11 KiB
11 KiB
Architectural Prevention Strategies on Ghaymah
Preventing API Brute Force & Lateral Movement
Document ID: GH-ARCH-2026-003
Applies To: Ghaymah Managed Kubernetes & Block Storage
1. Network Policy Architecture (Zero-Trust Microsegmentation)
1.1 Default-Deny Foundation
Every namespace on Ghaymah Kubernetes must start with a default-deny policy. This ensures no pod can communicate unless explicitly allowed.
# default-deny-all.yaml — Apply to EVERY namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: <target-namespace>
spec:
podSelector: {} # Applies to ALL pods in namespace
policyTypes:
- Ingress
- Egress
1.2 Explicit Allow Policies (Least-Privilege)
# allow-api-to-db.yaml — Only API pods can reach the database
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-api-to-postgres
namespace: data-pipeline
spec:
podSelector:
matchLabels:
app: postgres
tier: database
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: api-gateway
tier: backend
ports:
- protocol: TCP
port: 5432
---
# allow-egress-dns-only.yaml — Pods can only resolve DNS, nothing else
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-egress-dns-only
namespace: data-pipeline
spec:
podSelector:
matchLabels:
tier: database
policyTypes:
- Egress
egress:
- to: []
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
1.3 Network Architecture Diagram
┌─────────────────────────────────────────────────────────────────────┐
│ GHAYMAH CLOUD PERIMETER │
│ ┌──────────────┐ │
│ │ DDoS Shield │ ← L3/L4 Volumetric Protection │
│ └──────┬───────┘ │
│ ▼ │
│ ┌──────────────┐ │
│ │ WAF (CRS 4) │ ← L7 Application Firewall (OWASP rules) │
│ └──────┬───────┘ │
│ ▼ │
│ ┌──────────────┐ ┌─────────────────────┐ │
│ │ API Gateway │────▶│ Rate Limiter │ │
│ │ (Ingress) │ │ • Per-IP: 100/min │ │
│ │ │ │ • Per-User: 20/min │ │
│ │ │ │ • Global: 10K/min │ │
│ └──────┬───────┘ └─────────────────────┘ │
│ │ │
│ ╔══════╧══════════════════════════════════════════════════════╗ │
│ ║ KUBERNETES CLUSTER (Managed) ║ │
│ ║ ║ │
│ ║ ┌─────────── Namespace: api-gateway ──────────────┐ ║ │
│ ║ │ [API Pods] ← mTLS (Istio) → [Auth Service] │ ║ │
│ ║ │ NetworkPolicy: allow ingress from WAF only │ ║ │
│ ║ └─────────────────────┬───────────────────────────┘ ║ │
│ ║ │ mTLS ║ │
│ ║ ┌─────────── Namespace: data-pipeline ────────────┐ ║ │
│ ║ │ [Worker Pods] → [PostgreSQL] → [Redis Cache] │ ║ │
│ ║ │ NetworkPolicy: allow from api-gateway only │ ║ │
│ ║ │ Egress: DNS only (no internet) │ ║ │
│ ║ └─────────────────────┬───────────────────────────┘ ║ │
│ ║ │ ║ │
│ ║ ┌─────────── Namespace: security-tools ───────────┐ ║ │
│ ║ │ [Wazuh DaemonSet] [n8n SOAR] [Falco] │ ║ │
│ ║ │ [Elastic Stack] │ ║ │
│ ║ │ NetworkPolicy: monitoring access to all NS │ ║ │
│ ║ └──────────────────────────────────────────────────┘ ║ │
│ ╚══════════════════════════════════════════════════════════════╝ │
│ │ │
│ ┌─────────────────────┴────────────────────────────┐ │
│ │ GHAYMAH BLOCK STORAGE │ │
│ │ • AES-256 encryption at rest (CMEK) │ │
│ │ • Immutable snapshots with retention lock │ │
│ │ • Cross-region replication (DR) │ │
│ └───────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘
2. Container Security Hardening
2.1 Pod Security Standards (Restricted Profile)
# namespace-security-labels.yaml
apiVersion: v1
kind: Namespace
metadata:
name: data-pipeline
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/enforce-version: latest
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted
2.2 Hardened Pod Template
# hardened-pod-template.yaml
apiVersion: v1
kind: Pod
metadata:
name: api-server
namespace: api-gateway
spec:
automountServiceAccountToken: false # No default SA token
securityContext:
runAsNonRoot: true # Never run as root
runAsUser: 10001 # Explicit non-root UID
runAsGroup: 10001
fsGroup: 10001
seccompProfile:
type: RuntimeDefault # Restrict syscalls
containers:
- name: api
image: registry.ghaymah.systems/api-server:v2.3.1@sha256:abc123... # Pinned digest
securityContext:
allowPrivilegeEscalation: false # Cannot gain more privileges
readOnlyRootFilesystem: true # Immutable filesystem
capabilities:
drop:
- ALL # Drop ALL Linux capabilities
resources:
limits:
cpu: "500m"
memory: "256Mi"
ephemeral-storage: "100Mi"
requests:
cpu: "100m"
memory: "128Mi"
volumeMounts:
- name: tmp
mountPath: /tmp
- name: cache
mountPath: /app/cache
volumes:
- name: tmp
emptyDir:
sizeLimit: 50Mi
- name: cache
emptyDir:
sizeLimit: 100Mi
2.3 Image Policy (OPA Gatekeeper Constraint)
# require-signed-images.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
name: require-ghaymah-registry
spec:
match:
kinds:
- apiGroups: [""]
kinds: ["Pod"]
parameters:
repos:
- "registry.ghaymah.systems/" # Only allow images from trusted registry
3. API-Level Protection
3.1 Multi-Layer Rate Limiting Architecture
Request Flow:
Client → [Global Rate Limit: 10K/min]
→ [Per-IP Rate Limit: 100/min]
→ [Per-Account Rate Limit: 20/min]
→ [Per-Endpoint Rate Limit: varies]
→ API Handler
Rate Limit Response (429 Too Many Requests):
{
"error": "rate_limit_exceeded",
"retry_after": 60,
"limit": 100,
"remaining": 0,
"reset": 1721890800
}
3.2 Authentication Hardening
| Control | Implementation |
|---|---|
| MFA Enforcement | TOTP/WebAuthn mandatory for ALL accounts (including service accounts) |
| Password Policy | Min 14 chars, complexity required, breach database check (HaveIBeenPwned API) |
| Token Expiry | Access tokens: 15 min, Refresh tokens: 24 hrs, API keys: 90 days max |
| Account Lockout | Lock after 5 failed attempts, progressive delay (1min, 5min, 15min, 1hr) |
| Session Management | Single active session per account (configurable), IP binding optional |
4. Monitoring & Detection Architecture
4.1 Security Monitoring Stack
Data Sources:
├── K8s API Audit Logs ──────────────────┐
├── Container Runtime (Falco) ───────────┤
├── Wazuh Agent Logs ────────────────────┤──→ [Elastic/OpenSearch]
├── Application Logs (structured JSON) ──┤ │
├── Network Flow Logs ───────────────────┤ ├──→ [Kibana Dashboards]
└── Ghaymah Platform Audit Logs ─────────┘ │
└──→ [Wazuh Manager]
│
┌──────┴──────┐
│ n8n SOAR │
│ Playbooks │
└─────────────┘
│
┌───────────┼───────────┐
▼ ▼ ▼
[Firewall] [IAM API] [Slack/PD]
Auto-block Lock acct Alert team