27 أسطر
2.0 KiB
Markdown
27 أسطر
2.0 KiB
Markdown
# Ghaymah Security Audit Checklist (15 Items)
|
|
|
|
## 1. Container Security
|
|
1. **Minimal Base Images**: Use distroless or minimal Alpine images from trusted registries to reduce attack surface.
|
|
2. **Non-Root Execution**: Configure `securityContext.runAsNonRoot: true` in deployment manifests to prevent container privilege escalation.
|
|
3. **Container Image Scanning**: Integrate vulnerability scanners (e.g., Trivy/Grype) into the CI/CD pipeline before pushing to Ghaymah Container Registry.
|
|
|
|
## 2. Network Security
|
|
4. **Kubernetes Network Policies**: Enforce strict ingress/egress rules allowing inter-service communication only on required ports.
|
|
5. **TLS Encryption in Transit**: Mandate TLS 1.3 / mTLS for all microservices communication managed via Ghaymah Ingress Controller.
|
|
6. **Port & Interface Restriction**: Close unneeded open ports (e.g., SSH, DB ports) on public IPs, exposing only 80/443 via reverse proxy.
|
|
|
|
## 3. OWASP Top 5 Mitigation
|
|
7. **Broken Access Control**: Enforce RBAC at API Gateway layer and validate JWT claims on every endpoint.
|
|
8. **Cryptographic Failures**: Encrypt data at rest on Ghaymah Block Storage using AES-256 with automated KMS key rotation.
|
|
9. **Injection Protection**: Deploy Ghaymah Web Application Firewall (WAF) to filter SQLi, Command Injection, and XSS payloads.
|
|
10. **Insecure Design**: Implement threat modeling and adhere to Least Privilege access policies during architecture design.
|
|
11. **Security Misconfiguration**: Disable verbose stack traces/debug modes and obscure Server/OS headers.
|
|
|
|
## 4. Data & Storage Security
|
|
12. **Secrets Management**: Retrieve API keys and DB credentials dynamically using Ghaymah Secrets Manager instead of hardcoding.
|
|
13. **Immutable Backups**: Utilize Ghaymah Backup to create WORM (Write Once Read Many) encrypted snapshots.
|
|
|
|
## 5. Identity & Access Management (IAM)
|
|
14. **Enforce MFA**: Require Multi-Factor Authentication for all Ghaymah Cloud console and CLI management accounts.
|
|
15. **Privilege Auditing**: Perform automated 30-day reviews to revoke stale credentials and unused service accounts.
|