1502 lines
42 KiB
Markdown
1502 lines
42 KiB
Markdown
# Security Documentation - AI Study Assistant
|
|
|
|
> ⚠️ **ATUALIZADO**: Este documento foi corrigido para refletir a implementação REAL.
|
|
>
|
|
> **Nota Importante sobre Roles:** Apenas `student` e `teacher` estão implementados. Roles `admin` e `super_admin` NÃO existem no código.
|
|
|
|
## 🔒 COMPREHENSIVE SECURITY FRAMEWORK
|
|
|
|
---
|
|
|
|
## 📋 OVERVIEW
|
|
|
|
This document outlines the security architecture for the AI Study Assistant platform. Note: This is a Flutter + Firebase BaaS application without a custom backend server.
|
|
|
|
---
|
|
|
|
## 🛡️ SECURITY ARCHITECTURE
|
|
|
|
### Defense in Depth Strategy
|
|
|
|
#### Multi-Layer Security
|
|
```
|
|
┌─────────────────────────────────────────────────────┐
|
|
│ APPLICATION LAYER │
|
|
│ • Input Validation • Authentication • Authorization │
|
|
├─────────────────────────────────────────────────────┤
|
|
│ API LAYER │
|
|
│ • Rate Limiting • API Security • Request Validation │
|
|
├─────────────────────────────────────────────────────┤
|
|
│ DATA LAYER │
|
|
│ • Encryption • Access Control • Audit Logging │
|
|
├─────────────────────────────────────────────────────┤
|
|
│ INFRASTRUCTURE LAYER │
|
|
│ • Network Security • Container Security • Monitoring│
|
|
└─────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
#### Security Domains
|
|
- **Application Security**: Code-level protections
|
|
- **Data Security**: Encryption and access control
|
|
- **Network Security**: Communication protection
|
|
- **Infrastructure Security**: Platform protection
|
|
- **Operational Security**: Processes and procedures
|
|
|
|
---
|
|
|
|
## 🔐 AUTHENTICATION & AUTHORIZATION
|
|
|
|
### Authentication Framework
|
|
|
|
#### Firebase Authentication
|
|
```typescript
|
|
// Authentication configuration
|
|
const authConfig = {
|
|
providers: [
|
|
'email', // Email/password
|
|
'google', // Google OAuth
|
|
'apple', // Apple Sign In (iOS)
|
|
],
|
|
passwordPolicy: {
|
|
minLength: 8,
|
|
requireUppercase: false,
|
|
requireLowercase: false,
|
|
requireNumbers: false,
|
|
requireSpecialChars: false,
|
|
},
|
|
sessionManagement: {
|
|
maxAge: 30 * 60 * 1000, // 30 minutes
|
|
refreshThreshold: 5 * 60 * 1000, // 5 minutes
|
|
},
|
|
multiFactorAuth: {
|
|
enabled: false, // Future enhancement
|
|
methods: ['sms', 'totp'],
|
|
}
|
|
};
|
|
```
|
|
|
|
#### Token Management
|
|
```typescript
|
|
// JWT Token validation
|
|
export class TokenValidator {
|
|
async validateToken(token: string): Promise<AuthResult> {
|
|
try {
|
|
const decodedToken = await admin.auth().verifyIdToken(token);
|
|
|
|
// Check token age
|
|
const now = Date.now() / 1000;
|
|
if (decodedToken.exp < now) {
|
|
throw new Error('Token expired');
|
|
}
|
|
|
|
// Check user status
|
|
const user = await this.getUser(decodedToken.uid);
|
|
if (!user.isActive) {
|
|
throw new Error('User account disabled');
|
|
}
|
|
|
|
return {
|
|
success: true,
|
|
user: decodedToken,
|
|
permissions: await this.getPermissions(decodedToken.uid),
|
|
};
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
error: error.message,
|
|
};
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
### Authorization Framework
|
|
|
|
#### Role-Based Access Control (RBAC)
|
|
```typescript
|
|
// Role definitions
|
|
export enum UserRole {
|
|
STUDENT = 'student',
|
|
TEACHER = 'teacher',
|
|
ADMIN = 'admin',
|
|
SUPER_ADMIN = 'super_admin',
|
|
}
|
|
|
|
// Permission definitions
|
|
export enum Permission {
|
|
// Student permissions
|
|
READ_OWN_CONTENT = 'read_own_content',
|
|
SUBMIT_QUIZZES = 'submit_quizzes',
|
|
ASK_QUESTIONS = 'ask_questions',
|
|
VIEW_OWN_PROGRESS = 'view_own_progress',
|
|
|
|
// Teacher permissions
|
|
MANAGE_CLASS = 'manage_class',
|
|
UPLOAD_CONTENT = 'upload_content',
|
|
CREATE_QUIZZES = 'create_quizzes',
|
|
VIEW_STUDENT_PROGRESS = 'view_student_progress',
|
|
|
|
// Admin permissions
|
|
MANAGE_USERS = 'manage_users',
|
|
MANAGE_SCHOOLS = 'manage_schools',
|
|
VIEW_ANALYTICS = 'view_analytics',
|
|
MANAGE_SYSTEM = 'manage_system',
|
|
}
|
|
|
|
// Role-Permission mapping
|
|
const rolePermissions = {
|
|
[UserRole.STUDENT]: [
|
|
Permission.READ_OWN_CONTENT,
|
|
Permission.SUBMIT_QUIZZES,
|
|
Permission.ASK_QUESTIONS,
|
|
Permission.VIEW_OWN_PROGRESS,
|
|
],
|
|
[UserRole.TEACHER]: [
|
|
...rolePermissions[UserRole.STUDENT],
|
|
Permission.MANAGE_CLASS,
|
|
Permission.UPLOAD_CONTENT,
|
|
Permission.CREATE_QUIZZES,
|
|
Permission.VIEW_STUDENT_PROGRESS,
|
|
],
|
|
[UserRole.ADMIN]: [
|
|
...rolePermissions[UserRole.TEACHER],
|
|
Permission.MANAGE_USERS,
|
|
Permission.MANAGE_SCHOOLS,
|
|
Permission.VIEW_ANALYTICS,
|
|
],
|
|
[UserRole.SUPER_ADMIN]: [
|
|
...rolePermissions[UserRole.ADMIN],
|
|
Permission.MANAGE_SYSTEM,
|
|
],
|
|
};
|
|
```
|
|
|
|
#### Authorization Middleware
|
|
```typescript
|
|
// Express middleware for authorization
|
|
export const authorize = (requiredPermission: Permission) => {
|
|
return async (req: Request, res: Response, next: NextFunction) => {
|
|
try {
|
|
const token = req.headers.authorization?.split('Bearer ')[1];
|
|
if (!token) {
|
|
return res.status(401).json({ error: 'Authentication required' });
|
|
}
|
|
|
|
const authResult = await tokenValidator.validateToken(token);
|
|
if (!authResult.success) {
|
|
return res.status(401).json({ error: authResult.error });
|
|
}
|
|
|
|
const userPermissions = authResult.permissions;
|
|
if (!userPermissions.includes(requiredPermission)) {
|
|
return res.status(403).json({ error: 'Insufficient permissions' });
|
|
}
|
|
|
|
req.user = authResult.user;
|
|
req.permissions = userPermissions;
|
|
next();
|
|
} catch (error) {
|
|
res.status(500).json({ error: 'Authorization error' });
|
|
}
|
|
};
|
|
};
|
|
```
|
|
|
|
---
|
|
|
|
## 🔒 DATA PROTECTION
|
|
|
|
### Encryption Standards
|
|
|
|
#### Data-at-Rest Encryption
|
|
```typescript
|
|
// Firebase Firestore encryption
|
|
const encryptionConfig = {
|
|
// Default Firebase encryption
|
|
firestore: {
|
|
encryption: 'AES-256',
|
|
keyRotation: '90 days',
|
|
},
|
|
|
|
// Additional encryption for sensitive data
|
|
sensitiveFields: [
|
|
'email',
|
|
'personalInfo',
|
|
'healthData',
|
|
'assessmentResults',
|
|
],
|
|
|
|
// Custom encryption for PII
|
|
piiEncryption: {
|
|
algorithm: 'AES-256-GCM',
|
|
keyDerivation: 'PBKDF2',
|
|
iterations: 100000,
|
|
},
|
|
};
|
|
```
|
|
|
|
#### Data-in-Transit Encryption
|
|
```typescript
|
|
// HTTPS/TLS configuration
|
|
const tlsConfig = {
|
|
version: 'TLS 1.3',
|
|
ciphers: [
|
|
'TLS_AES_256_GCM_SHA384',
|
|
'TLS_CHACHA20_POLY1305_SHA256',
|
|
'TLS_AES_128_GCM_SHA256',
|
|
],
|
|
certificates: {
|
|
provider: 'Let\'s Encrypt',
|
|
autoRenewal: true,
|
|
monitoring: true,
|
|
},
|
|
};
|
|
```
|
|
|
|
#### Field-Level Encryption
|
|
```typescript
|
|
// Sensitive data encryption
|
|
export class FieldEncryption {
|
|
private readonly algorithm = 'aes-256-gcm';
|
|
private readonly keyLength = 32;
|
|
|
|
async encryptField(data: string, key: string): Promise<EncryptedData> {
|
|
const iv = crypto.randomBytes(16);
|
|
const cipher = crypto.createCipher(this.algorithm, key);
|
|
cipher.setAAD(Buffer.from('teachit-field', 'utf8'));
|
|
|
|
let encrypted = cipher.update(data, 'utf8', 'hex');
|
|
encrypted += cipher.final('hex');
|
|
|
|
const tag = cipher.getAuthTag();
|
|
|
|
return {
|
|
data: encrypted,
|
|
iv: iv.toString('hex'),
|
|
tag: tag.toString('hex'),
|
|
};
|
|
}
|
|
|
|
async decryptField(encryptedData: EncryptedData, key: string): Promise<string> {
|
|
const decipher = crypto.createDecipher(this.algorithm, key);
|
|
decipher.setAAD(Buffer.from('learnit-field', 'utf8'));
|
|
decipher.setAuthTag(Buffer.from(encryptedData.tag, 'hex'));
|
|
|
|
let decrypted = decipher.update(encryptedData.data, 'hex', 'utf8');
|
|
decrypted += decipher.final('utf8');
|
|
|
|
return decrypted;
|
|
}
|
|
}
|
|
```
|
|
|
|
### Data Classification
|
|
|
|
#### Data Sensitivity Levels
|
|
```typescript
|
|
export enum DataClassification {
|
|
PUBLIC = 'public', // Public information
|
|
INTERNAL = 'internal', // Internal use only
|
|
CONFIDENTIAL = 'confidential', // Sensitive business data
|
|
RESTRICTED = 'restricted', // Highly sensitive data
|
|
}
|
|
|
|
// Data classification mapping
|
|
const dataClassification = {
|
|
// Public data
|
|
'appVersion': DataClassification.PUBLIC,
|
|
'featureFlags': DataClassification.PUBLIC,
|
|
|
|
// Internal data
|
|
'userPreferences': DataClassification.INTERNAL,
|
|
'learningProgress': DataClassification.INTERNAL,
|
|
'quizResults': DataClassification.INTERNAL,
|
|
|
|
// Confidential data
|
|
'email': DataClassification.CONFIDENTIAL,
|
|
'personalInfo': DataClassification.CONFIDENTIAL,
|
|
'schoolData': DataClassification.CONFIDENTIAL,
|
|
|
|
// Restricted data
|
|
'assessmentScores': DataClassification.RESTRICTED,
|
|
'behavioralData': DataClassification.RESTRICTED,
|
|
'healthInformation': DataClassification.RESTRICTED,
|
|
};
|
|
```
|
|
|
|
#### Data Retention Policy
|
|
```typescript
|
|
// Data retention configuration
|
|
const retentionPolicy = {
|
|
// User data
|
|
userData: {
|
|
active: 'indefinite', // While account is active
|
|
inactive: '2 years', // After account closure
|
|
deleted: '30 days', // After deletion request
|
|
},
|
|
|
|
// Learning data
|
|
learningProgress: {
|
|
detailed: '2 years', // Detailed progress
|
|
summary: '7 years', // Summary statistics
|
|
aggregated: 'indefinite', // Aggregated analytics
|
|
},
|
|
|
|
// System logs
|
|
logs: {
|
|
access: '90 days', // Access logs
|
|
errors: '1 year', // Error logs
|
|
performance: '30 days', // Performance logs
|
|
security: '7 years', // Security logs
|
|
},
|
|
|
|
// Audit data
|
|
audit: {
|
|
userActions: '7 years', // User action logs
|
|
adminActions: 'indefinite', // Admin actions
|
|
dataAccess: '7 years', // Data access logs
|
|
},
|
|
};
|
|
```
|
|
|
|
---
|
|
|
|
## 🌐 NETWORK SECURITY
|
|
|
|
### API Security
|
|
|
|
#### Rate Limiting
|
|
```typescript
|
|
// Rate limiting configuration
|
|
export const rateLimitConfig = {
|
|
// Global limits
|
|
global: {
|
|
windowMs: 60 * 1000, // 1 minute
|
|
max: 1000, // 1000 requests per minute
|
|
},
|
|
|
|
// Per-endpoint limits
|
|
endpoints: {
|
|
'/auth/signin': {
|
|
windowMs: 15 * 60 * 1000, // 15 minutes
|
|
max: 5, // 5 login attempts
|
|
},
|
|
'/tutor/ask': {
|
|
windowMs: 60 * 1000, // 1 minute
|
|
max: 20, // 20 questions per minute
|
|
},
|
|
'/quiz/submit': {
|
|
windowMs: 60 * 1000, // 1 minute
|
|
max: 10, // 10 quiz submissions per minute
|
|
},
|
|
'/content/upload': {
|
|
windowMs: 60 * 1000, // 1 minute
|
|
max: 5, // 5 uploads per minute
|
|
},
|
|
},
|
|
|
|
// Per-user limits
|
|
perUser: {
|
|
windowMs: 60 * 1000, // 1 minute
|
|
max: 100, // 100 requests per minute per user
|
|
},
|
|
};
|
|
```
|
|
|
|
#### API Security Headers
|
|
```typescript
|
|
// Security headers middleware
|
|
export const securityHeaders = {
|
|
'Content-Security-Policy': [
|
|
"default-src 'self'",
|
|
"script-src 'self' 'unsafe-inline'",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"img-src 'self' data: https:",
|
|
"font-src 'self'",
|
|
"connect-src 'self' https://api.learnit.app",
|
|
"frame-ancestors 'none'",
|
|
"base-uri 'self'",
|
|
"form-action 'self'",
|
|
].join('; '),
|
|
|
|
'X-Content-Type-Options': 'nosniff',
|
|
'X-Frame-Options': 'DENY',
|
|
'X-XSS-Protection': '1; mode=block',
|
|
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
|
|
'Referrer-Policy': 'strict-origin-when-cross-origin',
|
|
'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
|
|
};
|
|
```
|
|
|
|
#### Input Validation
|
|
```typescript
|
|
// Input validation middleware
|
|
export const validateInput = (schema: Joi.Schema) => {
|
|
return (req: Request, res: Response, next: NextFunction) => {
|
|
const { error } = schema.validate(req.body);
|
|
if (error) {
|
|
return res.status(400).json({
|
|
error: 'Validation error',
|
|
details: error.details.map(d => d.message),
|
|
});
|
|
}
|
|
next();
|
|
};
|
|
};
|
|
|
|
// Example validation schemas
|
|
export const schemas = {
|
|
askTutor: Joi.object({
|
|
query: Joi.string().min(5).max(500).required(),
|
|
mode: Joi.string().valid('EXPLANATION', 'TUTOR', 'EXPLORATION', 'REMEDIAL').required(),
|
|
context: Joi.object({
|
|
subject: Joi.string(),
|
|
currentTopic: Joi.string(),
|
|
}).optional(),
|
|
}),
|
|
|
|
submitQuiz: Joi.object({
|
|
quizId: Joi.string().required(),
|
|
answers: Joi.array().items(
|
|
Joi.object({
|
|
questionId: Joi.string().required(),
|
|
answer: Joi.alternatives().try(
|
|
Joi.number(),
|
|
Joi.string(),
|
|
Joi.array()
|
|
).required(),
|
|
timeSpent: Joi.number().min(0).max(3600).optional(),
|
|
})
|
|
).required(),
|
|
}),
|
|
};
|
|
```
|
|
|
|
### Database Security
|
|
|
|
#### Firestore Security Rules
|
|
```javascript
|
|
// Enhanced security rules
|
|
rules_version = '2';
|
|
service cloud.firestore {
|
|
match /databases/{database}/documents {
|
|
|
|
// Helper functions
|
|
function isAuthenticated() {
|
|
return request.auth != null;
|
|
}
|
|
|
|
function isSameSchool(schoolId) {
|
|
return isAuthenticated() &&
|
|
get(/databases/$(database)/documents/users/$(request.auth.uid)).data.schoolId == schoolId;
|
|
}
|
|
|
|
function hasRole(role) {
|
|
return isAuthenticated() &&
|
|
get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == role;
|
|
}
|
|
|
|
function isDataOwner(userId) {
|
|
return isAuthenticated() && request.auth.uid == userId;
|
|
}
|
|
|
|
function isValidTimestamp() {
|
|
return request.time == request.time;
|
|
}
|
|
|
|
function hasValidFields(fields) {
|
|
return request.resource.data.keys().hasAll(fields);
|
|
}
|
|
|
|
// Users collection
|
|
match /users/{userId} {
|
|
allow read, write: if isDataOwner(userId) || hasRole('admin');
|
|
allow create: if isAuthenticated() &&
|
|
isDataOwner(userId) &&
|
|
hasValidFields(['email', 'role', 'schoolId']) &&
|
|
isValidTimestamp();
|
|
allow update: if isDataOwner(userId) || hasRole('admin');
|
|
allow delete: if hasRole('admin');
|
|
}
|
|
|
|
// Learning states
|
|
match /learningStates/{studentId} {
|
|
allow read: if isAuthenticated() &&
|
|
(isDataOwner(studentId) || isSameSchool(resource.data.schoolId));
|
|
allow write: if isAuthenticated() &&
|
|
(isDataOwner(studentId) || hasRole('teacher'));
|
|
allow create: if isAuthenticated() && isDataOwner(studentId);
|
|
allow update: if isAuthenticated() &&
|
|
(isDataOwner(studentId) || hasRole('teacher'));
|
|
allow delete: if hasRole('admin');
|
|
}
|
|
|
|
// Content chunks
|
|
match /contentChunks/{chunkId} {
|
|
allow read: if isAuthenticated() && isSameSchool(resource.data.schoolId);
|
|
allow write: if isAuthenticated() &&
|
|
(hasRole('teacher') || hasRole('admin')) &&
|
|
isSameSchool(resource.data.schoolId);
|
|
allow create: if isAuthenticated() &&
|
|
hasRole('teacher') &&
|
|
isSameSchool(request.resource.data.schoolId);
|
|
allow update: if isAuthenticated() &&
|
|
(hasRole('teacher') || hasRole('admin')) &&
|
|
isSameSchool(resource.data.schoolId);
|
|
allow delete: if isAuthenticated() &&
|
|
(hasRole('teacher') || hasRole('admin')) &&
|
|
isSameSchool(resource.data.schoolId);
|
|
}
|
|
|
|
// Quiz attempts
|
|
match /quizAttempts/{attemptId} {
|
|
allow read: if isAuthenticated() &&
|
|
(isDataOwner(resource.data.studentId) || isSameSchool(resource.data.schoolId));
|
|
allow write: if isAuthenticated() &&
|
|
(isDataOwner(resource.data.studentId) || hasRole('teacher'));
|
|
allow create: if isAuthenticated() && isDataOwner(resource.data.studentId);
|
|
allow update: if hasRole('admin');
|
|
allow delete: if hasRole('admin');
|
|
}
|
|
|
|
// Audit logs (admin only)
|
|
match /auditLogs/{logId} {
|
|
allow read, write, create: if hasRole('admin');
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
#### Storage Security Rules
|
|
```javascript
|
|
// Firebase Storage security rules
|
|
rules_version = '2';
|
|
service firebase.storage {
|
|
match /b/{bucket}/o {
|
|
|
|
// Helper functions
|
|
function isAuthenticated() {
|
|
return request.auth != null;
|
|
}
|
|
|
|
function isSameSchool(schoolId) {
|
|
return isAuthenticated() &&
|
|
get(/databases/(default)/documents/users/$(request.auth.uid)).data.schoolId == schoolId;
|
|
}
|
|
|
|
function hasRole(role) {
|
|
return isAuthenticated() &&
|
|
get(/databases/(default)/documents/users/$(request.auth.uid)).data.role == role;
|
|
}
|
|
|
|
// Content files
|
|
match /content/{schoolId}/{allPaths=**} {
|
|
allow read: if isAuthenticated() && isSameSchool(schoolId);
|
|
allow write: if isAuthenticated() &&
|
|
(hasRole('teacher') || hasRole('admin')) &&
|
|
isSameSchool(schoolId);
|
|
allow create: if isAuthenticated() &&
|
|
(hasRole('teacher') || hasRole('admin')) &&
|
|
isSameSchool(schoolId) &&
|
|
request.resource.size < 50 * 1024 * 1024; // 50MB limit
|
|
}
|
|
|
|
// User avatars
|
|
match /avatars/{userId}/{fileName} {
|
|
allow read: if isAuthenticated();
|
|
allow write: if isAuthenticated() &&
|
|
request.auth.uid == userId &&
|
|
request.resource.size < 5 * 1024 * 1024; // 5MB limit
|
|
allow delete: if isAuthenticated() && request.auth.uid == userId;
|
|
}
|
|
|
|
// Temporary files
|
|
match /temp/{userId}/{fileName} {
|
|
allow read: if isAuthenticated() && request.auth.uid == userId;
|
|
allow write: if isAuthenticated() &&
|
|
request.auth.uid == userId &&
|
|
request.resource.size < 10 * 1024 * 1024; // 10MB limit
|
|
allow delete: if isAuthenticated() && request.auth.uid == userId;
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 🔍 MONITORING & AUDITING
|
|
|
|
### Security Monitoring
|
|
|
|
#### Real-time Monitoring
|
|
```typescript
|
|
// Security monitoring service
|
|
export class SecurityMonitor {
|
|
private alerts: SecurityAlert[] = [];
|
|
|
|
async detectAnomalies(request: Request): Promise<SecurityAlert[]> {
|
|
const alerts: SecurityAlert[] = [];
|
|
|
|
// Rate limit detection
|
|
const rateLimitAlert = await this.checkRateLimit(request);
|
|
if (rateLimitAlert) alerts.push(rateLimitAlert);
|
|
|
|
// Suspicious activity detection
|
|
const suspiciousAlert = await this.checkSuspiciousActivity(request);
|
|
if (suspiciousAlert) alerts.push(suspiciousAlert);
|
|
|
|
// Geolocation anomaly detection
|
|
const geoAlert = await this.checkGeolocationAnomaly(request);
|
|
if (geoAlert) alerts.push(geoAlert);
|
|
|
|
return alerts;
|
|
}
|
|
|
|
private async checkRateLimit(request: Request): Promise<SecurityAlert | null> {
|
|
const key = `rate_limit:${request.ip}:${request.path}`;
|
|
const count = await this.redis.incr(key);
|
|
|
|
if (count === 1) {
|
|
await this.redis.expire(key, 60); // 1 minute window
|
|
}
|
|
|
|
if (count > 100) {
|
|
return {
|
|
type: 'RATE_LIMIT_EXCEEDED',
|
|
severity: 'HIGH',
|
|
message: `Rate limit exceeded for ${request.ip}`,
|
|
metadata: {
|
|
ip: request.ip,
|
|
path: request.path,
|
|
count: count,
|
|
},
|
|
};
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
private async checkSuspiciousActivity(request: Request): Promise<SecurityAlert | null> {
|
|
// Check for unusual patterns
|
|
const patterns = [
|
|
/union.*select/i, // SQL injection
|
|
/<script.*>/i, // XSS
|
|
/\.\.\//, // Path traversal
|
|
/javascript:/i, // JavaScript injection
|
|
];
|
|
|
|
const body = JSON.stringify(request.body);
|
|
const query = request.url;
|
|
|
|
for (const pattern of patterns) {
|
|
if (pattern.test(body) || pattern.test(query)) {
|
|
return {
|
|
type: 'SUSPICIOUS_PATTERN',
|
|
severity: 'MEDIUM',
|
|
message: `Suspicious pattern detected: ${pattern}`,
|
|
metadata: {
|
|
pattern: pattern.toString(),
|
|
ip: request.ip,
|
|
userAgent: request.headers['user-agent'],
|
|
},
|
|
};
|
|
}
|
|
}
|
|
|
|
return null;
|
|
}
|
|
}
|
|
```
|
|
|
|
#### Audit Logging
|
|
```typescript
|
|
// Audit logging service
|
|
export class AuditLogger {
|
|
async logSecurityEvent(event: SecurityEvent): Promise<void> {
|
|
const auditLog = {
|
|
timestamp: new Date().toISOString(),
|
|
eventType: event.type,
|
|
severity: event.severity,
|
|
userId: event.userId,
|
|
ipAddress: event.ipAddress,
|
|
userAgent: event.userAgent,
|
|
action: event.action,
|
|
resource: event.resource,
|
|
result: event.result,
|
|
metadata: event.metadata,
|
|
};
|
|
|
|
// Log to Firestore
|
|
await admin.firestore().collection('auditLogs').add(auditLog);
|
|
|
|
// Log to external security system
|
|
await this.sendToSecuritySystem(auditLog);
|
|
|
|
// Check for immediate alerts
|
|
if (event.severity === 'HIGH' || event.severity === 'CRITICAL') {
|
|
await this.triggerSecurityAlert(auditLog);
|
|
}
|
|
}
|
|
|
|
private async sendToSecuritySystem(log: any): Promise<void> {
|
|
// Integration with SIEM or security monitoring system
|
|
const securityWebhook = process.env.SECURITY_WEBHOOK_URL;
|
|
if (securityWebhook) {
|
|
await fetch(securityWebhook, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify(log),
|
|
});
|
|
}
|
|
}
|
|
|
|
private async triggerSecurityAlert(log: any): Promise<void> {
|
|
// Send immediate notification to security team
|
|
const alert = {
|
|
type: 'SECURITY_ALERT',
|
|
severity: log.severity,
|
|
message: `Security event: ${log.eventType}`,
|
|
details: log,
|
|
};
|
|
|
|
// Send to Slack/email/SMS
|
|
await this.sendAlert(alert);
|
|
}
|
|
}
|
|
```
|
|
|
|
### Compliance Monitoring
|
|
|
|
#### GDPR Compliance
|
|
```typescript
|
|
// GDPR compliance monitoring
|
|
export class GDPRMonitor {
|
|
async checkCompliance(userId: string): Promise<ComplianceReport> {
|
|
const report: ComplianceReport = {
|
|
userId,
|
|
timestamp: new Date().toISOString(),
|
|
checks: [],
|
|
compliant: true,
|
|
};
|
|
|
|
// Check data consent
|
|
const consentCheck = await this.checkDataConsent(userId);
|
|
report.checks.push(consentCheck);
|
|
|
|
// Check data retention
|
|
const retentionCheck = await this.checkDataRetention(userId);
|
|
report.checks.push(retentionCheck);
|
|
|
|
// Check data processing
|
|
const processingCheck = await this.checkDataProcessing(userId);
|
|
report.checks.push(processingCheck);
|
|
|
|
// Check data sharing
|
|
const sharingCheck = await this.checkDataSharing(userId);
|
|
report.checks.push(sharingCheck);
|
|
|
|
report.compliant = report.checks.every(check => check.compliant);
|
|
|
|
return report;
|
|
}
|
|
|
|
private async checkDataConsent(userId: string): Promise<ComplianceCheck> {
|
|
const user = await this.getUser(userId);
|
|
const hasConsent = user.dataConsent?.given;
|
|
const consentUpToDate = this.isConsentRecent(user.dataConsent?.timestamp);
|
|
|
|
return {
|
|
type: 'DATA_CONSENT',
|
|
compliant: hasConsent && consentUpToDate,
|
|
details: {
|
|
hasConsent,
|
|
consentDate: user.dataConsent?.timestamp,
|
|
consentUpToDate,
|
|
},
|
|
};
|
|
}
|
|
|
|
private async checkDataRetention(userId: string): Promise<ComplianceCheck> {
|
|
const userData = await this.getUserData(userId);
|
|
const oldData = userData.filter(data => this.isDataTooOld(data.timestamp));
|
|
|
|
return {
|
|
type: 'DATA_RETENTION',
|
|
compliant: oldData.length === 0,
|
|
details: {
|
|
dataCount: userData.length,
|
|
oldDataCount: oldData.length,
|
|
retentionPolicy: '2 years',
|
|
},
|
|
};
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 🚨 INCIDENT RESPONSE
|
|
|
|
### Incident Response Plan
|
|
|
|
#### Incident Classification
|
|
```typescript
|
|
export enum IncidentSeverity {
|
|
LOW = 'low', // Minor issue, limited impact
|
|
MEDIUM = 'medium', // Moderate issue, some impact
|
|
HIGH = 'high', // Serious issue, significant impact
|
|
CRITICAL = 'critical', // Critical issue, severe impact
|
|
}
|
|
|
|
export enum IncidentType {
|
|
DATA_BREACH = 'data_breach',
|
|
UNAUTHORIZED_ACCESS = 'unauthorized_access',
|
|
DENIAL_OF_SERVICE = 'denial_of_service',
|
|
MALWARE = 'malware',
|
|
SOCIAL_ENGINEERING = 'social_engineering',
|
|
SYSTEM_COMPROMISE = 'system_compromise',
|
|
PHYSICAL_SECURITY = 'physical_security',
|
|
}
|
|
```
|
|
|
|
#### Response Procedures
|
|
```typescript
|
|
// Incident response service
|
|
export class IncidentResponse {
|
|
async handleIncident(incident: SecurityIncident): Promise<void> {
|
|
// Step 1: Immediate response
|
|
await this.immediateResponse(incident);
|
|
|
|
// Step 2: Assessment
|
|
const assessment = await this.assessIncident(incident);
|
|
|
|
// Step 3: Containment
|
|
await this.containIncident(incident, assessment);
|
|
|
|
// Step 4: Investigation
|
|
const investigation = await this.investigateIncident(incident);
|
|
|
|
// Step 5: Recovery
|
|
await this.recoverFromIncident(incident, investigation);
|
|
|
|
// Step 6: Post-incident review
|
|
await this.postIncidentReview(incident);
|
|
}
|
|
|
|
private async immediateResponse(incident: SecurityIncident): Promise<void> {
|
|
// Log incident
|
|
await this.logIncident(incident);
|
|
|
|
// Alert security team
|
|
await this.alertSecurityTeam(incident);
|
|
|
|
// Initial containment if critical
|
|
if (incident.severity === IncidentSeverity.CRITICAL) {
|
|
await this.emergencyContainment(incident);
|
|
}
|
|
}
|
|
|
|
private async assessIncident(incident: SecurityIncident): Promise<IncidentAssessment> {
|
|
return {
|
|
impact: await this.assessImpact(incident),
|
|
scope: await this.assessScope(incident),
|
|
urgency: this.calculateUrgency(incident),
|
|
resources: await this.identifyResources(incident),
|
|
};
|
|
}
|
|
|
|
private async containIncident(incident: SecurityIncident, assessment: IncidentAssessment): Promise<void> {
|
|
switch (incident.type) {
|
|
case IncidentType.UNAUTHORIZED_ACCESS:
|
|
await this.containUnauthorizedAccess(incident);
|
|
break;
|
|
case IncidentType.DATA_BREACH:
|
|
await this.containDataBreach(incident);
|
|
break;
|
|
case IncidentType.DENIAL_OF_SERVICE:
|
|
await this.containDenialOfService(incident);
|
|
break;
|
|
default:
|
|
await this.genericContainment(incident);
|
|
}
|
|
}
|
|
|
|
private async containUnauthorizedAccess(incident: SecurityIncident): Promise<void> {
|
|
// Revoke compromised tokens
|
|
await this.revokeTokens(incident.userId);
|
|
|
|
// Force password reset
|
|
await this.forcePasswordReset(incident.userId);
|
|
|
|
// Enable additional monitoring
|
|
await this.enhanceMonitoring(incident.userId);
|
|
}
|
|
|
|
private async containDataBreach(incident: SecurityIncident): Promise<void> {
|
|
// Isolate affected systems
|
|
await this.isolateSystems(incident.affectedSystems);
|
|
|
|
// Preserve evidence
|
|
await this.preserveEvidence(incident);
|
|
|
|
// Notify affected users
|
|
await this.notifyAffectedUsers(incident);
|
|
}
|
|
}
|
|
```
|
|
|
|
#### Communication Plan
|
|
```typescript
|
|
// Incident communication service
|
|
export class IncidentCommunication {
|
|
async notifyStakeholders(incident: SecurityIncident): Promise<void> {
|
|
const stakeholders = await this.getStakeholders(incident);
|
|
|
|
for (const stakeholder of stakeholders) {
|
|
await this.notifyStakeholder(stakeholder, incident);
|
|
}
|
|
}
|
|
|
|
private async notifyStakeholder(stakeholder: Stakeholder, incident: SecurityIncident): Promise<void> {
|
|
const message = this.createMessage(stakeholder, incident);
|
|
|
|
switch (stakeholder.type) {
|
|
case 'SECURITY_TEAM':
|
|
await this.sendUrgentNotification(stakeholder, message);
|
|
break;
|
|
case 'MANAGEMENT':
|
|
await this.sendExecutiveNotification(stakeholder, message);
|
|
break;
|
|
case 'LEGAL':
|
|
await this.sendLegalNotification(stakeholder, message);
|
|
break;
|
|
case 'USERS':
|
|
await this.sendUserNotification(stakeholder, message);
|
|
break;
|
|
case 'PUBLIC':
|
|
await this.sendPublicNotification(stakeholder, message);
|
|
break;
|
|
}
|
|
}
|
|
|
|
private createMessage(stakeholder: Stakeholder, incident: SecurityIncident): string {
|
|
const templates = {
|
|
SECURITY_TEAM: `URGENT: ${incident.type} detected. Severity: ${incident.severity}. Immediate action required.`,
|
|
MANAGEMENT: `Security Incident Report: ${incident.type}. Impact: ${incident.impact}. Status: ${incident.status}`,
|
|
LEGAL: `Legal Notification: ${incident.type} incident. Potential regulatory implications.`,
|
|
USERS: `Security Notice: We're investigating a security incident. Your account may be affected.`,
|
|
PUBLIC: `Security Update: We're investigating a security incident and taking appropriate action.`,
|
|
};
|
|
|
|
return templates[stakeholder.type] || 'Security incident occurred.';
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 🛡️ VULNERABILITY MANAGEMENT
|
|
|
|
### Security Testing
|
|
|
|
#### Penetration Testing
|
|
```typescript
|
|
// Penetration testing framework
|
|
export class PenetrationTest {
|
|
async runSecurityTests(): Promise<TestResults> {
|
|
const results: TestResults = {
|
|
timestamp: new Date().toISOString(),
|
|
tests: [],
|
|
vulnerabilities: [],
|
|
score: 0,
|
|
};
|
|
|
|
// Authentication tests
|
|
const authTests = await this.testAuthentication();
|
|
results.tests.push(...authTests.tests);
|
|
results.vulnerabilities.push(...authTests.vulnerabilities);
|
|
|
|
// Authorization tests
|
|
const authzTests = await this.testAuthorization();
|
|
results.tests.push(...authzTests.tests);
|
|
results.vulnerabilities.push(...authzTests.vulnerabilities);
|
|
|
|
// Input validation tests
|
|
const inputTests = await this.testInputValidation();
|
|
results.tests.push(...inputTests.tests);
|
|
results.vulnerabilities.push(...inputTests.vulnerabilities);
|
|
|
|
// Data protection tests
|
|
const dataTests = await this.testDataProtection();
|
|
results.tests.push(...dataTests.tests);
|
|
results.vulnerabilities.push(...dataTests.vulnerabilities);
|
|
|
|
// Calculate security score
|
|
results.score = this.calculateSecurityScore(results);
|
|
|
|
return results;
|
|
}
|
|
|
|
private async testAuthentication(): Promise<TestResult> {
|
|
const tests = [];
|
|
const vulnerabilities = [];
|
|
|
|
// Test weak passwords
|
|
const weakPasswordTest = await this.testWeakPasswords();
|
|
tests.push(weakPasswordTest);
|
|
if (weakPasswordTest.vulnerable) {
|
|
vulnerabilities.push({
|
|
type: 'WEAK_PASSWORDS',
|
|
severity: 'HIGH',
|
|
description: 'Weak password policy detected',
|
|
recommendation: 'Implement stronger password requirements',
|
|
});
|
|
}
|
|
|
|
// Test session management
|
|
const sessionTest = await this.testSessionManagement();
|
|
tests.push(sessionTest);
|
|
if (sessionTest.vulnerable) {
|
|
vulnerabilities.push({
|
|
type: 'SESSION_MANAGEMENT',
|
|
severity: 'MEDIUM',
|
|
description: 'Session management issues detected',
|
|
recommendation: 'Improve session security',
|
|
});
|
|
}
|
|
|
|
return { tests, vulnerabilities };
|
|
}
|
|
|
|
private async testInputValidation(): Promise<TestResult> {
|
|
const tests = [];
|
|
const vulnerabilities = [];
|
|
|
|
// Test SQL injection
|
|
const sqlInjectionTest = await this.testSQLInjection();
|
|
tests.push(sqlInjectionTest);
|
|
if (sqlInjectionTest.vulnerable) {
|
|
vulnerabilities.push({
|
|
type: 'SQL_INJECTION',
|
|
severity: 'CRITICAL',
|
|
description: 'SQL injection vulnerability detected',
|
|
recommendation: 'Implement proper input sanitization',
|
|
});
|
|
}
|
|
|
|
// Test XSS
|
|
const xssTest = await this.testXSS();
|
|
tests.push(xssTest);
|
|
if (xssTest.vulnerable) {
|
|
vulnerabilities.push({
|
|
type: 'XSS',
|
|
severity: 'HIGH',
|
|
description: 'Cross-site scripting vulnerability detected',
|
|
recommendation: 'Implement proper output encoding',
|
|
});
|
|
}
|
|
|
|
return { tests, vulnerabilities };
|
|
}
|
|
}
|
|
```
|
|
|
|
#### Code Security Analysis
|
|
```typescript
|
|
// Static code analysis
|
|
export class CodeSecurityAnalyzer {
|
|
async analyzeCode(codePath: string): Promise<SecurityReport> {
|
|
const report: SecurityReport = {
|
|
timestamp: new Date().toISOString(),
|
|
issues: [],
|
|
score: 0,
|
|
};
|
|
|
|
// Analyze for security issues
|
|
const issues = await this.scanForSecurityIssues(codePath);
|
|
report.issues = issues;
|
|
|
|
// Calculate security score
|
|
report.score = this.calculateSecurityScore(issues);
|
|
|
|
return report;
|
|
}
|
|
|
|
private async scanForSecurityIssues(codePath: string): Promise<SecurityIssue[]> {
|
|
const issues: SecurityIssue[] = [];
|
|
|
|
// Scan for hardcoded secrets
|
|
const secrets = await this.scanForSecrets(codePath);
|
|
issues.push(...secrets);
|
|
|
|
// Scan for insecure functions
|
|
const insecureFunctions = await this.scanForInsecureFunctions(codePath);
|
|
issues.push(...insecureFunctions);
|
|
|
|
// Scan for input validation issues
|
|
const validationIssues = await this.scanForValidationIssues(codePath);
|
|
issues.push(...validationIssues);
|
|
|
|
return issues;
|
|
}
|
|
|
|
private async scanForSecrets(codePath: string): Promise<SecurityIssue[]> {
|
|
const secrets = [];
|
|
const secretPatterns = [
|
|
/password\s*=\s*['"`][^'"`]+['"`]/gi,
|
|
/api_key\s*=\s*['"`][^'"`]+['"`]/gi,
|
|
/secret\s*=\s*['"`][^'"`]+['"`]/gi,
|
|
/token\s*=\s*['"`][^'"`]+['"`]/gi,
|
|
];
|
|
|
|
const files = await this.getAllCodeFiles(codePath);
|
|
|
|
for (const file of files) {
|
|
const content = await fs.readFile(file, 'utf8');
|
|
|
|
for (const pattern of secretPatterns) {
|
|
const matches = content.match(pattern);
|
|
if (matches) {
|
|
secrets.push({
|
|
type: 'HARDCODED_SECRET',
|
|
severity: 'HIGH',
|
|
file: file,
|
|
line: this.getLineNumber(content, matches[0]),
|
|
code: matches[0],
|
|
recommendation: 'Use environment variables or secure storage',
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
return secrets;
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 📋 COMPLIANCE & REGULATIONS
|
|
|
|
### GDPR Compliance
|
|
|
|
#### Data Subject Rights
|
|
```typescript
|
|
// GDPR rights implementation
|
|
export class GDPRRights {
|
|
async rightToAccess(userId: string): Promise<UserDataExport> {
|
|
const userData = await this.getAllUserData(userId);
|
|
|
|
return {
|
|
personalData: userData.personal,
|
|
learningData: userData.learning,
|
|
interactionData: userData.interactions,
|
|
metadata: {
|
|
exportDate: new Date().toISOString(),
|
|
recordCount: this.countRecords(userData),
|
|
},
|
|
};
|
|
}
|
|
|
|
async rightToRectification(userId: string, corrections: DataCorrection[]): Promise<void> {
|
|
for (const correction of corrections) {
|
|
await this.updateUserData(userId, correction.field, correction.newValue);
|
|
await this.logDataCorrection(userId, correction);
|
|
}
|
|
}
|
|
|
|
async rightToErasure(userId: string): Promise<void> {
|
|
// Soft delete (retain for legal requirements)
|
|
await this.anonymizeUserData(userId);
|
|
|
|
// Hard delete after retention period
|
|
await this.scheduleDataDeletion(userId, this.getRetentionPeriod());
|
|
|
|
// Confirmation to user
|
|
await this.confirmDataErasure(userId);
|
|
}
|
|
|
|
async rightToPortability(userId: string): Promise<DataExport> {
|
|
const userData = await this.rightToAccess(userId);
|
|
|
|
return {
|
|
format: 'JSON',
|
|
data: userData,
|
|
schema: 'learnit-data-schema-v1.0',
|
|
};
|
|
}
|
|
|
|
async rightToObjection(userId: string, processingType: string): Promise<void> {
|
|
await this.stopDataProcessing(userId, processingType);
|
|
await this.logObjection(userId, processingType);
|
|
}
|
|
}
|
|
```
|
|
|
|
### Educational Data Privacy
|
|
|
|
#### FERPA Compliance (US)
|
|
```typescript
|
|
// FERPA compliance implementation
|
|
export class FERPACompliance {
|
|
async ensurePrivacy(studentId: string): Promise<PrivacyStatus> {
|
|
const status: PrivacyStatus = {
|
|
studentId,
|
|
timestamp: new Date().toISOString(),
|
|
checks: [],
|
|
compliant: true,
|
|
};
|
|
|
|
// Check directory information
|
|
const directoryCheck = await this.checkDirectoryInformation(studentId);
|
|
status.checks.push(directoryCheck);
|
|
|
|
// Check educational records
|
|
const recordsCheck = await this.checkEducationalRecords(studentId);
|
|
status.checks.push(recordsCheck);
|
|
|
|
// Check parental access
|
|
const parentalCheck = await this.checkParentalAccess(studentId);
|
|
status.checks.push(parentalCheck);
|
|
|
|
status.compliant = status.checks.every(check => check.compliant);
|
|
|
|
return status;
|
|
}
|
|
|
|
private async checkEducationalRecords(studentId: string): Promise<ComplianceCheck> {
|
|
const records = await this.getEducationalRecords(studentId);
|
|
|
|
return {
|
|
type: 'EDUCATIONAL_RECORDS',
|
|
compliant: this.validateEducationalRecords(records),
|
|
details: {
|
|
recordCount: records.length,
|
|
accessLevel: this.getAccessLevel(records),
|
|
lastAccessed: this.getLastAccessed(records),
|
|
},
|
|
};
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 🔧 SECURITY BEST PRACTICES
|
|
|
|
### Development Security
|
|
|
|
#### Secure Coding Guidelines
|
|
```typescript
|
|
// Security coding standards
|
|
export const securityGuidelines = {
|
|
authentication: [
|
|
'Use strong password policies',
|
|
'Implement multi-factor authentication',
|
|
'Use secure session management',
|
|
'Implement proper logout functionality',
|
|
],
|
|
|
|
dataProtection: [
|
|
'Encrypt sensitive data at rest',
|
|
'Use HTTPS for all communications',
|
|
'Implement proper input validation',
|
|
'Use parameterized queries',
|
|
],
|
|
|
|
errorHandling: [
|
|
'Don\'t expose sensitive information in error messages',
|
|
'Log security events appropriately',
|
|
'Implement graceful error handling',
|
|
'Use generic error messages for users',
|
|
],
|
|
|
|
configuration: [
|
|
'Use environment variables for secrets',
|
|
'Implement proper CORS policies',
|
|
'Use secure headers',
|
|
'Disable unnecessary features',
|
|
],
|
|
};
|
|
```
|
|
|
|
#### Security Testing Checklist
|
|
```typescript
|
|
// Security testing checklist
|
|
export const securityChecklist = {
|
|
authentication: [
|
|
'Password strength requirements',
|
|
'Account lockout mechanisms',
|
|
'Session timeout implementation',
|
|
'Multi-factor authentication',
|
|
'Secure password reset',
|
|
],
|
|
|
|
authorization: [
|
|
'Role-based access control',
|
|
'Least privilege principle',
|
|
'Resource access validation',
|
|
'API endpoint protection',
|
|
'Cross-origin resource sharing',
|
|
],
|
|
|
|
dataProtection: [
|
|
'Data encryption at rest',
|
|
'Data encryption in transit',
|
|
'Secure key management',
|
|
'Data retention policies',
|
|
'Privacy by design',
|
|
],
|
|
|
|
infrastructure: [
|
|
'Network security configuration',
|
|
'Server hardening',
|
|
'Database security',
|
|
'Backup encryption',
|
|
'Monitoring and logging',
|
|
],
|
|
};
|
|
```
|
|
|
|
---
|
|
|
|
## 📊 SECURITY METRICS
|
|
|
|
### Key Performance Indicators
|
|
|
|
#### Security Metrics
|
|
```typescript
|
|
// Security KPIs
|
|
export const securityMetrics = {
|
|
authentication: {
|
|
'Failed login attempts': 'count per hour',
|
|
'Account lockouts': 'count per day',
|
|
'MFA adoption rate': 'percentage',
|
|
'Password reset requests': 'count per day',
|
|
},
|
|
|
|
authorization: {
|
|
'Access denied events': 'count per hour',
|
|
'Permission changes': 'count per day',
|
|
'Role assignments': 'count per week',
|
|
'Privilege escalation attempts': 'count per day',
|
|
},
|
|
|
|
dataProtection: {
|
|
'Data encryption coverage': 'percentage',
|
|
'Data access violations': 'count per day',
|
|
'PII exposure incidents': 'count per month',
|
|
'Data retention compliance': 'percentage',
|
|
},
|
|
|
|
incidents: {
|
|
'Security incidents': 'count per month',
|
|
'Incident response time': 'minutes',
|
|
'Vulnerability remediation time': 'days',
|
|
'Security testing coverage': 'percentage',
|
|
},
|
|
};
|
|
```
|
|
|
|
#### Security Dashboard
|
|
```typescript
|
|
// Security monitoring dashboard
|
|
export class SecurityDashboard {
|
|
async getSecurityMetrics(): Promise<SecurityMetrics> {
|
|
return {
|
|
authentication: await this.getAuthenticationMetrics(),
|
|
authorization: await this.getAuthorizationMetrics(),
|
|
dataProtection: await this.getDataProtectionMetrics(),
|
|
incidents: await this.getIncidentMetrics(),
|
|
compliance: await this.getComplianceMetrics(),
|
|
};
|
|
}
|
|
|
|
private async getAuthenticationMetrics(): Promise<AuthMetrics> {
|
|
const now = new Date();
|
|
const hourAgo = new Date(now.getTime() - 60 * 60 * 1000);
|
|
|
|
const failedLogins = await this.countFailedLogins(hourAgo, now);
|
|
const accountLockouts = await this.countAccountLockouts(hourAgo, now);
|
|
const mfaAdoption = await this.calculateMFAAdoption();
|
|
|
|
return {
|
|
failedLogins,
|
|
accountLockouts,
|
|
mfaAdoption,
|
|
passwordResets: await this.countPasswordResets(hourAgo, now),
|
|
};
|
|
}
|
|
}
|
|
```
|
|
|
|
---
|
|
|
|
## 📞 SECURITY CONTACTS
|
|
|
|
### Security Team
|
|
|
|
#### Incident Response Team
|
|
- **Security Lead**: security@learnit.app
|
|
- **Incident Response**: incidents@learnit.app
|
|
- **Vulnerability Reports**: vulnerabilities@learnit.app
|
|
- **Compliance Officer**: compliance@learnit.app
|
|
|
|
#### Emergency Contacts
|
|
- **Critical Incidents**: +1-800-SECURITY
|
|
- **Data Breach**: +1-800-BREACH
|
|
- **Legal Counsel**: legal@learnit.app
|
|
- **Law Enforcement**: emergency@learnit.app
|
|
|
|
### Reporting Security Issues
|
|
|
|
#### Vulnerability Disclosure
|
|
- **Email**: security@learnit.app
|
|
- **PGP Key**: Available on request
|
|
- **Response Time**: Within 24 hours
|
|
- **Bounty Program**: Available for qualifying reports
|
|
|
|
#### Data Subject Requests
|
|
- **Access Requests**: privacy@learnit.app
|
|
- **Deletion Requests**: delete@learnit.app
|
|
- **Correction Requests**: corrections@learnit.app
|
|
- **Complaints**: complaints@learnit.app
|
|
|
|
---
|
|
|
|
## ✅ SECURITY CHECKLIST
|
|
|
|
### Daily Security Checks
|
|
- [ ] Review security logs for anomalies
|
|
- [ ] Monitor failed authentication attempts
|
|
- [ ] Check system resource utilization
|
|
- [ ] Verify backup completion
|
|
- [ ] Review access request approvals
|
|
|
|
### Weekly Security Reviews
|
|
- [ ] Analyze security metrics trends
|
|
- [ ] Review incident reports
|
|
- [ ] Update threat intelligence
|
|
- [ ] Check compliance status
|
|
- [ ] Review security patch status
|
|
|
|
### Monthly Security Audits
|
|
- [ ] Conduct vulnerability scans
|
|
- [ ] Review access controls
|
|
- [ ] Update security policies
|
|
- [ ] Perform penetration testing
|
|
- [ ] Review data retention compliance
|
|
|
|
### Quarterly Security Assessments
|
|
- [ ] Full security audit
|
|
- [ ] Risk assessment update
|
|
- [ ] Security training review
|
|
- [ ] Compliance audit
|
|
- [ ] Incident response drill
|
|
|
|
---
|
|
|
|
*Last Updated: 2026-05-06*
|
|
*Version: 1.0.0*
|
|
*Security Team: Information Security*
|