274 أسطر
11 KiB
Markdown
274 أسطر
11 KiB
Markdown
# Architectural Prevention Strategies on Ghaymah
|
|
## Preventing API Brute Force & Lateral Movement
|
|
|
|
> **Document ID:** GH-ARCH-2026-003
|
|
> **Applies To:** Ghaymah Managed Kubernetes & Block Storage
|
|
|
|
---
|
|
|
|
## 1. Network Policy Architecture (Zero-Trust Microsegmentation)
|
|
|
|
### 1.1 Default-Deny Foundation
|
|
|
|
Every namespace on Ghaymah Kubernetes must start with a default-deny policy. This ensures no pod can communicate unless explicitly allowed.
|
|
|
|
```yaml
|
|
# default-deny-all.yaml — Apply to EVERY namespace
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: default-deny-all
|
|
namespace: <target-namespace>
|
|
spec:
|
|
podSelector: {} # Applies to ALL pods in namespace
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
```
|
|
|
|
### 1.2 Explicit Allow Policies (Least-Privilege)
|
|
|
|
```yaml
|
|
# allow-api-to-db.yaml — Only API pods can reach the database
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-api-to-postgres
|
|
namespace: data-pipeline
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: postgres
|
|
tier: database
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: api-gateway
|
|
tier: backend
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
---
|
|
# allow-egress-dns-only.yaml — Pods can only resolve DNS, nothing else
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: allow-egress-dns-only
|
|
namespace: data-pipeline
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
tier: database
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
- to: []
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
```
|
|
|
|
### 1.3 Network Architecture Diagram
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────┐
|
|
│ GHAYMAH CLOUD PERIMETER │
|
|
│ ┌──────────────┐ │
|
|
│ │ DDoS Shield │ ← L3/L4 Volumetric Protection │
|
|
│ └──────┬───────┘ │
|
|
│ ▼ │
|
|
│ ┌──────────────┐ │
|
|
│ │ WAF (CRS 4) │ ← L7 Application Firewall (OWASP rules) │
|
|
│ └──────┬───────┘ │
|
|
│ ▼ │
|
|
│ ┌──────────────┐ ┌─────────────────────┐ │
|
|
│ │ API Gateway │────▶│ Rate Limiter │ │
|
|
│ │ (Ingress) │ │ • Per-IP: 100/min │ │
|
|
│ │ │ │ • Per-User: 20/min │ │
|
|
│ │ │ │ • Global: 10K/min │ │
|
|
│ └──────┬───────┘ └─────────────────────┘ │
|
|
│ │ │
|
|
│ ╔══════╧══════════════════════════════════════════════════════╗ │
|
|
│ ║ KUBERNETES CLUSTER (Managed) ║ │
|
|
│ ║ ║ │
|
|
│ ║ ┌─────────── Namespace: api-gateway ──────────────┐ ║ │
|
|
│ ║ │ [API Pods] ← mTLS (Istio) → [Auth Service] │ ║ │
|
|
│ ║ │ NetworkPolicy: allow ingress from WAF only │ ║ │
|
|
│ ║ └─────────────────────┬───────────────────────────┘ ║ │
|
|
│ ║ │ mTLS ║ │
|
|
│ ║ ┌─────────── Namespace: data-pipeline ────────────┐ ║ │
|
|
│ ║ │ [Worker Pods] → [PostgreSQL] → [Redis Cache] │ ║ │
|
|
│ ║ │ NetworkPolicy: allow from api-gateway only │ ║ │
|
|
│ ║ │ Egress: DNS only (no internet) │ ║ │
|
|
│ ║ └─────────────────────┬───────────────────────────┘ ║ │
|
|
│ ║ │ ║ │
|
|
│ ║ ┌─────────── Namespace: security-tools ───────────┐ ║ │
|
|
│ ║ │ [Wazuh DaemonSet] [n8n SOAR] [Falco] │ ║ │
|
|
│ ║ │ [Elastic Stack] │ ║ │
|
|
│ ║ │ NetworkPolicy: monitoring access to all NS │ ║ │
|
|
│ ║ └──────────────────────────────────────────────────┘ ║ │
|
|
│ ╚══════════════════════════════════════════════════════════════╝ │
|
|
│ │ │
|
|
│ ┌─────────────────────┴────────────────────────────┐ │
|
|
│ │ GHAYMAH BLOCK STORAGE │ │
|
|
│ │ • AES-256 encryption at rest (CMEK) │ │
|
|
│ │ • Immutable snapshots with retention lock │ │
|
|
│ │ • Cross-region replication (DR) │ │
|
|
│ └───────────────────────────────────────────────────┘ │
|
|
└─────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
---
|
|
|
|
## 2. Container Security Hardening
|
|
|
|
### 2.1 Pod Security Standards (Restricted Profile)
|
|
|
|
```yaml
|
|
# namespace-security-labels.yaml
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: data-pipeline
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: restricted
|
|
pod-security.kubernetes.io/enforce-version: latest
|
|
pod-security.kubernetes.io/audit: restricted
|
|
pod-security.kubernetes.io/warn: restricted
|
|
```
|
|
|
|
### 2.2 Hardened Pod Template
|
|
|
|
```yaml
|
|
# hardened-pod-template.yaml
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: api-server
|
|
namespace: api-gateway
|
|
spec:
|
|
automountServiceAccountToken: false # No default SA token
|
|
securityContext:
|
|
runAsNonRoot: true # Never run as root
|
|
runAsUser: 10001 # Explicit non-root UID
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
seccompProfile:
|
|
type: RuntimeDefault # Restrict syscalls
|
|
containers:
|
|
- name: api
|
|
image: registry.ghaymah.systems/api-server:v2.3.1@sha256:abc123... # Pinned digest
|
|
securityContext:
|
|
allowPrivilegeEscalation: false # Cannot gain more privileges
|
|
readOnlyRootFilesystem: true # Immutable filesystem
|
|
capabilities:
|
|
drop:
|
|
- ALL # Drop ALL Linux capabilities
|
|
resources:
|
|
limits:
|
|
cpu: "500m"
|
|
memory: "256Mi"
|
|
ephemeral-storage: "100Mi"
|
|
requests:
|
|
cpu: "100m"
|
|
memory: "128Mi"
|
|
volumeMounts:
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: cache
|
|
mountPath: /app/cache
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 50Mi
|
|
- name: cache
|
|
emptyDir:
|
|
sizeLimit: 100Mi
|
|
```
|
|
|
|
### 2.3 Image Policy (OPA Gatekeeper Constraint)
|
|
|
|
```yaml
|
|
# require-signed-images.yaml
|
|
apiVersion: constraints.gatekeeper.sh/v1beta1
|
|
kind: K8sAllowedRepos
|
|
metadata:
|
|
name: require-ghaymah-registry
|
|
spec:
|
|
match:
|
|
kinds:
|
|
- apiGroups: [""]
|
|
kinds: ["Pod"]
|
|
parameters:
|
|
repos:
|
|
- "registry.ghaymah.systems/" # Only allow images from trusted registry
|
|
```
|
|
|
|
---
|
|
|
|
## 3. API-Level Protection
|
|
|
|
### 3.1 Multi-Layer Rate Limiting Architecture
|
|
|
|
```
|
|
Request Flow:
|
|
Client → [Global Rate Limit: 10K/min]
|
|
→ [Per-IP Rate Limit: 100/min]
|
|
→ [Per-Account Rate Limit: 20/min]
|
|
→ [Per-Endpoint Rate Limit: varies]
|
|
→ API Handler
|
|
|
|
Rate Limit Response (429 Too Many Requests):
|
|
{
|
|
"error": "rate_limit_exceeded",
|
|
"retry_after": 60,
|
|
"limit": 100,
|
|
"remaining": 0,
|
|
"reset": 1721890800
|
|
}
|
|
```
|
|
|
|
### 3.2 Authentication Hardening
|
|
|
|
| Control | Implementation |
|
|
|---------|---------------|
|
|
| MFA Enforcement | TOTP/WebAuthn mandatory for ALL accounts (including service accounts) |
|
|
| Password Policy | Min 14 chars, complexity required, breach database check (HaveIBeenPwned API) |
|
|
| Token Expiry | Access tokens: 15 min, Refresh tokens: 24 hrs, API keys: 90 days max |
|
|
| Account Lockout | Lock after 5 failed attempts, progressive delay (1min, 5min, 15min, 1hr) |
|
|
| Session Management | Single active session per account (configurable), IP binding optional |
|
|
|
|
---
|
|
|
|
## 4. Monitoring & Detection Architecture
|
|
|
|
### 4.1 Security Monitoring Stack
|
|
|
|
```
|
|
Data Sources:
|
|
├── K8s API Audit Logs ──────────────────┐
|
|
├── Container Runtime (Falco) ───────────┤
|
|
├── Wazuh Agent Logs ────────────────────┤──→ [Elastic/OpenSearch]
|
|
├── Application Logs (structured JSON) ──┤ │
|
|
├── Network Flow Logs ───────────────────┤ ├──→ [Kibana Dashboards]
|
|
└── Ghaymah Platform Audit Logs ─────────┘ │
|
|
└──→ [Wazuh Manager]
|
|
│
|
|
┌──────┴──────┐
|
|
│ n8n SOAR │
|
|
│ Playbooks │
|
|
└─────────────┘
|
|
│
|
|
┌───────────┼───────────┐
|
|
▼ ▼ ▼
|
|
[Firewall] [IAM API] [Slack/PD]
|
|
Auto-block Lock acct Alert team
|
|
```
|
|
|
|
|