368 أسطر
32 KiB
Python
368 أسطر
32 KiB
Python
# generate_risk_misconfigs.py
|
|
# Comprehensive Risk Register items, Common Misconfigurations Encyclopedia, and Remediation Roadmap
|
|
|
|
def get_risk_register_items():
|
|
return [
|
|
{
|
|
"id": "SEC-WEB-01",
|
|
"title": "Absence of Critical HTTP Security Headers on Web Dashboard",
|
|
"component": "Web Dashboard (`https://deploy.ghaymah.systems`)",
|
|
"domain": "Application Security (A.14 / A.12)",
|
|
"severity": "High",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
|
|
"cvss_score": "5.4",
|
|
"likelihood": "High",
|
|
"impact": "Medium",
|
|
"description": "The web application does not return Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, or X-Content-Type-Options headers. This leaves browser clients susceptible to Clickjacking, MIME-sniffing, and Cross-Site Scripting (XSS) exploitation if dynamic content injection occurs.",
|
|
"exploitability": "An attacker can embed the dashboard inside an invisible iframe on a malicious website to conduct UI redressing (Clickjacking) attacks against authenticated users.",
|
|
"status": "Not existed"
|
|
},
|
|
{
|
|
"id": "SEC-WEB-02",
|
|
"title": "Publicly Exposed Interactive Swagger UI / OpenAPI Documentation",
|
|
"component": "GenAI Service (`https://genai.ghaymah.systems/docs`)",
|
|
"domain": "API Security / Access Control (A.9, A.14)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cvss_score": "5.3",
|
|
"likelihood": "High",
|
|
"impact": "Low",
|
|
"description": "The interactive Swagger UI and OpenAPI JSON specification schema are exposed to the public Internet without authentication. This facilitates detailed reconnaissance of API endpoints, parameters, models, and backend types.",
|
|
"exploitability": "Threat actors can automatically map the entire API surface and craft targeted exploits against internal models without needing prior knowledge.",
|
|
"status": "Partially existed"
|
|
},
|
|
{
|
|
"id": "SEC-CLI-03",
|
|
"title": "Plaintext Credential Storage in Local Client Configuration (CWE-312)",
|
|
"component": "Ghaymah CLI Client (`~/.ghaymah/config.json`)",
|
|
"domain": "Data Protection & Authentication (A.8, A.9)",
|
|
"severity": "High",
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"cvss_score": "6.2",
|
|
"likelihood": "Medium",
|
|
"impact": "High",
|
|
"description": "The Ghaymah CLI client stores API access tokens and session credentials in plaintext JSON files on the local filesystem without operating system keychain protection (Windows DPAPI, Linux Secret Service, macOS Keychain).",
|
|
"exploitability": "Any local unprivileged process or malware executing under the user's context can harvest authentication tokens without requiring elevated privileges.",
|
|
"status": "Partially existed"
|
|
},
|
|
{
|
|
"id": "SEC-DOCKER-04",
|
|
"title": "Containers Executing with Default Root Privileges and Capabilities",
|
|
"component": "Docker Microservice Infrastructure",
|
|
"domain": "Docker and Container Security (A.8, A.12)",
|
|
"severity": "High",
|
|
"cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
|
"cvss_score": "8.8",
|
|
"likelihood": "Low",
|
|
"impact": "High",
|
|
"description": "Several application containers run as root (UID 0) inside the container and retain default Linux capabilities rather than enforcing `cap_drop: [ALL]` and unprivileged runtime users.",
|
|
"exploitability": "If an application component suffers a Remote Code Execution (RCE) vulnerability, the attacker possesses root privileges inside the container, substantially increasing the feasibility of container escape.",
|
|
"status": "Partially existed"
|
|
},
|
|
{
|
|
"id": "SEC-DOCKER-05",
|
|
"title": "Container Filesystems Mounted Writable Without Immutable Rootfs",
|
|
"component": "Docker Runtime Environment",
|
|
"domain": "Docker and Container Security (A.8, A.12)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
|
|
"cvss_score": "5.3",
|
|
"likelihood": "Medium",
|
|
"impact": "Medium",
|
|
"description": "Production containers run with writable root filesystems (`read_only: false`), allowing arbitrary binaries, webshells, or scripts to be downloaded and executed in temporary or application directories.",
|
|
"exploitability": "Attackers exploiting application-level vulnerabilities can download post-exploitation toolkits, drop persistent webshells, or modify system binaries in the container.",
|
|
"status": "Not existed"
|
|
},
|
|
{
|
|
"id": "SEC-S3-06",
|
|
"title": "Lack of Automated Periodic Credential Rotation for Storage Keys",
|
|
"component": "S3 Storage Gateway / IAM",
|
|
"domain": "Authentication and Identity (A.9)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"cvss_score": "5.9",
|
|
"likelihood": "Low",
|
|
"impact": "High",
|
|
"description": "S3 API access keys and secret keys remain static without automated 90-day expiration or forced rotation workflows.",
|
|
"exploitability": "Compromised or leaked API credentials remain active indefinitely until manual discovery and revocation occur.",
|
|
"status": "Not existed"
|
|
},
|
|
{
|
|
"id": "SEC-S3-07",
|
|
"title": "Missing Granular S3 Object-Level Audit Logging (Webhook/Audit Target)",
|
|
"component": "S3 Storage Gateway (`minio audit webhook`)",
|
|
"domain": "Logging and Monitoring (A.12.4)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"cvss_score": "5.3",
|
|
"likelihood": "Medium",
|
|
"impact": "Medium",
|
|
"description": "While reverse proxy records HTTP request lines, dedicated S3 object-level audit logging (PutObject, GetObject, DeleteObject with tenant metadata) is not configured to stream to an immutable audit target.",
|
|
"exploitability": "In the event of data exfiltration or malicious object tampering, security teams cannot ascertain which specific object keys were accessed or downloaded.",
|
|
"status": "Partially existed"
|
|
},
|
|
{
|
|
"id": "SEC-WAF-08",
|
|
"title": "Absence of Dedicated Web Application Firewall (WAF) with OWASP CRS",
|
|
"component": "Public Reverse Proxy / Ingress Gateway",
|
|
"domain": "WAF and Perimeter Protection (A.13)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
|
"cvss_score": "5.3",
|
|
"likelihood": "Medium",
|
|
"impact": "Medium",
|
|
"description": "Perimeter reverse proxy terminates TLS and routes traffic, but does not perform deep packet inspection or execute OWASP Core Rule Set (CRS) filtering against SQLi, XSS, and command injection patterns.",
|
|
"exploitability": "Zero-day application flaws or unhandled parser inputs pass directly to backend containers without perimeter filtering.",
|
|
"status": "Not existed"
|
|
},
|
|
{
|
|
"id": "SEC-SIEM-09",
|
|
"title": "Container Application Logs Excluded from Centralized SIEM Ingestion",
|
|
"component": "Wazuh Agent / Container Logging",
|
|
"domain": "Logging and Monitoring (A.12.4)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"cvss_score": "4.3",
|
|
"likelihood": "Medium",
|
|
"impact": "Low",
|
|
"description": "Host-level logs (SSH, auth.log) are forwarded to Wazuh, but Docker container application logs (auth-service, web, api) remain on local container stdout.",
|
|
"exploitability": "Security analysts lack real-time correlation between application authentication failures and network-level anomalies.",
|
|
"status": "Partially existed"
|
|
},
|
|
{
|
|
"id": "SEC-DR-10",
|
|
"title": "Lack of Tested Periodic Disaster Recovery Restoration Procedures",
|
|
"component": "Backup and Recovery Infrastructure",
|
|
"domain": "Backup and Recovery (A.17)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H",
|
|
"cvss_score": "5.0",
|
|
"likelihood": "Low",
|
|
"impact": "High",
|
|
"description": "Cloud disk snapshots are captured, but formal periodic recovery exercises validating restoration time and data integrity from backups have not been conducted or documented.",
|
|
"exploitability": "In the event of catastrophic storage corruption or ransomware, recovery procedures may fail or severely exceed acceptable Recovery Time Objectives (RTO).",
|
|
"status": "Not existed"
|
|
},
|
|
{
|
|
"id": "SEC-S3-11",
|
|
"title": "Lack of Automated Anti-Malware / ICAP Scanning on Uploaded Objects",
|
|
"component": "S3 Object Ingestion Pipeline",
|
|
"domain": "Application Security & Incident Response (A.14, A.16)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"cvss_score": "5.4",
|
|
"likelihood": "Medium",
|
|
"impact": "Medium",
|
|
"description": "Objects uploaded to S3 storage are not scanned for malicious payloads, viruses, or embedded macros prior to storage or subsequent distribution to other users.",
|
|
"exploitability": "A malicious actor can upload weaponized documents or executables to shared storage, turning the platform into a malware distribution mechanism.",
|
|
"status": "Partially existed"
|
|
},
|
|
{
|
|
"id": "SEC-AUTH-12",
|
|
"title": "Multi-Factor Authentication (MFA) Optional for Administrative Accounts",
|
|
"component": "Authentication Gateway",
|
|
"domain": "Authentication and Identity (A.9)",
|
|
"severity": "Medium",
|
|
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"cvss_score": "5.4",
|
|
"likelihood": "Low",
|
|
"impact": "High",
|
|
"description": "While MFA is supported by the authentication provider, it is not strictly mandated for all administrative and operational staff.",
|
|
"exploitability": "Phished or credential-stuffed administrative credentials can be used directly without secondary verification challenges.",
|
|
"status": "Partially existed"
|
|
}
|
|
]
|
|
|
|
def get_common_s3_misconfigurations():
|
|
return [
|
|
{
|
|
"title": "1. Public S3 Bucket via Overly Permissive ACL or Bucket Policy",
|
|
"description": "Buckets configured with `AllUsers` or `AuthenticatedUsers` read/write grants allow anyone on the Internet to list, download, or delete objects without valid credentials.",
|
|
"threat": "Mass data breach, unauthorized data tampering, or host compromise through uploaded malicious payloads.",
|
|
"safe_detection": "Run `aws --endpoint-url <S3_URL> s3api get-bucket-acl --bucket <bucket>` and `aws --endpoint-url <S3_URL> s3api get-bucket-policy --bucket <bucket>`. Or send unauthenticated `curl -sI <S3_URL>/<bucket>/` and check for HTTP 200.",
|
|
"remediation": "Apply S3 Block Public Access settings and enforce explicit deny in bucket policy:\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"EnforcePrivateBucket\",\n \"Effect\": \"Deny\",\n \"Principal\": \"*\",\n \"Action\": \"s3:*\",\n \"Resource\": [\n \"arn:aws:s3:::customer-data\",\n \"arn:aws:s3:::customer-data/*\"\n ],\n \"Condition\": {\n \"StringNotEquals\": {\n \"aws:PrincipalArn\": \"arn:aws:iam::account:role/StorageServiceRole\"\n }\n }\n }\n ]\n}\n```"
|
|
},
|
|
{
|
|
"title": "2. Missing Default Server-Side Encryption (SSE-S3 / SSE-KMS)",
|
|
"description": "Buckets created without mandatory default server-side encryption allow plaintext objects on underlying physical disk storage.",
|
|
"threat": "Data exposure if underlying physical media or disk snapshots are accessed directly outside the storage software layer.",
|
|
"safe_detection": "Run `aws --endpoint-url <S3_URL> s3api get-bucket-encryption --bucket <bucket>`. A `ServerSideEncryptionConfigurationNotFoundError` indicates encryption is not enforced.",
|
|
"remediation": "Enable default SSE-S3 (AES256) or SSE-KMS on the bucket:\n```bash\naws --endpoint-url <S3_URL> s3api put-bucket-encryption \\\n --bucket customer-data \\\n --server-side-encryption-configuration '{\"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]}'\n```"
|
|
},
|
|
{
|
|
"title": "3. Insecure Transport Allowed (Plaintext HTTP Access)",
|
|
"description": "Storage endpoints that accept plaintext HTTP requests without enforcing TLS encryption transmit credentials and sensitive data unencrypted across the network.",
|
|
"threat": "Man-in-the-Middle (MitM) packet interception, credential harvesting, and session hijacking.",
|
|
"safe_detection": "Send plaintext HTTP request: `curl -Iv http://<s3-host>/<bucket>/test.txt`. If connection succeeds without redirecting to HTTPS, insecure transport is permitted.",
|
|
"remediation": "Attach a bucket policy requiring `aws:SecureTransport: true` and configure reverse proxy to force 301 HTTPS redirection:\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"EnforceTLSRequestsOnly\",\n \"Effect\": \"Deny\",\n \"Principal\": \"*\",\n \"Action\": \"s3:*\",\n \"Resource\": [\"arn:aws:s3:::customer-data\", \"arn:aws:s3:::customer-data/*\"],\n \"Condition\": {\n \"Bool\": {\"aws:SecureTransport\": \"false\"}\n }\n }\n ]\n}\n```"
|
|
},
|
|
{
|
|
"title": "4. Disabled S3 Object Versioning and Missing MFA Delete",
|
|
"description": "Without object versioning, overwriting or deleting an object permanently destroys previous versions immediately. Lack of MFA delete allows rogue credentials to erase version history.",
|
|
"threat": "Ransomware data destruction, accidental administrative deletion, or insider threat tampering.",
|
|
"safe_detection": "Run `aws --endpoint-url <S3_URL> s3api get-bucket-versioning --bucket <bucket>`. Status should return `Enabled` and `MFADelete: Enabled`.",
|
|
"remediation": "Enable versioning via CLI:\n```bash\naws --endpoint-url <S3_URL> s3api put-bucket-versioning \\\n --bucket customer-data \\\n --versioning-configuration Status=Enabled\n```"
|
|
},
|
|
{
|
|
"title": "5. Overly Permissive Cross-Origin Resource Sharing (CORS) Policy",
|
|
"description": "CORS configurations specifying `AllowedOrigins: [\"*\"]` with credentials enabled or wildcard methods allow malicious websites to issue authenticated cross-origin requests.",
|
|
"threat": "Cross-origin data exfiltration from user browsers visiting attacker-controlled sites.",
|
|
"safe_detection": "Inspect CORS rules via `aws --endpoint-url <S3_URL> s3api get-bucket-cors --bucket <bucket>` and verify no `*` origins are combined with sensitive data access.",
|
|
"remediation": "Restrict `AllowedOrigins` strictly to verified application domains:\n```json\n{\n \"CORSRules\": [\n {\n \"AllowedHeaders\": [\"Authorization\", \"Content-Type\"],\n \"AllowedMethods\": [\"GET\", \"HEAD\"],\n \"AllowedOrigins\": [\"https://deploy.ghaymah.systems\"],\n \"MaxAgeSeconds\": 3600\n }\n ]\n}\n```"
|
|
},
|
|
{
|
|
"title": "6. Publicly Exposed MinIO / Storage Management Console",
|
|
"description": "Management web interfaces (e.g. MinIO Console on port 9001) exposed to the Internet provide an entry point for brute-force credential attacks or administrative vulnerabilities.",
|
|
"threat": "Full cluster compromise, deletion of all buckets, and infrastructure takeover.",
|
|
"safe_detection": "Probe host on port 9001: `curl -sI https://<host>:9001` or inspect `docker ps` to verify port 9001 is not bound to `0.0.0.0`.",
|
|
"remediation": "Unbind port 9001 from host public interface or bind strictly to `127.0.0.1`: \n```yaml\n# docker-compose.yml\nservices:\n minio:\n ports:\n - \"127.0.0.1:9001:9001\" # Bound strictly to loopback\n```"
|
|
},
|
|
{
|
|
"title": "7. Missing S3 Bucket Access Logging and Audit Streams",
|
|
"description": "Operating object storage without access logging means read, write, and deletion events are never permanently recorded.",
|
|
"threat": "Zero forensic visibility into unauthorized data access, intellectual property exfiltration, or tampering timelines.",
|
|
"safe_detection": "Run `aws --endpoint-url <S3_URL> s3api get-bucket-logging --bucket <bucket>`. An empty response indicates logging is inactive.",
|
|
"remediation": "Configure bucket logging to an isolated, append-only log bucket:\n```bash\naws --endpoint-url <S3_URL> s3api put-bucket-logging \\\n --bucket customer-data \\\n --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"audit-logs-immutable\", \"TargetPrefix\": \"customer-data-access/\"}}'\n```"
|
|
},
|
|
{
|
|
"title": "8. Overly Broad IAM Role Privileges (Wildcard Actions)",
|
|
"description": "Granting service accounts `s3:*` on `arn:aws:s3:::*` violates the principle of least privilege, enabling any compromised service to read, modify, and delete all cloud data.",
|
|
"threat": "Lateral movement across tenant boundaries and catastrophic data destruction.",
|
|
"safe_detection": "Audit IAM policy JSON documents using Checkov or jq, flagging any statement where `Action` contains `*` or `Resource` is unbounded.",
|
|
"remediation": "Scope IAM policies to exact prefixes and required API actions:\n```json\n{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\"s3:GetObject\", \"s3:PutObject\"],\n \"Resource\": \"arn:aws:s3:::app-data/tenant-${user_id}/*\"\n }\n ]\n}\n```"
|
|
},
|
|
{
|
|
"title": "9. Excessively Long Presigned URL Lifetimes",
|
|
"description": "Generating presigned URLs with long expiration windows (e.g. 7 days) means that if the URL is leaked in browser history, logs, or chat channels, unauthorized parties retain access for days.",
|
|
"threat": "Unauthorized object access via leaked URLs.",
|
|
"safe_detection": "Review application code generating presigned URLs (e.g. `get_presigned_url(expires_in=...)`) to ensure expiration <= 900 seconds (15 minutes).",
|
|
"remediation": "Enforce maximum 15-minute expiration in SDK configuration:\n```python\nurl = s3_client.generate_presigned_url(\n ClientMethod='get_object',\n Params={'Bucket': 'customer-data', 'Key': object_key},\n ExpiresIn=900 # 15 minutes max\n)\n```"
|
|
},
|
|
{
|
|
"title": "10. Missing S3 Object Malware & Ransomware Quarantine Pipeline",
|
|
"description": "Storage systems lacking automated antivirus/malware scanning allow users to store and distribute malicious executables or infected documents.",
|
|
"threat": "Platform weaponization, secondary infections of administrative workstations, and legal liability.",
|
|
"safe_detection": "Verify whether S3 bucket events trigger an AWS Lambda / containerized ClamAV scanning webhook upon `s3:ObjectCreated:*`.",
|
|
"remediation": "Deploy an automated ClamAV container or S3 event webhook that scans newly uploaded files, tagging infected files as `Quarantine` and revoking read permissions."
|
|
}
|
|
]
|
|
|
|
def get_common_web_misconfigurations():
|
|
return [
|
|
{
|
|
"title": "1. Missing HTTP Security Headers (HSTS, CSP, XFO, XCTO)",
|
|
"description": "Omitting browser security headers leaves users unprotected against Clickjacking, MIME confusion, and script injection attacks.",
|
|
"threat": "Clickjacking credential capture, reflected/stored XSS execution, and downgrade attacks.",
|
|
"safe_detection": "Execute `curl -sI https://<web-service>` and check for `Strict-Transport-Security`, `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`.",
|
|
"remediation": "Add security header directives to reverse proxy (Nginx):\n```nginx\n# /etc/nginx/conf.d/security_headers.conf\nadd_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;\nadd_header Content-Security-Policy \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-ancestors 'none';\" always;\nadd_header X-Frame-Options \"DENY\" always;\nadd_header X-Content-Type-Options \"nosniff\" always;\nadd_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\nadd_header Permissions-Policy \"camera=(), microphone=(), geolocation=()\" always;\n```"
|
|
},
|
|
{
|
|
"title": "2. Publicly Exposed Interactive API Documentation (Swagger /docs)",
|
|
"description": "Allowing unauthenticated access to Swagger UI (`/docs`, `/swagger-ui`) exposes API schemas, private parameters, and backend route names to potential adversaries.",
|
|
"threat": "Automated reconnaissance, zero-day parameter fuzzing, and model exploitation.",
|
|
"safe_detection": "Execute `curl -sI https://<service>/docs`. If HTTP 200 is returned, interactive documentation is open to the public.",
|
|
"remediation": "Disable docs in production or restrict behind authentication in FastAPI / Express:\n```python\n# FastAPI production configuration\nimport os\nfrom fastapi import FastAPI\n\napp = FastAPI(\n docs_url=None if os.getenv(\"ENV\") == \"production\" else \"/docs\",\n redoc_url=None,\n openapi_url=None if os.getenv(\"ENV\") == \"production\" else \"/openapi.json\"\n)\n```"
|
|
},
|
|
{
|
|
"title": "3. Containers Running with Default Root (UID 0) Privileges",
|
|
"description": "Running containers as root means any process compromise inside the container executes with root privileges, dramatically elevating container breakout risk.",
|
|
"threat": "Container breakout and host operating system compromise.",
|
|
"safe_detection": "Run `docker inspect --format '{{.Config.User}}' <container>`. If output is empty or `root`, container runs as root.",
|
|
"remediation": "Define and enforce a dedicated non-root user in Dockerfile:\n```dockerfile\nRUN addgroup -S appgroup && adduser -S appuser -G appgroup\nUSER appuser:appgroup\n```"
|
|
},
|
|
{
|
|
"title": "4. Retaining Default Linux Capabilities in Docker",
|
|
"description": "Docker assigns containers a default set of 14 Linux capabilities (e.g. `CAP_NET_RAW`, `CAP_MKNOD`, `CAP_CHOWN`), many of which are unnecessary for web workloads.",
|
|
"threat": "Exploitation of kernel privilege escalation vulnerabilities.",
|
|
"safe_detection": "Inspect container capabilities: `docker inspect --format '{{.HostConfig.CapDrop}}' <container>`.",
|
|
"remediation": "Drop all capabilities in `docker-compose.yml`:\n```yaml\nservices:\n web:\n image: ghaymah-web:prod\n cap_drop:\n - ALL\n cap_add:\n - NET_BIND_SERVICE\n```"
|
|
},
|
|
{
|
|
"title": "5. Container Filesystems Mounted Writable Without Read-Only Rootfs",
|
|
"description": "Writable root filesystems allow attackers with remote execution capabilities to download backdoors, compile exploits, or alter application files.",
|
|
"threat": "Persistent webshell placement and rootkit installation.",
|
|
"safe_detection": "Run `docker inspect --format '{{.HostConfig.ReadonlyRootfs}}' <container>`. Secure state is `true`.",
|
|
"remediation": "Mount root filesystem read-only with tmpfs for volatile paths in `docker-compose.yml`:\n```yaml\nservices:\n web:\n read_only: true\n tmpfs:\n - /tmp:rw,noexec,nosuid,size=64m\n - /app/run:rw,noexec,nosuid,size=16m\n```"
|
|
},
|
|
{
|
|
"title": "6. Plaintext Secrets Stored in Host Environment Files or Configs (CWE-312)",
|
|
"description": "Saving production API keys and database passwords in plaintext `.env` files or CLI `config.json` exposes them to any process or inspection command.",
|
|
"threat": "Token harvesting by malicious dependencies or unauthorized local users.",
|
|
"safe_detection": "Inspect `~/.ghaymah/config.json` or run `docker inspect --format '{{.Config.Env}}' <container>` for unmasked credentials.",
|
|
"remediation": "Use Docker Secrets or system credential vaults (Windows DPAPI / Linux Keyring) and file permissions `chmod 600`:\n```yaml\nservices:\n api:\n secrets:\n - db_password\nsecrets:\n db_password:\n file: ./secrets/db_password.txt\n```"
|
|
},
|
|
{
|
|
"title": "7. Absence of Dedicated Perimeter WAF with OWASP Core Rule Set",
|
|
"description": "Relying strictly on application code to sanitize inputs without edge WAF filtering means zero-day parser flaws can reach backend runtimes.",
|
|
"threat": "SQL injection, remote code execution (e.g. Log4j/Spring4Shell), and path traversal.",
|
|
"safe_detection": "Review reverse proxy modules or test benign test probe headers (`X-WAF-Probe`) to confirm absence of WAF inspection.",
|
|
"remediation": "Deploy Coraza WAF or ModSecurity with OWASP Core Rule Set (CRS 4.0) in blocking mode ahead of reverse proxy."
|
|
},
|
|
{
|
|
"title": "8. Inadequate Granular API Rate Limiting & Account Lockout",
|
|
"description": "Allowing unlimited requests to authentication endpoints permits automated dictionary attacks and credential stuffing.",
|
|
"threat": "Brute-force credential takeover and service degradation.",
|
|
"safe_detection": "Execute 20 rapid test requests to login endpoint; verify whether HTTP 429 is returned with `Retry-After` header.",
|
|
"remediation": "Configure rate limiting in Nginx reverse proxy:\n```nginx\nlimit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/m;\nlocation /api/v1/auth/login {\n limit_req zone=auth_limit burst=3 nodelay;\n proxy_pass http://auth_backend;\n}\n```"
|
|
},
|
|
{
|
|
"title": "9. Container Application Logs Not Ingested into Central SIEM",
|
|
"description": "Leaving container logs on host stdout prevents real-time correlation and security operations visibility.",
|
|
"threat": "Delayed or missed incident detection, inability to track attacker lateral movement.",
|
|
"safe_detection": "Verify SIEM agent configuration (`/var/ossec/etc/ossec.conf`) to ensure docker container logs are collected.",
|
|
"remediation": "Configure Docker logging driver to route to Fluentd / Promtail / Syslog, or configure Wazuh agent to collect container log files:\n```xml\n<localfile>\n <log_format>syslog</log_format>\n <location>/var/lib/docker/containers/*/*.log</location>\n</localfile>\n```"
|
|
},
|
|
{
|
|
"title": "10. Untested Disaster Recovery and Database Restoration Procedures",
|
|
"description": "Taking database backups without periodic verification drills leads to undetected backup corruption and catastrophic downtime during outages.",
|
|
"threat": "Total business disruption, permanent data loss upon disaster.",
|
|
"safe_detection": "Review historical audit tickets for verified recovery test drill sign-offs within the last 12 months.",
|
|
"remediation": "Implement automated weekly staging restore pipelines: spin up an ephemeral container, restore the latest backup, verify schema and row counts, and output a signed recovery test report."
|
|
}
|
|
]
|
|
|
|
def get_remediation_roadmap():
|
|
return [
|
|
{
|
|
"phase": "Phase 1: Immediate Critical & High Remediation (P0 - Days 1 to 7)",
|
|
"focus": "Perimeter Hardening, Secret Protection & Attack Surface Reduction",
|
|
"actions": [
|
|
"Implement all HTTP security headers (`Strict-Transport-Security`, `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`) on reverse proxy configuration for `deploy.ghaymah.systems`.",
|
|
"Disable public interactive Swagger UI (`/docs`, `/openapi.json`) on production GenAI service (`https://genai.ghaymah.systems/docs`) or restrict access behind internal VPN / admin auth.",
|
|
"Harden Ghaymah CLI client: Encrypt cached credentials in `~/.ghaymah/config.json` using OS native secure storage (DPAPI on Windows, Secret Service on Linux, Keychain on macOS) and restrict file permissions (`chmod 600`).",
|
|
"Enforce rate limiting on authentication and API routes via reverse proxy with HTTP 429 responses and Retry-After headers."
|
|
]
|
|
},
|
|
{
|
|
"phase": "Phase 2: Short-Term Architecture & Container Hardening (P1 - Days 8 to 30)",
|
|
"focus": "Container Security, Least Privilege & Storage Isolation",
|
|
"actions": [
|
|
"Transition all Docker containers to run as dedicated non-root users (`USER appuser`) and codify `cap_drop: [ALL]` in Docker Compose.",
|
|
"Configure container read-only root filesystems (`read_only: true`) with isolated, size-limited tmpfs mounts.",
|
|
"Migrate plain environment variable secrets to native Docker Secrets or HashiCorp Vault.",
|
|
"Enforce S3 bucket default server-side encryption (SSE-S3 AES-256) and attach mandatory `aws:SecureTransport: true` bucket policies.",
|
|
"Enable S3 object versioning and MFA delete across all production storage namespaces."
|
|
]
|
|
},
|
|
{
|
|
"phase": "Phase 3: Medium-Term Monitoring, WAF & Incident Readiness (P2 - Days 31 to 60)",
|
|
"focus": "Detection Engineering, SIEM Integration & Continuous Security",
|
|
"actions": [
|
|
"Deploy a dedicated Web Application Firewall (WAF) running OWASP Core Rule Set (CRS) in active blocking mode ahead of reverse proxy.",
|
|
"Integrate Docker container application logs and S3 audit logs (`minio audit webhook`) into centralized Wazuh SIEM.",
|
|
"Develop and codify dedicated Incident Response Playbooks for S3 data leakage, account compromise, and container isolation.",
|
|
"Implement automated CI/CD security scanning gates (SAST via Semgrep, SCA via Dependabot, Container Scanning via Trivy) with build-blocking thresholds."
|
|
]
|
|
},
|
|
{
|
|
"phase": "Phase 4: Long-Term Governance & Compliance Assurance (P3 - Days 61 to 90)",
|
|
"focus": "Compliance Recertification, DR Testing & Continuous Assurance",
|
|
"actions": [
|
|
"Formalize and publish the standalone Cloud Storage Security Policy and Web Application Security Policy with annual executive sign-off.",
|
|
"Establish a formal automated Disaster Recovery restoration exercise pipeline validating backup integrity on a recurring quarterly schedule.",
|
|
"Codify semi-annual User Access Reviews (UAR) and enforce mandatory MFA for all operational personnel.",
|
|
"Deploy continuous Cloud Security Posture Management (CSPM) to automatically audit storage and web configurations against CIS benchmarks."
|
|
]
|
|
}
|
|
]
|