controls Matrix / CIS Control 3
+
+#### 4.2. Immutable Backups (WORM) & DR
+* **Rule:** Store critical backups in Write-Once-Read-Many (WORM) storage with multi-region replication to prevent deletion or alteration.
+* **Why for Ghaymah:** Ensures total recoverability in the event of a catastrophic ransomware attack targeting cloud backup systems.
+* **Source:** CISA Ransomware Readiness Guide / NIST SP 800-34
+
+#### 4.3. Automated Data Exposure Guardrails (DSPM)
+* **Rule:** Deploy automated Data Security Posture Management (DSPM) to enforce public access blocks on object storage and scan for exposed sensitive data.
+* **Why for Ghaymah:** Misconfigured public buckets are a leading cause of breaches. We must prevent accidental data exposure programmatically.
+* **Source:** NIST Privacy Framework
+
+### 5. Application Security (OWASP Top 5 Focus)
+
+#### 5.1. Strict Resource Authorization (Mitigate Broken Access Control - A01)
+* **Rule:** Enforce strict server-side object-level authorization (BOLA) checks on all API requests. Mandate IMDSv2 to prevent SSRF.
+* **Why for Ghaymah:** Prevents tenants from manipulating API requests to access or modify resources belonging to other tenants.
+* **Source:** OWASP Top 10 A01 / A10
+
+#### 5.2. Prevent Injection via Parameterized Execution (A03)
+* **Rule:** Utilize parameterized queries/ORMs exclusively. Strictly validate and sanitize all inputs to the Ghaymah CLI and APIs before execution.
+* **Why for Ghaymah:** Protects the orchestration backend from Remote Code Execution (RCE) via command or SQL injection.
+* **Source:** OWASP Top 10 A03
+
+#### 5.3. Centralized Logging & SIEM Integration (A09)
+* **Rule:** Centralize all API, CloudTrail, and Kubernetes audit logs into an immutable SIEM/SOAR platform with automated alerting for anomalies.
+* **Why for Ghaymah:** Reduces Mean Time To Detect (MTTD) breaches and ensures we have forensically sound data for incident response.
+* **Source:** OWASP Top 10 A09 / CISA Logging Playbook