POLICY STATEMENT
├── Subject: Who (User, Service, Device)
├── Action: What (Read, Write, Delete, Execute)
├── Resource: Which (Data, Service, API)
├── Environment: Where (Network, Location, Time)
└── Decision: Allow or Deny (with conditions)

USER LIFECYCLE
├── Onboarding
│   ├── Identity creation
│   ├── Attribute assignment
│   ├── Credential issuance
│   └── Access provisioning
├── Active
│   ├── Authentication
│   ├── Access management
│   ├── Profile updates
│   └── Activity monitoring
├── Suspension
│   ├── Temporary suspension
│   ├── Access revocation
│   └── Notification
└── Offboarding
    ├── Identity deletion
    ├── Access revocation
    ├── Data transfer
    └── Audit logging

USER REQUEST
    │
    ▼
┌─────────────────────────────────────┐
│ 1. AUTHENTICATION                   │
│    - Verify user identity           │
│    - MFA check                      │
│    - Session creation               │
└─────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────┐
│ 2. AUTHORIZATION                    │
│    - Check permissions              │
│    - Evaluate policies              │
│    - Apply conditions               │
└─────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────┐
│ 3. ACCESS GRANTED/DENIED            │
│    - Resource access                │
│    - Logging                        │
│    - Monitoring                     │
└─────────────────────────────────────┘

ORGANIZATIONAL ROLE HIERARCHY

CEO
├── VP Engineering
│   ├── Engineering Manager
│   │   ├── Senior Engineer
│   │   └── Junior Engineer
│   └── Architect
├── VP Operations
│   ├── Operations Manager
│   │   ├── System Administrator
│   │   └── Network Engineer
│   └── Security Officer
└── VP Finance
    ├── Finance Manager
    │   ├── Accountant
    │   └── Auditor
    └── Compliance Officer

ROLE: Exam_Administrator

PERMISSIONS:
    - Create_Exam:
        Resource: ExamDatabase
        Action: INSERT
    - Modify_Exam:
        Resource: ExamDatabase
        Action: UPDATE
        Condition: status = 'DRAFT'
    - Grade_Exam:
        Resource: ExamDatabase
        Action: UPDATE
        Condition: status = 'SUBMITTED'
    - View_Results:
        Resource: ExamDatabase
        Action: SELECT
        Condition: exam_completed = TRUE

CONSTRAINTS:
    - MFA required for all actions
    - Cannot grade own exam
    - All actions logged
    - Session timeout: 30 minutes

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::student-documents/*",
        "arn:aws:s3:::student-documents"
      ]
    },
    {
      "Effect": "Deny",
      "Action": [
        "s3:DeleteObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::student-documents/*"
    }
  ]
}

{
  "properties": {
    "roleName": "Exam Grader",
    "description": "Can view and grade student exams",
    "assignableScopes": [
      "/subscriptions/xxx/resourceGroups/exam-env"
    ],
    "permissions": [
      {
        "actions": [
          "Microsoft.Storage/storageAccounts/blobServices/containers/read",
          "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
        ],
        "notActions": [
          "Microsoft.Storage/storageAccounts/blobServices/containers/delete"
        ]
      }
    ]
  }
}

Tenant-Aware Roles
├── Tenant Admin
│   └── Manage resources within tenant
├── Tenant User
│   └── Access own tenant resources
├── Tenant Auditor
│   └── View logs within tenant
└── Global Admin
    └── Manage all tenants

TOTP GENERATION FLOW

SECRET KEY (shared)
    │
    ▼
┌─────────────────────────────────────┐
│ HMAC-SHA1(secret, current_time)    │
│                                     │
│  current_time = floor(UnixTime/30) │
└─────────────────────────────────────┘
    │
    ▼
DYNAMIC TRUNCATION
    │
    ▼
6-DIGIT CODE (e.g., 456789)
    │
    ▼
USER ENTERS CODE
    │
    ▼
VERIFICATION AT SERVER

Root User Account
├── Virtual MFA Device
│   ├── Google Authenticator
│   ├── Authy
│   └── AWS Authenticator
├── Hardware MFA Device
│   ├── Gemalto
│   └── YubiKey
└── Security Keys
    └── FIDO2

IAM Users
├── Optional MFA
├── MFA Delete Protection
└── MFA Age Policy

Azure AD Multi-Factor Authentication
├── Conditional Access Policies
│   ├── Require MFA for all users
│   ├── Require MFA for admin roles
│   ├── Require MFA for specific applications
│   └── Location-based policies
├── Authentication Methods
│   ├── Microsoft Authenticator
│   ├── Phone call/SMS
│   ├── FIDO2 security keys
│   ├── OATH hardware tokens
│   └── Temporary Access Pass
└── Risk-based MFA
    ├── User risk level
    ├── Sign-in risk level
    └── Real-time risk detection

ACCESS REQUEST
    │
    ▼
RISK ASSESSMENT
├── User Risk (Low/Medium/High)
│   ├── Login pattern
│   ├── Device reputation
│   └── Location history
├── Context Risk
│   ├── New location
│   ├── New device
│   └── Unusual time
└── Application Risk
    ├── Sensitive data
    ├── Administrative access
    └── Financial operations
    │
    ▼
DECISION
├── No MFA (Low Risk)
├── Standard MFA (Medium Risk)
├── Strong MFA (High Risk)
└── Block Access (Critical Risk)

┌─────────────────────────────────────────────────────────────┐
│                       SSO ARCHITECTURE                      │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌─────────────┐     ┌──────────────────┐                  │
│  │   USER      │────▶│   SSO PROVIDER   │                  │
│  │  (Browser)  │     │  (Identity Hub)  │                  │
│  └─────────────┘     └──────────────────┘                  │
│           │                     │                           │
│           │                     ▼                           │
│           │     ┌───────────────────────────┐              │
│           │     │    SERVICE PROVIDERS      │              │
│           │     ├───────────┬───────────────┤              │
│           └────▶│App 1      │App 2          │              │
│                 │(SaaS)     │(Internal)     │              │
│                 └───────────┴───────────────┘              │
│                                                             │
└─────────────────────────────────────────────────────────────┘

1. User requests access to SP
2. SP redirects to IdP with SAML request
3. User authenticates at IdP
4. IdP issues SAML assertion
5. User redirected to SP with assertion
6. SP validates assertion and grants access
7. Session created at SP

1. User requests access to resource
2. Authorization Server authenticates user
3. User grants/consents to permissions
4. Authorization Server issues access token
5. Client presents token to Resource Server
6. Resource Server validates token
7. Access granted to resource

1. User requests authentication
2. OP authenticates user
3. OP issues ID Token (JWT) + Access Token
4. Client validates ID Token
5. Client can request user info
6. User authenticated

AWS Single Sign-On
├── Identity Sources
│   ├── AWS SSO Directory
│   ├── Active Directory
│   └── External IdP (SAML 2.0)
├── Applications
│   ├── AWS Accounts
│   ├── Third-party SaaS
│   └── Custom apps (SAML/OIDC)
├── User Management
│   ├── Groups
│   ├── Permission sets
│   └── User provisioning (SCIM)
└── Monitoring
    ├── Audit logs
    ├── CloudTrail integration
    └── Usage metrics

Azure AD Single Sign-On
├── Enterprise Applications
│   ├── Gallery apps
│   ├── Non-gallery apps
│   └── Custom apps
├── Authentication Methods
│   ├── SAML
│   ├── OpenID Connect
│   ├── Password-based
│   └── Linked SSO
├── Access Management
│   ├── Conditional Access
│   ├── Identity Protection
│   └── Privileged Identity Management
└── Integration
    ├── Azure AD Connect
    ├── Application Proxy
    └── SCIM provisioning

ORGANIZATION A (Identity Provider)
    │
    │ ESTABLISH TRUST
    │ (Mutual Trust Agreement)
    ▼
ORGANIZATION B (Service Provider)
    │
    │ USER FROM ORG A
    ▼
ACCESS TO ORG B SERVICES

1. IdP publishes metadata (entityID, endpoints, certificates)
2. SP imports IdP metadata
3. SP publishes metadata
4. IdP imports SP metadata
5. Trust established for:
   - Authentication requests
   - Assertion validation
   - Signature verification

AWS Identity Federation
├── Federation Types
│   ├── SAML 2.0 Federation
│   │   ├── AWS Single Account
│   │   └── Multiple Accounts (Custom SAML)
│   ├── Web Identity Federation
│   │   ├── Cognito User Pools
│   │   ├── Amazon (Login with Amazon)
│   │   ├── Facebook
│   │   └── Google
│   └── Custom Identity Broker
│       └── API-based federation
├── Federation Mechanisms
│   ├── SAML Assertions
│   ├── IAM Roles (AssumeRoleWithSAML)
│   ├── IAM Roles (AssumeRoleWithWebIdentity)
│   └── STS (Security Token Service)
└── Use Cases
    ├── Enterprise SSO
    ├── Mobile Apps
    ├── Partner Access
    └── Customer IAM

1. User authenticates with Corporate IdP
2. IdP issues SAML assertion
3. User requests access to AWS
4. SAML assertion presented to AWS STS
5. STS validates assertion
6. STS issues temporary credentials
7. User accesses AWS resources
8. Credentials expire after 1-12 hours

Azure AD Federation (Continued)
├── Federation Features
│   ├── Single Sign-On
│   ├── Conditional Access
│   ├── Self-service password reset
│   ├── Group-based access
│   └── Seamless SSO
├── Authentication Protocols
│   ├── SAML 2.0
│   ├── WS-Federation
│   ├── OAuth 2.0
│   └── OpenID Connect
└── Benefits
    ├── Centralized identity management
    ├── Consistent user experience
    ├── Enhanced security
    └── Reduced administrative overhead

USER (Corporate Network)
    │
    ▼
┌─────────────────────────────────────┐
│ 1. Access Azure AD Application      │
│    (e.g., Office 365)              │
└─────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────┐
│ 2. Redirect to Corporate AD FS      │
│    (Federation Server)             │
└─────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────┐
│ 3. Authenticate with Corporate ID   │
│    (Domain credentials + MFA)      │
└─────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────┐
│ 4. AD FS Issues SAML Token          │
│    (Signed and encrypted)           │
└─────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────┐
│ 5. Token Presented to Azure AD      │
│    (SAML assertion validation)      │
└─────────────────────────────────────┘
    │
    ▼
┌─────────────────────────────────────┐
│ 6. Access Granted to Resource       │
│    (Seamless SSO experience)        │
└─────────────────────────────────────┘

Google Cloud Federation
├── Identity Providers
│   ├── Google Workspace
│   ├── SAML 2.0 Providers
│   ├── OIDC Providers
│   └── Social Providers
├── Workforce Identity Federation
│   ├── SAML federation
│   ├── OIDC federation
│   └── Attribute mapping
├── Workload Identity Federation
│   ├── Google Cloud to AWS
│   ├── AWS to Google Cloud
│   └── Azure to Google Cloud
└── Use Cases
    ├── External user access
    ├── Partner collaboration
    ├── Cross-cloud workloads
    └── Multi-cloud strategies

IDENTITY PROVIDER FUNCTIONS
├── Identity Management
│   ├── User provisioning
│   ├── User lifecycle management
│   ├── Identity repository
│   └── Attribute management
├── Authentication Services
│   ├── Authentication verification
│   ├── Credential validation
│   ├── MFA enforcement
│   └── Password management
├── Federation Services
│   ├── SAML assertions
│   ├── Token issuance
│   ├── Trust management
│   └── Metadata exchange
└── Integration Services
    ├── API management
    ├── SCIM provisioning
    ├── Event notifications
    └── Custom extensions

SERVICE PROVIDER FUNCTIONS
├── Authentication Processing
│   ├── Redirect users to IdP
│   ├── Accept authentication assertions
│   ├── Validate assertion signatures
│   └── Create local sessions
├── Authorization
│   ├── Evaluate access policies
│   ├── Apply permissions
│   ├── Enforce access controls
│   └── Audit access events
├── User Experience
│   ├── Seamless login
│   ├── Session management
│   ├── Error handling
│   └── Logout processing
└── Integration
    ├── IdP metadata import
    ├── Certificate trust
    ├── Attribute mapping
    └── Error handling

TRUST ESTABLISHMENT PROCESS

┌─────────────────────┐     ┌─────────────────────┐
│    IDENTITY PROVIDER │────▶│   SERVICE PROVIDER  │
└─────────────────────┘     └─────────────────────┘
         │                           │
         │  1. Exchange Metadata     │
         │  2. Share Certificates    │
         │  3. Define Attributes     │
         │  4. Test Connectivity     │
         ▼                           ▼
┌─────────────────────────────────────────────────┐
│          TRUST RELATIONSHIP ESTABLISHED          │
├─────────────────────────────────────────────────┤
│  • Metadata validated and configured            │
│  • Certificate thumbprints exchanged            │
│  • Attribute mapping defined                   │
│  • SSO endpoints configured                    │
│  • Error handling procedures defined           │
│  • Testing and verification completed          │
└─────────────────────────────────────────────────┘

SAML FEDERATION MODEL

┌─────────────────────────────────────────────────────────────┐
│                                                             │
│  ┌─────────────────┐    SAML Request    ┌─────────────────┐│
│  │                 │───────────────────▶│                 ││
│  │   IDENTITY      │                    │   SERVICE       ││
│  │   PROVIDER      │◀───────────────────│   PROVIDER      ││
│  │                 │    SAML Response   │                 ││
│  │   (IdP)         │                    │   (SP)          ││
│  │                 │    AuthnRequest    │                 ││
│  │                 │◀───────────────────│                 ││
│  │                 │                    │                 ││
│  └─────────────────┘    SAML Assertion ──────────────────┘│
│         │                (Subject, Attributes)             │
│         │                                                  │
│         ▼                                                  │
│  ┌────────────────────────────────────────────────────────┐│
│  │               USER AGENT (Browser)                     ││
│  └────────────────────────────────────────────────────────┘│
│                                                             │
└─────────────────────────────────────────────────────────────┘

ATTRIBUTE EXCHANGE EXAMPLE

Identity Provider Attributes
├── Subject ID: john.doe@university.edu
├── eduPersonAffiliation: student
├── eduPersonPrimaryAffiliation: student
├── displayName: John Doe
├── mail: john.doe@university.edu
├── eduPersonScopedAffiliation: student@university.edu
└── employeeNumber: 2024-12345

Service Provider Attributes
├── Local Username: jdoe
├── Department: Computer Science
├── Role: Student
├── Enrollment Status: Active
├── Courses: CS101, CS201
└── Access Level: Standard

AWS IAM IDENTITY PROVIDER
├── Identity Sources
│   ├── IAM Users (Built-in)
│   ├── IAM Roles (for services)
│   ├── SAML Providers
│   ├── OIDC Providers
│   └── Web Identity Providers
├── Authentication
│   ├── Username/Password
│   ├── Access Keys
│   ├── MFA
│   └── Temporary credentials (STS)
├── Authorization
│   ├── IAM Policies
│   ├── Permission Boundaries
│   ├── Service Control Policies
│   └── Resource Policies
└── Federation
    ├── Enterprise SSO
    ├── Identity Center
    ├── Cognito (customer identity)
    └── External IdPs

AZURE AD IDENTITY PROVIDER
├── Identity Types
│   ├── User identities
│   ├── Application identities
│   ├── Managed identities
│   └── External identities
├── Authentication
│   ├── Password authentication
│   ├── Passwordless authentication
│   ├── Federation (AD FS)
│   └── External providers
├── Authorization
│   ├── Azure RBAC
│   ├── Conditional Access
│   ├── Identity Protection
│   └── Privileged Identity Management
└── Integration
    ├── Application Gallery
    ├── Custom apps (SAML/OIDC)
    ├── Legacy apps (Application Proxy)
    └── API management

S3 ACCESS CONTROL HIERARCHY

┌─────────────────────────────────────────────────────┐
│                    BUCKET LEVEL                      │
├─────────────────────────────────────────────────────┤
│  │                        │                         │
│  ▼                        ▼                         │
│  Bucket Policy            IAM Policy                │
│  (Resource-based)         (User-based)             │
│  └─────────────────┐  ┌─────────────────┘          │
│                    │  │                             │
│                    ▼  ▼                             │
│              ┌──────────────┐                       │
│              │  ACCESS      │                       │
│              │  DECISION    │                       │
│              └──────────────┘                       │
│                    │                                │
│                    ▼                                │
├─────────────────────────────────────────────────────┤
│                    OBJECT LEVEL                      │
├─────────────────────────────────────────────────────┤
│  │                        │                         │
│  ▼                        ▼                         │
│  ACL (Object)            IAM Conditions            │
│  (Legacy)                 (Fine-grained)           │
│                                                     │
└─────────────────────────────────────────────────────┘

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowStudentAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/Students"
      },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::student-data/*",
        "arn:aws:s3:::student-data"
      ],
      "Condition": {
        "StringEquals": {
          "s3:prefix": "${aws:username}/*"
        }
      }
    },
    {
      "Sid": "DenyDelete",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::student-data/*"
    }
  ]
}

EBS ACCESS CONTROL

Volume Level
├── Encryption
│   ├── Default encryption
│   ├── Customer-managed keys
│   └── AWS-managed keys
├── IAM Permissions
│   ├── Attach/Detach volume
│   ├── Create snapshot
│   ├── Delete volume
│   └── Modify volume
├── Network Access
│   ├── EC2 instance association
│   ├── Security groups
│   └── Subnet placement
└── Snapshot Access
    ├── Create snapshot
    ├── Share snapshot
    ├── Copy snapshot
    └── Permission management

EFS ACCESS CONTROL

File System Level
├── IAM Authorization
│   ├── IAM policies
│   ├── IAM roles
│   └── Access points
├── Network Security
│   ├── VPC placement
│   ├── Security groups
│   ├── Mount targets
│   └── Network ACLs
├── POSIX Permissions
│   ├── Owner/Group
│   ├── Read/Write/Execute
│   ├── Sticky bit
│   └── SUID/SGID
└── Access Points
    ├── Root directory
    ├── POSIX user/group
    └── POSIX permissions

DATABASE ACCESS CONTROL

Network Layer
├── Private endpoints
├── Security groups
├── VPC placement
└── IP whitelisting

Authentication Layer
├── IAM authentication
├── Password authentication
├── Certificate-based
└── Integrated authentication

Authorization Layer
├── Database roles
├── Granular permissions
│   ├── SELECT, INSERT, UPDATE, DELETE
│   └── CREATE, ALTER, DROP
├── Row-level security
├── Column-level security
└── Stored procedures

Audit Layer
├── Connection logs
├── Query logs
├── DDL logs
└── Access logs

-- Row Level Security for Multi-Tenant Database
CREATE POLICY tenant_isolation ON student_records
USING (tenant_id = current_setting('app.tenant_id')::text);

-- Column-Level Security
CREATE VIEW student_data AS
SELECT
    id,
    name,
    CASE
        WHEN has_privilege('full_access')
        THEN ssn
        ELSE 'XXX-XX-' || RIGHT(ssn, 4)
    END AS ssn,
    email,
    enrollment_date
FROM students;

SECURITY GROUP RULES

┌─────────────────────────────────────────────────────────┐
│              SECURITY GROUP (Web-Tier)                  │
├─────────────────────────────────────────────────────────┤
│  INBOUND RULES                                         │
│  ┌────────────────────────────────────────────────────┐ │
│  │ Source      │ Protocol │ Port │ Description       │ │
│  ├─────────────┼──────────┼──────┼──────────────────┤ │
│  │ 0.0.0.0/0  │ TCP      │ 443  │ HTTPS Traffic     │ │
│  │ 0.0.0.0/0  │ TCP      │ 80   │ HTTP Traffic      │ │
│  │ SG-App    │ TCP      │ 8080 │ App Communication │ │
│  └────────────────────────────────────────────────────┘ │
│                                                         │
│  OUTBOUND RULES                                        │
│  ┌────────────────────────────────────────────────────┐ │
│  │ Destination   │ Protocol │ Port │ Description       │ │
│  ├───────────────┼──────────┼──────┼──────────────────┤ │
│  │ 0.0.0.0/0    │ TCP      │ 443  │ Outbound HTTPS   │ │
│  │ 0.0.0.0/0    │ TCP      │ 53   │ DNS Queries      │ │
│  │ SG-Database │ TCP      │ 3306 │ Database Access  │ │
│  └────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘

VPC SEGMENTATION

┌─────────────────────────────────────────────────────────┐
│                      VPC (10.0.0.0/16)                   │
│                                                         │
│  ┌───────────────────────────────────────────────────┐  │
│  │          PUBLIC SUBNET (10.0.1.0/24)              │  │
│  │  ┌─────────┐  ┌─────────┐  ┌─────────┐          │  │
│  │  │ Load     │  │ Web     │  │ Web     │          │  │
│  │  │ Balancer │  │ Server 1│  │ Server 2│          │  │
│  │  └─────────┘  └─────────┘  └─────────┘          │  │
│  │  Internet Gateway (0.0.0.0/0 → IGW)              │  │
│  └───────────────────────────────────────────────────┘  │
│                          │                              │
│                          ▼                              │
│  ┌───────────────────────────────────────────────────┐  │
│  │         PRIVATE SUBNET (10.0.2.0/24)              │  │
│  │  ┌─────────┐  ┌─────────┐  ┌─────────┐          │  │
│  │  │ App     │  │ App     │  │ App     │          │  │
│  │  │ Server 1│  │ Server 2│  │ Server 3│          │  │
│  │  └─────────┘  └─────────┘  └─────────┘          │  │
│  │  NAT Gateway (For outbound internet)              │  │
│  └───────────────────────────────────────────────────┘  │
│                          │                              │
│                          ▼                              │
│  ┌───────────────────────────────────────────────────┐  │
│  │        DATABASE SUBNET (10.0.3.0/24)              │  │
│  │  ┌─────────┐  ┌─────────┐  ┌─────────┐          │  │
│  │  │ Database│  │ Database│  │ Backup  │          │  │
│  │  │ Primary │  │ Replica │  │ Storage │          │  │
│  │  └─────────┘  └─────────┘  └─────────┘          │  │
│  │  No Internet Gateway                              │  │
│  └───────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────┘

PRIVATE ENDPOINT ARCHITECTURE

VPC A (10.0.0.0/16)
    │
    │ Private Endpoint
    │ (10.0.1.100)
    ▼
┌─────────────────────────────────────────────────────────┐
│             MANAGED SERVICE                            │
│  ┌───────────────────────────────────────────────────┐ │
│  │  • Azure SQL Database                            │ │
│  │  • AWS S3                                        │ │
│  │  • Cloud Service APIs                            │ │
│  │  • Database Services                             │ │
│  └───────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘

WAF PROTECTION CAPABILITIES

┌─────────────────────────────────────────────────────────┐
│                    WEB APPLICATION FIREWALL              │
├─────────────────────────────────────────────────────────┤
│  OWASP Top 10 Protections                               │
│  ├── SQL Injection                                      │
│  ├── Cross-Site Scripting (XSS)                        │
│  ├── Command Injection                                  │
│  ├── Path Traversal                                     │
│  ├── CSRF                                               │
│  └── File Inclusion                                    │
├─────────────────────────────────────────────────────────┤
│  Custom Rules                                          │
│  ├── Rate limiting                                      │
│  ├── IP whitelisting/blacklisting                      │
│  ├── Geo-blocking                                       │
│  ├── Header validation                                  │
│  └── Parameter validation                              │
├─────────────────────────────────────────────────────────┤
│  Bot Protection                                        │
│  ├── Bot detection                                      │
│  ├── Challenge mechanisms                               │
│  ├── Bot blocking                                       │
│  └── Captcha integration                               │
└─────────────────────────────────────────────────────────┘

DDOS PROTECTION LAYERS

Layer 1: Edge Protection (CDN)
├── Anycast network
├── Content caching
├── Traffic filtering
└── Geo-distribution

Layer 2: Network Layer Protection
├── Traffic scrubbing
├── Bandwidth monitoring
├── Packet filtering
└── Rate limiting

Layer 3: Application Layer Protection
├── Web Application Firewall
├── Rate-based rules
├── Signature-based filtering
└── Behavioral analysis

Layer 4: Resource Protection
├── Auto-scaling
├── Service quotas
├── Resource limits
└── Circuit breakers

USER ACCOUNT SECURITY

Account Policies
├── Password Policy
│   ├── Minimum length: 12+ characters
│   ├── Complexity: Mix of characters
│   ├── Password history: 5+ passwords
│   ├── Maximum age: 30-90 days
│   └── Account lockout: 5 failed attempts
├── Account Management
│   ├── Disable guest accounts
│   ├── Remove default accounts
│   ├── Disable unused accounts
│   ├── Separate admin accounts
│   └── Regular account reviews
└── Privilege Management
    ├── Separate roles
    ├── Least privilege
    ├── Just-in-time access
    ├── Session recording
    └── Audit logging

FILE SYSTEM SECURITY

File Permissions
├── Read/Write/Execute restrictions
├── Ownership verification
├── Sticky bit on shared directories
├── SUID/SGID management
└── File integrity monitoring

Directory Protection
├── Root directory restrictions
├── User home directory permissions
├── Temporary directory security
├── System directory protection
└── Application directory isolation

File System Encryption
├── Full disk encryption
├── Partition encryption
├── File-level encryption
├── Encryption key management
└── Secure key storage

NETWORK HARDENING

Network Services
├── Disable unused services
├── Service-specific firewalls
├── Port monitoring
├── Protocol restrictions
└── Service binding control

Network Security Settings
├── TCP/IP stack hardening
├── DNS security
├── DHCP configuration
├── ARP protection
└── IPsec configuration

Network Monitoring
├── Network traffic logging
├── Intrusion detection
├── Anomaly detection
├── Performance monitoring
└── Security event logging

SERVICE HARDENING

Service Management
├── Disable unnecessary services
├── Start services only when needed
├── Run with least privileges
├── Limit service accounts
└── Regular service reviews

Process Security
├── Process isolation
├── Memory protection
├── Resource limits
├── Privilege separation
└── Process monitoring

Application Security
├── Application whitelisting
├── Execution restrictions
├── Secure installation
├── Code signing
└── Runtime protection

LOGGING CONFIGURATION

Log Types
├── System logs
├── Security logs
├── Application logs
├── Access logs
└── Audit logs

Log Configuration
├── Enable comprehensive logging
├── Set appropriate log levels
├── Define log rotation
├── Configure log retention
└── Secure log storage

Log Monitoring
├── Real-time monitoring
├── Alert generation
├── Security analytics
├── Compliance reporting
└── Incident investigation

CIS BENCHMARK CATEGORIES

For Linux/Unix Systems
├── Initial Setup
│   ├── Filesystem configuration
│   ├── Bootloader security
│   └── Kernel hardening
├── Services Configuration
│   ├── SSH hardening
│   ├── Network services
│   └── System services
├── Network Configuration
│   ├── IP forwarding
│   ├── Packet filtering
│   └── TCP/IP settings
├── Auditing and Logging
│   ├── Audit configuration
│   ├── Logging services
│   └── Log rotation
├── Access, Authentication, Authorization
│   ├── Password policies
│   ├── PAM configuration
│   └── SSH security
├── System Maintenance
│   ├── Software updates
│   ├── File integrity
│   └── Security reporting
└── System Hardening
    ├── Kernel parameters
    ├── File permissions
    └── Security limits

NIST SERVER HARDENING GUIDELINES

Planning and Implementation
├── Security requirements definition
├── Risk assessment
├── Security controls selection
├── Implementation planning
└── Testing and validation

Security Controls
├── Access control
├── Audit and accountability
├── Identification and authentication
├── System and communications protection
├── System and information integrity
└── Configuration management

Maintenance
├── Patch management
├── Vulnerability scanning
├── Security monitoring
├── Incident response
└── Change management

COMPONENT MINIMIZATION

Remove Unnecessary:
├── Services and daemons
├── Applications and packages
├── Libraries and dependencies
├── Protocols and features
└── User accounts and groups

Minimize Configuration:
├── Default configurations
├── Sample applications
├── Test scripts
├── Development tools
└── Debugging tools

CONTAINER MINIMIZATION

Base Image Selection
├── Alpine Linux (5MB)
├── Distroless (Google)
├── Ubuntu Core
├── BusyBox
└── Custom minimal images

Image Optimization
├── Remove package manager
├── Delete build dependencies
├── Remove temporary files
├── Minimize layers
├── Clean package caches

Security Hardening
├── Non-root user
├── Read-only filesystem
├── Resource limits
├── Capability dropping
└── No sensitive data in image

line:"{{ item.line }}"
loop:
-{regexp:'^PASS_MAX_DAYS',line:'PASS_MAX_DAYS 90'}
-{regexp:'^PASS_MIN_DAYS',line:'PASS_MIN_DAYS 7'}
-{regexp:'^PASS_WARN_AGE',line:'PASS_WARN_AGE 14'}

-name: Install security packages
apt:
name:
- fail2ban
- aide
- auditd
- rkhunter
state: present

-name: Configure kernel parameters
sysctl:
name:"{{ item.name }}"
value:"{{ item.value }}"
state: present
reload:yes
loop:
-{name:'net.ipv4.tcp_syncookies',value:'1'}
-{name:'net.ipv4.conf.all.rp_filter',value:'1'}
-{name:'net.ipv4.conf.default.rp_filter',value:'1'}
-{name:'net.ipv4.icmp_echo_ignore_all',value:'1'}

-name: Set file permissions
file:
path:"{{ item }}"
mode:'600'
loop:
- /etc/ssh/sshd_config
- /etc/shadow
- /etc/gshadow

handlers:
-name: restart sshd
service:
name: sshd
state: restarted

LINUX HARDENING CHECKLIST

[ ] BIOS/UEFI SECURITY
    [ ] Boot password set
    [ ] Secure boot enabled
    [ ] Boot order restricted
    [ ] USB ports disabled if not needed

[ ] SYSTEM CONFIGURATION
    [ ] Latest security patches installed
    [ ] Unnecessary services disabled
    [ ] Unused network protocols disabled
    [ ] System time synchronized (NTP)

[ ] USER ACCOUNTS
    [ ] Default users removed/disabled
    [ ] Guest account disabled
    [ ] Strong password policy enforced
    [ ] Login attempt limits set
    [ ] sudo access restricted
    [ ] No root SSH login allowed

[ ] FILE SYSTEM
    [ ] Proper file permissions set
    [ ] File integrity monitoring configured
    [ ] /tmp and /var/tmp mounted with noexec
    [ ] /home mounted with noexec,nosuid

[ ] NETWORK SECURITY
    [ ] Firewall configured (iptables/ufw)
    [ ] Unused ports closed
    [ ] Network services restricted
    [ ] SSH hardening completed

[ ] LOGGING
    [ ] System logging enabled
    [ ] Audit daemon configured
    [ ] Log rotation configured
    [ ] Remote logging setup

[ ] SECURITY TOOLS
    [ ] Anti-malware installed
    [ ] IDS/IPS configured
    [ ] Vulnerability scanner setup
    [ ] Monitoring agent installed

WINDOWS SERVER HARDENING CHECKLIST

[ ] SECURITY POLICIES
    [ ] Password policy configured
    [ ] Account lockout policy set
    [ ] Audit policy enabled
    [ ] User rights assignment reviewed

[ ] USER MANAGEMENT
    [ ] Local Administrator password changed
    [ ] Guest account disabled
    [ ] Local accounts with weak passwords identified
    [ ] Admin accounts restricted

[ ] PATCH MANAGEMENT
    [ ] Windows Update configured
    [ ] Update schedule defined
    [ ] Critical updates tested
    [ ] Automatic updates configured

[ ] NETWORK SECURITY
    [ ] Windows Firewall enabled
    [ ] Inbound rules restricted
    [ ] RDP secured (NLA required)
    [ ] Unused services disabled

[ ] LOGGING
    [ ] Event logs enabled
    [ ] Audit log settings configured
    [ ] Log size limits set
    [ ] Centralized logging configured

[ ] SECURITY FEATURES
    [ ] UAC enabled
    [ ] DEP enabled
    [ ] Windows Defender configured
    [ ] Secure boot enabled

TRUSTED BOOT CHAIN

┌─────────────────────────────────────────────────────────────┐
│                    HARDWARE ROOT OF TRUST                   │
│                                                             │
│  BIOS/UEFI Boot ROM (Immutable)                            │
│  └── Contains Hashing Algorithm and Public Key            │
│                          │                                  │
│                          ▼                                  │
│  Boot Loader (GRUB/Windows Boot Manager)                  │
│  └── First stage signed by trusted key                   │
│                          │                                  │
│                          ▼                                  │
│  Kernel Image                                              │
│  └── Signed by trusted authority                          │
│                          │                                  │
│                          ▼                                  │
│  Operating System Boot                                     │
│  └── All modules and drivers verified                    │
│                          │                                  │
│                          ▼                                  │
│  Applications and Services                                 │
│  └── Secure execution environment established             │
│                                                             │
└─────────────────────────────────────────────────────────────┘

1. System Powers On
2. UEFI Firmware Initializes
3. Firmware verifies Platform Key (PK)
4. Firmware loads and verifies bootloader signature
   ├── Signature matched against db (allowed)
   ├── Signature matched against dbx (blocked)
   └── Signature validated using PK/KEK
5. Bootloader loads and verifies kernel image
6. Kernel loads and verifies modules/drivers
7. OS boots with verified components
8. TPM measures each component (if available)

PCR[0]  = SHA256(BIOS Code)
PCR[1]  = SHA256(Boot Settings)
PCR[2-3] = Option ROM Code
PCR[4]  = SHA256(Bootloader Code)
PCR[5]  = SHA256(Bootloader Configuration)
PCR[6]  = SHA256(Kernel Image)
PCR[7]  = SHA256(Initramfs)
PCR[8-15] = SHA256(Critical System Files)

WINDOWS TRUSTED BOOT

SECURE BOOT
├── UEFI Firmware verification
└── Windows Boot Manager (bootmgfw.efi) - Signed by Microsoft

TRUSTED BOOT
├── Windows Kernel (ntoskrnl.exe) - Signed by Microsoft
├── Verified by Windows Boot Manager
└── Integrity checked against measured configuration

EARLY LAUNCH ANTI-MALWARE (ELAM)
├── Driver verification
├── Checked against known malware signatures
└── Logged for security monitoring

MEASURED BOOT
├── Complete Boot Measurements
├── Stored in TPM PCRs
└── Available for remote attestation

KEY MANAGEMENT IN SECURE BOOT

Platform Key (PK)
├── Owned by OEM/Platform Owner
├── Establishes ownership of system
└── Used to sign KEK

Key Exchange Key (KEK)
├── Owned by Microsoft/OEM
├── Used to sign db and dbx
└── Can be updated by PK owner

Signature Database (db)
├── Contains authorized signatures
├── Used to verify boot components
└── Updated by KEK

Forbidden Signature Database (dbx)
├── Contains revoked signatures
├── Blocks untrusted components
└── Prioritized over db

HIDS COMPONENTS

System Call Monitoring
├── File system changes
├── Process execution
├── Registry changes (Windows)
├── System log analysis
└── Application logs

File Integrity Monitoring
├── Critical system files
├── Configuration files
├── Application binaries
└── User data files

Policy Enforcement
├── Security policy compliance
├── Usage patterns
├── Resource consumption
└── User activity

NIDS COMPONENTS

Packet Sniffing
├── Packet capture
├── Protocol analysis
├── Payload inspection
└── Traffic reconstruction

Signature Detection
├── Known attack patterns
├── Vulnerability signatures
├── Protocol anomalies
└── Exploit attempts

Anomaly Detection
├── Baseline learning
├── Unusual traffic patterns
├── Behavioral analysis
└── Heuristic detection

NBA FUNCTIONALITY

Baseline Creation
├── Normal traffic patterns
├── Typical user behavior
├── Application usage
└── Network utilization

Anomaly Detection
├── Traffic volume spikes
├── Unusual protocol usage
├── Data exfiltration patterns
└── Command and control traffic

Threat Detection
├── Zero-day attacks
├── Advanced persistent threats
├── Insider threats
└── Compromised systems

HYBRID DETECTION APPROACH

Signature Detection (Known attacks)
    +
Anomaly Detection (Unknown attacks)
    =
Correlation Engine
    ├── Combine detection methods
    ├── Reduce false positives
    ├── Enhance detection accuracy
    └── Prioritize threats

NIPS ARCHITECTURE

┌─────────────────────────────────────────────────────────────┐
│                   NIPS APPLIANCE                           │
│                                                             │
│  INGRESS TRAFFIC                                           │
│  ───────────────────────────────────────────────────────▶   │
│                          │                                  │
│                          ▼                                  │
│  Signature Detection Engine                                │
│  ├── Pattern matching                                      │
│  ├── Protocol analysis                                     │
│  └── Exploit detection                                     │
│                          │                                  │
│                          ▼                                  │
│  Response Engine                                           │
│  ├── Block traffic                                         │
│  ├── Reset connections                                     │
│  ├── Drop packets                                          │
│  └── Alert generation                                      │
│                          │                                  │
│                          ▼                                  │
│  EGRESS TRAFFIC                                            │
│  ───────────────────────────────────────────────────────▶   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

HIPS FUNCTIONS

System Call Interception
├── Monitor process execution
├── Check system calls
└── Block unauthorized actions

File System Protection
├── File integrity monitoring
├── File access control
└── Directory protection

Application Control
├── Application whitelisting
├── Execution control
└── Process monitoring

Behavior Blocking
├── Anomalous behavior detection
├── Suspicious activity blocking
└── Heuristic analysis

WIPS FUNCTIONS

Rogue Access Point Detection
├── Monitoring for unauthorized APs
├── Classification of legitimate APs
└── Automatic containment

Wireless Attack Prevention
├── De-authentication attacks
├── Evil twin detection
├── Man-in-the-middle prevention
└── Ad-hoc network detection

Wireless Policy Enforcement
├── SSID policy
├── Encryption requirements
└── Authentication requirements