Submit complete Ghaymah SecOps exam solution

common-qabilah/qabilah-profile.txt

@@ -0,0 +1,4 @@
+Qabilah Profile URL: https://qabilah.com/profile/waleedwael816/professional-profile
+Username: waleedwael816
+Track: SecOps — Security Operations
+Status: Following Ghaymah Official Account

q1-audit/audit-checklist.md

@@ -0,0 +1,26 @@
+# Ghaymah Security Audit Checklist (15 Items)
+
+## 1. Container Security
+1. **Minimal Base Images**: Use distroless or minimal Alpine images from trusted registries to reduce attack surface.
+2. **Non-Root Execution**: Configure `securityContext.runAsNonRoot: true` in deployment manifests to prevent container privilege escalation.
+3. **Container Image Scanning**: Integrate vulnerability scanners (e.g., Trivy/Grype) into the CI/CD pipeline before pushing to Ghaymah Container Registry.
+
+## 2. Network Security
+4. **Kubernetes Network Policies**: Enforce strict ingress/egress rules allowing inter-service communication only on required ports.
+5. **TLS Encryption in Transit**: Mandate TLS 1.3 / mTLS for all microservices communication managed via Ghaymah Ingress Controller.
+6. **Port & Interface Restriction**: Close unneeded open ports (e.g., SSH, DB ports) on public IPs, exposing only 80/443 via reverse proxy.
+
+## 3. OWASP Top 5 Mitigation
+7. **Broken Access Control**: Enforce RBAC at API Gateway layer and validate JWT claims on every endpoint.
+8. **Cryptographic Failures**: Encrypt data at rest on Ghaymah Block Storage using AES-256 with automated KMS key rotation.
+9. **Injection Protection**: Deploy Ghaymah Web Application Firewall (WAF) to filter SQLi, Command Injection, and XSS payloads.
+10. **Insecure Design**: Implement threat modeling and adhere to Least Privilege access policies during architecture design.
+11. **Security Misconfiguration**: Disable verbose stack traces/debug modes and obscure Server/OS headers.
+
+## 4. Data & Storage Security
+12. **Secrets Management**: Retrieve API keys and DB credentials dynamically using Ghaymah Secrets Manager instead of hardcoding.
+13. **Immutable Backups**: Utilize Ghaymah Backup to create WORM (Write Once Read Many) encrypted snapshots.
+
+## 5. Identity & Access Management (IAM)
+14. **Enforce MFA**: Require Multi-Factor Authentication for all Ghaymah Cloud console and CLI management accounts.
+15. **Privilege Auditing**: Perform automated 30-day reviews to revoke stale credentials and unused service accounts.

q1-audit/ghaymah-checker.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# Ghaymah Security Auto-Checker Script
+
+TARGET="ghaymah.systems"
+PORT_CHECK_RANGE="80 443 22 8080 3306"
+
+echo "=========================================="
+echo "  Ghaymah Security Audit Tool - SecOps   "
+echo "=========================================="
+echo "Target: $TARGET"
+echo "------------------------------------------"
+
+# 1. Check Ports
+echo "[+] 1. Checking Open Ports..."
+for port in $PORT_CHECK_RANGE; do
+    timeout 2 nc -z -v $TARGET $port 2>&1 | grep -E "open|succeeded" && echo "  - Port $port is OPEN" || echo "  - Port $port is CLOSED"
+done
+
+echo "------------------------------------------"
+
+# 2. Check SSL/TLS
+echo "[+] 2. Checking SSL/TLS Certificate..."
+SSL_INFO=$(echo | openssl s_client -servername $TARGET -connect $TARGET:443 2>/dev/null | openssl x509 -noout -dates 2>/dev/null)
+if [ -n "$SSL_INFO" ]; then
+    echo "$SSL_INFO"
+else
+    echo "  [!] Failed to retrieve SSL Certificate info for $TARGET"
+fi
+
+echo "------------------------------------------"
+
+# 3. Check Security Headers
+echo "[+] 3. Checking Security Headers..."
+HEADERS=$(curl -sI https://$TARGET)
+
+check_header() {
+    HEADER_NAME=$1
+    echo "$HEADERS" | grep -iq "$HEADER_NAME" && echo "  [✓] $HEADER_NAME Enabled" || echo "  [✗] $HEADER_NAME Missing!"
+}
+
+check_header "Strict-Transport-Security"
+check_header "X-Content-Type-Options"
+check_header "X-Frame-Options"
+check_header "Content-Security-Policy"
+
+echo "=========================================="
+echo "Audit Execution Completed."

q2-incident-response/alert-rules.yaml

@@ -0,0 +1,12 @@
+groups:
+  - name: ghaymah-secops-alerts
+    rules:
+      - alert: HighFailedLoginAttempts
+        expr: sum(rate(http_requests_total{status="401", path="/api/v1/auth/login"}[2m])) by (client_ip) > 10
+        for: 1m
+        labels:
+          severity: critical
+          category: security
+        annotations:
+          summary: "Brute Force Attack Detected from IP {{ $labels.client_ip }}"
+          description: "IP {{ $labels.client_ip }} generated over 10 failed login attempts within 2 minutes on Ghaymah API."

q2-incident-response/incident-report.md

@@ -0,0 +1,16 @@
+# Incident Response & Attack Analysis Report
+
+## 1. Attack Timeline
+- **T+00:00 (Reconnaissance)**: Attacker discovered `/api/v1/auth/login` endpoint via automated API scanning.
+- **T+00:10 (Brute Force Execution)**: Attacker initiated high-velocity credential stuffing from distributed IPs (bypassing basic rate limits).
+- **T+00:45 (Account Compromise)**: Successful login on an admin account due to weak password policy and missing MFA.
+- **T+01:05 (Exfiltration)**: Unauthorized API access using compromised session JWT to exfiltrate database records.
+
+## 2. Incident Response Plan (IRP)
+1. **Containment**: Revoke all active JWT tokens, enforce IP-based rate limiting on Ghaymah Ingress, and lock compromised user accounts.
+2. **Eradication**: Block malicious IP ranges via Ghaymah WAF, patch authentication endpoints with MFA, and enforce strong password policies.
+3. **Recovery**: Restore verified state, validate patch integrity, and monitor API traffic for anomaly resurgences over 48 hours.
+
+## 3. Prevention on Ghaymah Infrastructure
+- **Network Policies**: Deploy rate-limiting rules at Ghaymah Ingress Controller (max 5 failed attempts/min per IP).
+- **Container Security**: Enforce readonly root filesystems and minimal container privileges to restrict lateral movement.

q3-privacy-mithal/privacy-report.md

@@ -0,0 +1,22 @@
+# Privacy Assessment Report: mithal.space
+
+## 1. DevTools Technical Audit
+- **Cookies**: No third-party tracking cookies detected. Only essential session cookies with `HttpOnly` and `Secure` flags.
+- **HTTPS & SSL**: Enforced TLS 1.3 encryption with strong cipher suites.
+- **Security Headers**:
+  - `Strict-Transport-Security`: Enforced
+  - `X-Content-Type-Options: nosniff`: Enforced
+  - `Referrer-Policy: no-referrer`: Active (prevents query leakage to external destination sites).
+
+## 2. Privacy Comparison
+
+| Feature | mithal.space | DuckDuckGo | Google |
+| :--- | :--- | :--- | :--- |
+| **User Tracking** | None | No Ad Tracking | Extensive Profiling |
+| **Search Query Logs** | Disassociated from IP | Disassociated from IP | Linked to Account/IP |
+| **Hosting Jurisdiction**| Sovereign Ghaymah Cloud | US / EU Servers | Global Ad Infrastructure |
+
+## 3. Proposed Security & Privacy Enhancements
+1. **Tor Onion Service Deployment**: Provide a `.onion` endpoint for maximum user anonymity.
+2. **DNS-over-HTTPS (DoH)**: Integrate dedicated DoH resolver to prevent ISP query sniffing.
+3. **Zero-Log Storage Policy**: Implement automated log flushing on Ghaymah Block Storage every 10 minutes.

q4-siem/dashboard.html

@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html lang="ar" dir="rtl">
+<head>
+    <meta charset="UTF-8">
+    <title>Ghaymah Mini SIEM Dashboard</title>
+    <style>
+        body { font-family: sans-serif; background-color: #0f172a; color: #f8fafc; padding: 20px; }
+        .card { background: #1e293b; padding: 20px; border-radius: 8px; margin-bottom: 20px; }
+        h1 { color: #38bdf8; }
+        table { width: 100%; border-collapse: collapse; margin-top: 10px; }
+        th, td { padding: 12px; border: 1px solid #334155; text-align: right; }
+        th { background-color: #334155; }
+        .CRITICAL { color: #ef4444; font-weight: bold; }
+        .HIGH { color: #f97316; font-weight: bold; }
+    </style>
+</head>
+<body>
+    <h1>🛡️ منصة غيمة — لوحة تنبيهات SIEM</h1>
+    <div class="card">
+        <h3>التنبيهات الأمنية المكتشفة</h3>
+        <table>
+            <thead>
+                <tr>
+                    <th>مستوى الخطورة</th>
+                    <th>نوع الهجوم</th>
+                    <th>عنوان IP</th>
+                    <th>التفاصيل</th>
+                </tr>
+            </thead>
+            <tbody>
+                <tr>
+                    <td class="CRITICAL">CRITICAL</td>
+                    <td>Web Attack (SQLi)</td>
+                    <td>103.15.28.1</td>
+                    <td>SQL Injection pattern detected: UNION SELECT</td>
+                </tr>
+                <tr>
+                    <td class="HIGH">HIGH</td>
+                    <td>Brute Force Detected</td>
+                    <td>45.33.32.156</td>
+                    <td>Multiple failed logins (3 times)</td>
+                </tr>
+            </tbody>
+        </table>
+    </div>
+</body>
+</html>

q4-siem/siem.py

@@ -0,0 +1,44 @@
+import json
+
+logs_data = [
+    '{"source": "Nginx", "timestamp": "2026-07-27T01:00:01", "ip": "192.168.1.10", "status": 200, "message": "GET /index.html"}',
+    '{"source": "Auth", "timestamp": "2026-07-27T01:00:05", "ip": "45.33.32.156", "status": 401, "message": "Failed login for admin"}',
+    '{"source": "Auth", "timestamp": "2026-07-27T01:00:06", "ip": "45.33.32.156", "status": 401, "message": "Failed login for admin"}',
+    '{"source": "Auth", "timestamp": "2026-07-27T01:00:07", "ip": "45.33.32.156", "status": 401, "message": "Failed login for admin"}',
+    '{"source": "WAF", "timestamp": "2026-07-27T01:00:10", "ip": "103.15.28.1", "status": 403, "message": "SQL Injection pattern detected: UNION SELECT"}'
+]
+
+failed_attempts = {}
+alerts = []
+
+def analyze_logs():
+    for entry in logs_data:
+        log = json.loads(entry)
+        ip = log.get("ip")
+        msg = log.get("message", "")
+        status = log.get("status")
+
+        if status == 401:
+            failed_attempts[ip] = failed_attempts.get(ip, 0) + 1
+            if failed_attempts[ip] >= 3:
+                alerts.append({
+                    "severity": "HIGH",
+                    "type": "Brute Force Detected",
+                    "ip": ip,
+                    "details": f"Multiple failed logins ({failed_attempts[ip]} times)"
+                })
+
+        if "SQL" in msg or "UNION SELECT" in msg:
+            alerts.append({
+                "severity": "CRITICAL",
+                "type": "Web Attack (SQLi)",
+                "ip": ip,
+                "details": msg
+            })
+
+    with open("q4-siem/alerts.json", "w", encoding="utf-8") as f:
+        json.dump(alerts, f, indent=2)
+    print("[✓] SIEM Analysis Complete. Alerts generated in q4-siem/alerts.json")
+
+if __name__ == "__main__":
+    analyze_logs()