Operations Security

Introduction

Security is a top priority at MyQ Roger. We enforce a security-first approach at every stage of development, deployment, and operations. Given the critical nature of cloud environments, security must be proactive, automated, and continuously monitored to prevent breaches and unauthorized access.

Our Secure Operations strategy integrates continuous monitoring, vulnerability management, infrastructure security, and compliance to ensure the integrity of applications and infrastructure.

Monitoring

Continuous monitoring is essential for detecting and responding to threats in real time. MyQ implements a multi-layered monitoring approach:

Endpoint Detection and Response (EDR)

• Monitors all endpoints (servers, VMs, and containers) for suspicious activity.

• Uses behavioral analytics and threat intelligence to detect advanced threats.

• Automatically isolates compromised endpoints to prevent lateral movement.

Azure Defender (Now Defender for Cloud)

• Protects Azure AKS, SQL Server, Virtual Machines, and Storage.

• Provides real-time threat detection and security configuration recommendations.

• Integrates with Microsoft Sentinel (SIEM) for centralized alerting.

Host Scanning

• Scans VMs, cloud instances, and on-premises servers for misconfigurations and outdated software.

• Detects privilege escalation risks, unauthorized access points, and outdated dependencies.

Log Collection & Analysis

• Centralized logging on a separate cluster for scalability and isolation.

• Logs from Kubernetes, applications, and infrastructure are labeled for efficient retrieval.

• Long-term retention policies ensure compliance and security analysis.

• Alerting mechanisms detect anomalies and security incidents, integrating with SIEM.

• Real-time log correlation for API requests, authentication events, database queries, and firewall traffic.

Port Scanning

• Detects unauthorized open ports that expose services to threats.

• Uses automated tools like Nmap and ZMap to scan for unexpected port changes.

Container Scanning

• Static and dynamic scanning of Docker containers before deployment.

• Identifies vulnerabilities in base images, application layers, and runtime permissions.

• Integrated with Trivy for image security scanning.

Kubernetes Monitoring

• Uses Azure Kubernetes Service (AKS) built-in monitoring with Prometheus & Grafana.

• Monitors Kubernetes API calls, RBAC policies, and pod security.

• Alerts on container privilege escalations, excessive resource usage, and lateral movement attempts.

Regular TLS Scans

• MyQ performs TLS security scans using Qualys SSL Labs to ensure best practices.

• TLS configurations are evaluated to maintain an A+ security rating, mitigating risks from weak protocols.

• Automated tools verify certificate validity, expiration tracking, and protocol strength.

Vulnerability Management

Vulnerability Scanning

• Regular scans detect security flaws in applications and infrastructure.

• Includes automated CVE scanning for cloud-deployed components.

• Integrates with DefectDojo, SonarQube, and Trivy for risk assessment.

Penetration Testing

• Conducted regularly to identify security weaknesses before exploitation.

• Combines automated and manual testing methodologies for comprehensive assessment.

• Findings are documented, prioritized, and remediated accordingly.

Infrastructure Security

A hardened infrastructure ensures security beyond just monitoring. MyQ employs:

SIEM (Security Information and Event Management)

• Microsoft Sentinel SIEM collect security events for real-time detection.

• Analyzes logs from firewalls, identity systems, application logs, audit logs, and threat feeds.

• Enables automated responses to detected threats.

Security Tracking & Management

• Jira Bug Database tracks, categorizes, and prioritizes security vulnerabilities.

• DefectDojo consolidates test results, ensuring structured tracking of security engagements.

• Regular patching and remediation maintain a strong security posture.

Identity and Access Management (IAM)

• Enforces Zero Trust with role-based access control (RBAC) and multi-factor authentication (MFA).

• Uses Azure AD for identity governance.

• Privilege escalation alerts detect unauthorized admin access.

Development Workflow

Secure software development is a critical aspect of MyQ's security strategy. The following measures ensure the integrity of code, pipelines, and cloud environments:

Secure Development Environment

• MyQ developers use security-hardened environments with endpoint protection.

• Developers must follow secure coding practices and regular security training.

GitLab Secure Pipelines

• GitLab CI/CD pipelines include automated security checks, code reviews, and testing.

• Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) detect vulnerabilities.

• Container Image Signing ensures only trusted images are deployed.

IAM & Access Control

• Only Selected DevOps and SecOps personnel have access to Azure cloud environments.

• Role-based access control (RBAC) with Just-In-Time (JIT) least privilege elevation is enforced.

Azure Kubernetes & Container Security

• MyQ’s AKS clusters pull images only from Azure Container Registry (ACR).

• AKS environments enforce network policies and Pod Security Standards (PSS) to isolate workloads.

Secrets Management

• All secrets and API keys are stored in Azure Key Vault, accessible only to IAM-authorized personnel.

• Trivy filesystem scans are conducted before committing to Git to detect and prevent sensitive secrets.

Conclusion

MyQ's Secure Operations strategy is built on a foundation of continuous monitoring, proactive threat management, and strong infrastructure security. By leveraging advanced security tools, strict access controls, and automated testing, MyQ ensures a secure, resilient cloud environment.

With the integration of TLS security scans, penetration testing, and centralized logging, MyQ enhances its ability to detect, respond to, and mitigate security risks effectively.

Security is an evolving challenge, and MyQ remains committed to enhancing security measures through regular updates, compliance audits, and security best practices. By maintaining a security-first mindset, MyQ upholds the integrity and confidentiality of its services, ensuring trust and reliability for all stakeholders.