====== Cybersecurity & Systems Best Practices ====== This document outlines core cybersecurity and systems engineering best practices for maintaining secure, resilient, and compliant IT infrastructure across the Telenegar network, web applications, and email services. Applying a **defense-in-depth** strategy—combining identity governance, network perimeter security, transport encryption, and continuous monitoring—minimizes attack surfaces and protects systems against unauthorized access, data breaches, and service disruptions. ---- ===== 1. Identity & Access Management (IAM) ===== Identity is the primary security boundary for modern cloud and infrastructure services. * **Enforce Multi-Factor Authentication (MFA):** Require MFA (preferably TOTP or FIDO2 hardware keys) for all user accounts, administrative portals, SSH access, and [[email:clients:webmail|Webmail]]. * **Principle of Least Privilege (PoLP):** Grant users, application tokens, and service accounts only the minimum privileges required to perform their functions. * **Credential Management:** * Prohibit hardcoding secrets, API tokens, or passwords in codebase repositories. * Use environment variables or secret managers (e.g., Vault, AWS Secrets Manager). * Enforce application-specific passwords or OAuth2 tokens for [[email:clients:mail-clients|Mail Clients]]. ---- ===== 2. Infrastructure & Systems Hardening ===== ==== Network & Server Defense ==== * **Disable Unnecessary Services & Ports:** Keep firewall rules strict. Expose only required ports (`80/443` for HTTP/S, `22` for SSH, `993/465/587` for [[email:clients:mail-clients|Mail Services]]). * **Automate Security Updates:** Implement automated patch management for operating system kernels, web servers (Nginx/Apache), and runtime dependencies. * **Disable Insecure Protocols:** Decommission legacy, unencrypted protocols such as Telnet, FTP, HTTP, POP3 (`110`), and IMAP (`143`). Force encrypted alternatives (SSH, SFTP, HTTPS, IMAPS). ==== Transport Layer Security (TLS) ==== * Enforce **TLS 1.2+** across all HTTPS websites and SMTP/IMAP services; deprecate SSLv3, TLS 1.0, and TLS 1.1. * Use automated, short-lived SSL/TLS certificates (e.g., Let's Encrypt). * Enforce inbound mail transport security by deploying [[email:dns-configuration:mta-sts|MTA-STS]] and monitoring handshake health via [[email:dns-configuration:tls-rpt|TLS-RPT]]. ---- ===== 3. Web Application Security ===== ==== HTTP Security Headers ==== Hardened web applications and APIs must return protective HTTP headers to defend against browser-based vectors (XSS, clickjacking, MIME sniffing). Deploy standard baseline headers as outlined in [[security:security-headers|HTTP Security Headers]]: * `Content-Security-Policy` (CSP) * `Strict-Transport-Security` (HSTS) * `X-Frame-Options` * `X-Content-Type-Options` * `Referrer-Policy` ==== Input Validation & Sanitization ==== * Sanitize and validate all user-supplied input to prevent SQL Injection (SQLi), Command Injection, and Cross-Site Scripting (XSS). * Use parameterized queries or ORM frameworks for database interactions. ---- ===== 4. Email Security & Anti-Spoofing Architecture ===== Email protocols require explicit authentication mechanisms to prevent brand abuse, phishing, and spam generation. ^ Mechanism ^ Objective ^ Reference ^ | **SPF** | Authorize sending server IP addresses for your domain. | [[email:dns-configuration:spf|SPF Guide]] | | **DKIM** | Cryptographically sign outbound email to guarantee content integrity. | [[email:dns-configuration:dkim|DKIM Guide]] | | **DMARC** | Enforce policy (`p=quarantine` or `p=reject`) to block unauthorized or spoofed emails. | [[email:dns-configuration:dmarc|DMARC Guide]] | | **BIMI** | Display official verified brand logos in recipient inboxes. | [[email:dns-configuration:bimi|BIMI Guide]] | | **FCrDNS** | Maintain matching forward (`A`) and reverse (`PTR`) DNS records for mail servers. | [[email:troubleshooting:reverse-dns|Reverse DNS Guide]] | ---- ===== 5. Monitoring, Logging & Incident Response ===== * **Centralized Logging:** Aggregate server logs (auth, web access, SMTP logs) to a centralized, secure log management platform (SIEM). * **Audit Trail Analysis:** Monitor raw [[email:troubleshooting:mail-headers|Email Headers]] and HTTP request headers to investigate unauthorized access attempts or suspicious activity. * **Automated Rate Limiting:** Implement rate limiting (e.g., Fail2ban, WAF rules) to protect login endpoints and mail relays from brute-force and credential-stuffing attacks. * **Backup Strategy (3-2-1 Rule):** Maintain 3 copies of critical data on 2 different media types, with at least 1 copy stored securely offsite or in an immutable cloud bucket. ---- ===== Diagnostics & Compliance Audits with Telenegar ===== Regularly validate system security postures using **Telenegar Audit Tools**: ==== Using Telenegar Tools ==== * **Email & Server Security Audit:** Test SPF, DKIM, DMARC alignment, STARTTLS compliance, and port status with the [[tools:mailcheck|Telenegar Mail Check Tool]]. * **Global DNS & Propagation Check:** Validate `A/AAAA`, `MX`, `TXT`, and `PTR` record consistency using the [[tools:dnscheck|Telenegar DNS Check Tool]]. ---- ===== Related Documentation ===== * [[tools:mailcheck|Telenegar Mail Check Tool]] — Automated email security and server diagnostic tool. * [[tools:dnscheck|Telenegar DNS Check Tool]] — DNS lookup and propagation testing tool. * [[security:security-headers|HTTP Security Headers]] — Technical configuration guide for web server security headers. * [[email:security:email-encryption|Email Encryption]] — Transport and end-to-end encryption architecture. * [[email:security:spoofing|Email Spoofing]] — Countermeasures against exact-domain forging. * [[email:security:phishing|Phishing]] — Defense against credential harvesting and malicious campaigns. * [[email:security:spam|Spam]] — Inbound filtering and outbound reputation defense. * [[email:troubleshooting:email-deliverability|Email Deliverability]] — Best practices for inbox placement and domain reputation.