Submit complete Ghaymah SecOps exam solution

q1-audit/audit-checklist.md

@@ -0,0 +1,26 @@
+# Ghaymah Security Audit Checklist (15 Items)
+
+## 1. Container Security
+1. **Minimal Base Images**: Use distroless or minimal Alpine images from trusted registries to reduce attack surface.
+2. **Non-Root Execution**: Configure `securityContext.runAsNonRoot: true` in deployment manifests to prevent container privilege escalation.
+3. **Container Image Scanning**: Integrate vulnerability scanners (e.g., Trivy/Grype) into the CI/CD pipeline before pushing to Ghaymah Container Registry.
+
+## 2. Network Security
+4. **Kubernetes Network Policies**: Enforce strict ingress/egress rules allowing inter-service communication only on required ports.
+5. **TLS Encryption in Transit**: Mandate TLS 1.3 / mTLS for all microservices communication managed via Ghaymah Ingress Controller.
+6. **Port & Interface Restriction**: Close unneeded open ports (e.g., SSH, DB ports) on public IPs, exposing only 80/443 via reverse proxy.
+
+## 3. OWASP Top 5 Mitigation
+7. **Broken Access Control**: Enforce RBAC at API Gateway layer and validate JWT claims on every endpoint.
+8. **Cryptographic Failures**: Encrypt data at rest on Ghaymah Block Storage using AES-256 with automated KMS key rotation.
+9. **Injection Protection**: Deploy Ghaymah Web Application Firewall (WAF) to filter SQLi, Command Injection, and XSS payloads.
+10. **Insecure Design**: Implement threat modeling and adhere to Least Privilege access policies during architecture design.
+11. **Security Misconfiguration**: Disable verbose stack traces/debug modes and obscure Server/OS headers.
+
+## 4. Data & Storage Security
+12. **Secrets Management**: Retrieve API keys and DB credentials dynamically using Ghaymah Secrets Manager instead of hardcoding.
+13. **Immutable Backups**: Utilize Ghaymah Backup to create WORM (Write Once Read Many) encrypted snapshots.
+
+## 5. Identity & Access Management (IAM)
+14. **Enforce MFA**: Require Multi-Factor Authentication for all Ghaymah Cloud console and CLI management accounts.
+15. **Privilege Auditing**: Perform automated 30-day reviews to revoke stale credentials and unused service accounts.

q1-audit/ghaymah-checker.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# Ghaymah Security Auto-Checker Script
+
+TARGET="ghaymah.systems"
+PORT_CHECK_RANGE="80 443 22 8080 3306"
+
+echo "=========================================="
+echo "  Ghaymah Security Audit Tool - SecOps   "
+echo "=========================================="
+echo "Target: $TARGET"
+echo "------------------------------------------"
+
+# 1. Check Ports
+echo "[+] 1. Checking Open Ports..."
+for port in $PORT_CHECK_RANGE; do
+    timeout 2 nc -z -v $TARGET $port 2>&1 | grep -E "open|succeeded" && echo "  - Port $port is OPEN" || echo "  - Port $port is CLOSED"
+done
+
+echo "------------------------------------------"
+
+# 2. Check SSL/TLS
+echo "[+] 2. Checking SSL/TLS Certificate..."
+SSL_INFO=$(echo | openssl s_client -servername $TARGET -connect $TARGET:443 2>/dev/null | openssl x509 -noout -dates 2>/dev/null)
+if [ -n "$SSL_INFO" ]; then
+    echo "$SSL_INFO"
+else
+    echo "  [!] Failed to retrieve SSL Certificate info for $TARGET"
+fi
+
+echo "------------------------------------------"
+
+# 3. Check Security Headers
+echo "[+] 3. Checking Security Headers..."
+HEADERS=$(curl -sI https://$TARGET)
+
+check_header() {
+    HEADER_NAME=$1
+    echo "$HEADERS" | grep -iq "$HEADER_NAME" && echo "  [✓] $HEADER_NAME Enabled" || echo "  [✗] $HEADER_NAME Missing!"
+}
+
+check_header "Strict-Transport-Security"
+check_header "X-Content-Type-Options"
+check_header "X-Frame-Options"
+check_header "Content-Security-Policy"
+
+echo "=========================================="
+echo "Audit Execution Completed."