This document establishes the comprehensive cybersecurity posture, threat models, hardening benchmarks, cryptographic baselines, detection-and-response procedures, and cloud cost guardrails governing the stefanutc1/infrastructure platform.

Built on the principles of Defense-in-Depth, Least Privilege, and Zero Trust Architecture, the platform protects 24/7 household services while providing isolated, hardened proving grounds for academic cybersecurity research, digital forensics, and penetration testing.

1. Symmetric Cryptography: AES-256-GCM and ChaCha20-Poly1305 only. Legacy 3DES, DES, and RC4 algorithms are blacklisted across all services.
2. Asymmetric Cryptography:
   • SSH Keys: OpenSSH ed25519 keys only; RSA keys <3072 bits rejected.
   • TLS Certificates: ECDSA (secp256r1 / secp384r1) and RSA 4096-bit for offline Root CA.
3. Transport Encryption: TLS 1.3 enforced by default; TLS 1.0, 1.1, and unencrypted HTTP strictly prohibited on external ingress.
4. Internal PKI: Smallstep step-ca manages short-lived leaf certificates with automated renewal via ACME protocol.

The repository enforces a Zero-Plaintext Policy:

• Automated CI Gates: Gitleaks and TruffleHog scan every pull request and push in the CI matrix (.github/workflows/ci.yml).
• Storage Standards:
  • Production passwords, tokens, and private keys reside in local environment files (.env) excluded via .gitignore.
  • Shared repository secrets use Mozilla SOPS with age public-key encryption.
• Immediate Revocation: Any key or token detected in repository commit history must be considered instantly compromised and revoked within 60 minutes.

       Security Events (Host Logs, Syslog, Network Packets, Auth Failures)
                                     │
                 ┌───────────────────┴───────────────────┐
                 ▼                                       ▼
       Wazuh HIDS Agents                       Suricata NIDS Engine
     (File Integrity, Sudo, Auth)           (DPI, Snort/Suricata Rules)
                 │                                       │
                 ▼                                       ▼
       Wazuh SIEM Manager (CT 106)              OPNsense Alert Log
                 │                                       │
                 └───────────────────┬───────────────────┘
                                     │
                                     ▼
                          CrowdSec Remediation
                                     │
                 ┌───────────────────┴───────────────────┐
                 ▼                                       ▼
      OPNsense Packet Drop                  Uptime Kuma & ntfy Alert

1. Wazuh HIDS / SIEM Server (CT 106):
   • Collects real-time security events, file integrity changes (FIM), and CIS benchmark audit results across all Linux and Windows nodes.
   • Automated Active Response: Repeated SSH brute-force attempts trigger an automated host-level drop rule via iptables.
2. Suricata Network IDS/IPS (VM 200):
   • Deep packet inspection operating inline on the OPNsense perimeter firewall.
   • Active rulesets inspect internal transit and external uplinks for command-and-control (C2) beaconing, SQL injection, and banking malware signatures.
3. CrowdSec Threat Intelligence:
   • Ingests consensus threat intelligence from the CrowdSec security community.
   • Bouncers installed on OPNsense proactively block known malicious scanners and residential proxy IP addresses.

To prevent unexpected billing liabilities and resource sprawl when staging hybrid cloud architectures:

1. Free-Tier Static Whitelist: Terraform configurations in cloud/aws, cloud/gcp, and cloud/azure are restricted to zero-cost instance tiers (t2.micro, t3.micro, t4g.small, e2-micro, Standard_B1s).
2. Billable Resource Ban: NAT Gateways, paid ALBs, provisioned IOPS (io1, io2), and unattached elastic IPs are strictly prohibited.
3. Automated CI Enforcement:
   • Python static analyzer: python3 scripts/verify_zero_cloud_cost.py (exit code 0 required).
   • Policy-as-Code: Open Policy Agent (OPA) / Conftest executing policy/cloud/zero_cost_policy.rego.
4. Cloud Storage Hygiene: S3 / GCS buckets must enforce block_public_acls = true, block_public_policy = true, and default server-side encryption (AES-256).

1. Static Analysis Security Testing (SAST):
   • Trivy scans infrastructure filesystem configs, Dockerfiles, and Terraform modules for known CVEs.
   • Checkov verifies Terraform modules against CIS and cloud security posture benchmarks.
2. Automated Dependency Updates:
   • Dependabot actively audits npm, Python, GitHub Actions, and Docker dependencies on a weekly schedule (.github/dependabot.yml).
   • Dependabot pull requests require 100% CI check passes prior to merging.

If you discover a potential security vulnerability within this infrastructure codebase, please report it via private disclosure:

• Email: security@stefanut.lan / GitHub Security Advisory.
• Please include reproduction steps, affected commit SHA, and remediation suggestions.
• Do not publicly disclose vulnerabilities until a verified patch has been merged.