Skip to content

docs(security): publish hardening readiness report for findings 8-14 #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
careb36 merged 1 commit into from
Apr 2, 2026
Merged

docs(security): publish hardening readiness report for findings 8-14 #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,11 @@ It is designed to serve three audiences:
- `docs/operations/README.md` - operations index
- `docs/operations/monitor-operations-runbook.md` - operational runbook

#### Security Reports

- `docs/reports/SECURITY-AUDIT.md` - baseline security assessment and findings catalog
- `docs/reports/SECURITY-HARDENING-READINESS.md` - current closure/readiness status for findings #8-#14

### Recommended Reading Paths

#### For executives or architects
Expand Down Expand Up @@ -134,6 +139,11 @@ Esta dise�ado para tres audiencias:
- `docs/operations/README.md` - indice operativo
- `docs/operations/monitor-operations-runbook.md` - runbook operativo

#### Reportes de Seguridad

- `docs/reports/SECURITY-AUDIT.md` - evaluacion base de seguridad y catalogo de hallazgos
- `docs/reports/SECURITY-HARDENING-READINESS.md` - estado actual de cierre/readiness para hallazgos #8-#14

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the Spanish documentation map entry, the description mixes languages ("cierre/readiness"). Consider using a single term (e.g., fully Spanish wording) to keep the index consistent and easier to scan for Spanish readers.

Suggested change
- `docs/reports/SECURITY-HARDENING-READINESS.md` - estado actual de cierre/readiness para hallazgos #8-#14
- `docs/reports/SECURITY-HARDENING-READINESS.md` - estado actual de cierre y preparación para hallazgos #8-#14

Copilot uses AI. Check for mistakes.

### Rutas de Lectura Recomendadas

#### Para ejecutivos o arquitectos
Expand Down
84 changes: 84 additions & 0 deletions docs/reports/SECURITY-HARDENING-READINESS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
# Security Hardening Readiness Report

Date: 2026-04-02
Scope: Remaining findings from SECURITY-AUDIT.md (#8 to #14)
Target branch: develop

## Executive Summary
Security hardening phases for findings #8 to #14 were implemented across CI/CD, backend configuration, Docker runtime exposure, Kafka secure-mode rollout, and operational controls.

Readiness conclusion:
- Develop environment: READY with compensating controls
- Production promotion: CONDITIONALLY READY, requires secure-mode enforcement decision for Kafka (mandatory SASL_SSL cutover)

## Findings Status Matrix

| Finding | Severity | Status | Evidence |
|---|---|---|---|
| #8 (deploy pipeline skips tests) | HIGH | Closed | `.github/workflows/deploy.yml` uses `mvn --batch-mode clean verify -Powasp` |

Copilot AI Apr 2, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The evidence for finding #8 references the deploy workflow command as mvn --batch-mode clean verify -Powasp, but the current deploy.yml invocation also includes additional required flags (e.g., -DnvdApiKey=...). To keep this report auditable and copy/paste accurate, consider reflecting the full command (or explicitly noting that additional flags are passed via secrets).

Suggested change
| #8 (deploy pipeline skips tests) | HIGH | Closed | `.github/workflows/deploy.yml` uses `mvn --batch-mode clean verify -Powasp` |
| #8 (deploy pipeline skips tests) | HIGH | Closed | `.github/workflows/deploy.yml` runs \`mvn --batch-mode clean verify -Powasp\` with additional required flags (e.g., \`-DnvdApiKey\` via secrets) |

Copilot uses AI. Check for mistakes.
| #9 (Jackson hardening) | MEDIUM | Closed | `src/main/java/com/monitor/config/JacksonConfig.java` enforces unknown-property fail and disables default typing |
| #10 (Oracle privilege/user hardcoding) | MEDIUM | Mitigated | `docker/oracle/init.sql` parameterized user/schema references, reduced hardcoded account coupling |
| #11 (Docker port exposure) | MEDIUM | Closed | `docker-compose.yml` binds exposed ports to localhost by default (`127.0.0.1`) |
| #12 (Kafka plaintext transport) | MEDIUM | Mitigated with rollout controls | `docker-compose.secure.yml` + secure scripts + preflight + smoke + acceptance checklist |
| #13 (dependency hygiene) | LOW | Closed | `pom.xml` duplicate security dependency removed |
| #14 (secret file protection) | LOW | Closed | `.gitignore` includes secret patterns and constrained exceptions for tracked placeholders |

## Implemented Controls (Phase Trace)

### CI/CD and dependency gates
- Production deploy workflow executes full verification with OWASP profile.
- Dependency check and enforcer are integrated in Maven build lifecycle.

### Serialization hardening
- ObjectMapper hardened with:
- `FAIL_ON_UNKNOWN_PROPERTIES`
- `deactivateDefaultTyping()`
- restricted visibility configuration

### Database/script hardening
- Oracle init script no longer depends on hardcoded schema/user references for grants and DDL context.
- Current schema is parameterized via `&MONITOR_APP_USER`.

### Runtime exposure reduction
- Container ports default-bind to loopback host, reducing accidental external exposure in local/proxy-hosted environments.

### Kafka secure transport rollout controls
Implemented artifacts:
- `docker-compose.secure.yml`
- `scripts/kafka-generate-secrets.sh`
- `scripts/kafka-bootstrap-scram-users.sh`
- `scripts/kafka-secure-preflight.sh`
- `scripts/kafka-enable-secure-mode.sh`
- `scripts/kafka-secure-smoke.sh`
- `docs/operations/kafka-sasl-ssl-quickstart.md`
- `docs/operations/kafka-sasl-ssl-troubleshooting.md`
- `docs/operations/kafka-sasl-ssl-acceptance-checklist.md`

These controls establish an auditable path to run Kafka in SASL_SSL and validate it before promotion.

## Residual Risk

### Finding #12 residual risk
Base compose remains PLAINTEXT-compatible by default to preserve backward compatibility and low-risk local onboarding. This is acceptable for staged rollout but should not be the final production posture.

Residual risk rating: Medium (operationally controlled, not yet hard-enforced by default)

## Release Decision

For develop:
- APPROVED

For production:
- APPROVED WITH CONDITION

Condition to fully close finding #12 in production:
1. Enforce secure overlay in production deployment path.
2. Remove PLAINTEXT listener usage from production runtime configuration.
3. Attach smoke/preflight evidence artifacts in release PR.

## Evidence Checklist for Release PR
- Output of `./scripts/kafka-secure-preflight.sh`
- Output of `./scripts/kafka-secure-smoke.sh`
- `docker compose ps` with secure overlay
- Last 200 lines of logs for `kafka`, `kafka-connect`, `backend`
- Confirmation that deploy pipeline uses verify + OWASP profile
Loading