109 أسطر
6.8 KiB
Markdown
109 أسطر
6.8 KiB
Markdown
# Security Audit Documentation & Checklist
|
||
|
||
## Objective
|
||
To perform a rigorous security audit of the Ghaymah Cloud infrastructure, focusing on network port exposure, SSL/TLS protocol strength, and local filesystem permissions, in alignment with the Shared Responsibility Model.
|
||
|
||
## Scope
|
||
- **Target:** `ghaymah.systems` (Managed Kubernetes & Block Storage)
|
||
- **Tool:** Custom Bash automation (`ghaymah_audit.sh`)
|
||
- **Domains Covered:** Network Ports, Cryptography (SSL/TLS), Access Control (Permissions)
|
||
|
||
## Methodology
|
||
The audit was conducted using native Linux tools (`nc`, `openssl`, `find`, `stat`) to minimize external dependencies. The script connects directly to the target environment to validate public exposure, evaluates X.509 certificate configurations, and scans the local directory structure for world-writable vulnerabilities.
|
||
|
||
---
|
||
|
||
## ISO 27001 Security Checklist
|
||
|
||
This 15-point checklist maps the technical controls evaluated during this audit directly to ISO 27001 Annex A controls, ensuring regulatory compliance alongside technical hardening.
|
||
|
||
| # | Audit Item | ISO 27001 Reference | Application to `ghaymah.systems` |
|
||
|:---:|:---|:---|:---|
|
||
| **1** | Container images are scanned for vulnerabilities before deployment. | A.12.6.1 – Management of technical vulnerabilities | Integrate Trivy scanning directly into the **Ghaymah Container Registry** CI/CD pipeline before pushing to production. |
|
||
| **2** | Containers run as non-root users. | A.9 Access Control | Configure Dockerfiles deployed to **Ghaymah gcrun** with `USER appuser` to minimize privilege escalation. |
|
||
| **3** | Secrets are not hardcoded inside Docker images or source code. | A.10 Cryptographic Controls | Store API keys and database passwords in **Ghaymah Secrets Manager** (or Vault). |
|
||
| **4** | Only required network ports are exposed. | A.13.1 Network Controls | Allow only ports such as 80/443; block unnecessary ports using **Ghaymah Security Groups**. |
|
||
| **5** | Network communication uses TLS/HTTPS. | A.13.2 Information Transfer | Enforce HTTPS (TLS 1.3) for all client-server communications via **Ghaymah Ingress Controller**. |
|
||
| **6** | Input validation prevents SQL Injection. | A.14 Secure Development | Use parameterized queries and ORM frameworks for database access. |
|
||
| **7** | Input validation prevents Cross-Site Scripting (XSS). | A.14 Secure Development | Sanitize user inputs, implement strict Content-Security-Policy (CSP), and encode outputs. |
|
||
| **8** | Protection against Broken Authentication. | A.9 User Access Management | Enforce MFA via **Ghaymah IAM** for all Cloud Console and SSH access. |
|
||
| **9** | Access control is enforced on every API endpoint. | A.9.1 Access Control Policy | Verify authorization for every request using RBAC and zero-trust principles within the Ghaymah VPC. |
|
||
| **10** | Sensitive data is encrypted at rest. | A.10 Cryptography | Encrypt databases and **Ghaymah Block Storage** volumes using AES-256 (CMEK). |
|
||
| **11** | Regular backups are performed and tested. | A.12.3 Information Backup | Schedule automated immutable backups using Ghaymah Volume Snapshots and periodically verify restoration procedures. |
|
||
| **12** | Logs are collected and protected from tampering. | A.12.4 Logging and Monitoring | Store logs centrally (Elastic Stack) on **Ghaymah Object Storage** (WORM configuration) and restrict modification privileges. |
|
||
| **13** | User accounts follow least privilege. | A.9.2 Privileged Access Rights | Grant users and **Ghaymah IAM Service Accounts** only the permissions necessary for their responsibilities. |
|
||
| **14** | User accounts are reviewed periodically. | A.9.2.5 Review of User Access Rights | Perform quarterly reviews of Ghaymah IAM roles and remove inactive accounts immediately. |
|
||
| **15** | Incident response procedures are documented and tested. | A.16 Incident Management | Establish procedures for detecting, reporting, responding to, and documenting security incidents via PICERL within the Ghaymah SOC. |
|
||
|
||
---
|
||
|
||
## Security Checks Performed
|
||
|
||
| Domain | Check Description | Tool Used | Expected Outcome |
|
||
|--------|-------------------|-----------|------------------|
|
||
| **Network** | TCP Port Scanning (22, 80, 443, 3306, 5432, 6379, 27017) | `/dev/tcp` | Only 80/443 exposed. Databases closed. |
|
||
| **Crypto** | TLS 1.3 Validation | `openssl` | TLS 1.3 supported and enforced. |
|
||
| **Crypto** | Certificate Expiration | `openssl` | Validity > 30 days remaining. |
|
||
| **Web** | HTTP Security Headers (HSTS, CSP, XFO, etc.) | `curl` | All OWASP recommended headers present. |
|
||
| **System** | World-Writable Files / Directories | `find` + `stat` | Zero world-writable paths. |
|
||
|
||
---
|
||
|
||
## Findings
|
||
|
||
The execution of the audit script yielded the following results:
|
||
- `[PASS]` HTTPS (443) and HTTP (80) are reachable.
|
||
- `[PASS]` HTTPS response code 200 validated.
|
||
- `[PASS]` TLS 1.3 is enabled and Certificate is valid.
|
||
- `[PASS]` HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy enabled.
|
||
- `[PASS]` Zero world-writable directories found.
|
||
- `[WARNING]` SSH (22) is exposed to the public internet.
|
||
- `[WARNING]` Content-Security-Policy (CSP) is missing.
|
||
- `[WARNING]` Permissions-Policy is missing.
|
||
- `[WARNING]` World-writable application files detected in the target directory.
|
||
|
||
---
|
||
|
||
## Evidence — Security Audit Execution
|
||
|
||
|
||
### Observation
|
||
The audit script successfully executed against `ghaymah.systems`. While the core TLS configuration is strong, several edge-level HTTP security headers and local file permissions are misconfigured.
|
||
|
||
### Risk
|
||
1. **Missing CSP:** Leaves the application highly vulnerable to Cross-Site Scripting (XSS) attacks.
|
||
2. **Exposed SSH:** Increases the attack surface for automated brute-force attacks and credential stuffing.
|
||
3. **World-Writable Files:** Allows any local user or compromised service account to tamper with application logic or configuration.
|
||
|
||
### Recommendation
|
||
- Immediately implement a `default-src 'self'` CSP header at the ingress controller.
|
||
- Move SSH access behind a VPN or Bastion host.
|
||
- Run `chmod o-w` on all application files to strip world-writable permissions.
|
||
|
||
### Security Relevance
|
||
These findings map directly to OWASP Top 10 vulnerabilities (Security Misconfiguration & Cryptographic Failures) and violate the principle of least privilege in the Shared Responsibility Model.
|
||
|
||
---
|
||
|
||
## Sample Execution
|
||
|
||
```bash
|
||
sudo ./ghaymah_audit.sh ghaymah.systems 443 ./app
|
||
```
|
||
|
||
## Sample Output
|
||
*(See [docs/sample-output.md](../docs/sample-output.md) for full raw output)*
|
||
|
||
```text
|
||
-----------------------------------
|
||
SUMMARY
|
||
-----------------------------------
|
||
Critical : 0
|
||
Warnings : 4
|
||
Passed : 11
|
||
Overall : WARNING
|
||
```
|
||
|
||
## Conclusion
|
||
The Ghaymah infrastructure possesses a strong foundational security posture, particularly regarding certificate management and database isolation. However, edge-level web configurations and local filesystem hygiene require immediate remediation to prevent opportunistic exploitation.
|