Cybersecurity

Dokumen

• Report temuan (executive summary + technical detail)
• Risk rating & remediation plan
• Checklist hardening & best practices
• Playbook IR (opsional)

Sesi & Verifikasi

• Walkthrough hasil & tanya jawab
• Fix verification (sesuai paket)
• Knowledge transfer & rekomendasi prioritas

JS/TS (SAST + Dep Scan)

name: security-js
on: [push, pull_request]
jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm ci
      - name: ESLint + tsconfig checks (opsional)
        run: npm run lint --if-present
      - name: Dependency Audit
        run: npm audit --production --audit-level=moderate || true
  dast:
    runs-on: ubuntu-latest
    steps:
      - name: OWASP ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.10.0
        with:
          target: https://staging.example.com
          cmd_options: -a

Java (FindSecBugs + Dependency-Check)

name: security-java
on: [push, pull_request]
jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
      - name: Build + SpotBugs
        run: mvn -B -DskipTests=false clean verify
      - name: Dependency-Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: my-java-app
          path: .
          format: HTML
      - name: Upload DC report
        uses: actions/upload-artifact@v4
        with:
          name: dep-check-report
          path: ./dependency-check-report.html

Linux sysctl (network)

# /etc/sysctl.d/99-security.conf
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
kernel.kptr_restrict = 2
kernel.randomize_va_space = 2
# apply: sysctl --system

OpenSSH (sshd_config)

# /etc/ssh/sshd_config.d/99-hardening.conf
Protocol 2
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
ClientAliveInterval 300
ClientAliveCountMax 2
AllowTcpForwarding no
X11Forwarding no
MaxAuthTries 3
# restart: systemctl restart sshd

UFW (Firewall)

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp comment "SSH"
ufw allow 80,443/tcp comment "HTTP(S)"
ufw enable

NGINX Security Headers

# /etc/nginx/conf.d/security-headers.conf
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
# include in server {} block: include conf.d/security-headers.conf;

PostgreSQL

# postgresql.conf
listen_addresses = 'localhost'            # gunakan private IP/VPC bila perlu
password_encryption = scram-sha-256
ssl = on
log_connections = on
log_disconnections = on
log_statement = 'ddl'
log_min_duration_statement = 500
shared_preload_libraries = 'auto_explain'

# pg_hba.conf (gunakan CIDR yang ketat)
hostssl all all 10.0.0.0/24 scram-sha-256
host    all all 127.0.0.1/32    scram-sha-256
host    all all ::1/128         scram-sha-256

MySQL/MariaDB

# /etc/mysql/conf.d/99-hardening.cnf
[mysqld]
bind-address = 127.0.0.1
require_secure_transport = ON
default_authentication_plugin = caching_sha2_password
local_infile = OFF
secure_file_priv = /var/lib/mysql-files
log_error_verbosity = 2
slow_query_log = 1
long_query_time = 0.5

-- contoh grant minimal
CREATE USER 'app'@'10.%' IDENTIFIED BY 'strong-password';
GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'app'@'10.%';
FLUSH PRIVILEGES;