Security on Ankit Maurya

MCP Monitoring Tool

Sat, 15 Jun 2024 00:00:00 +0000

This project is a proxy-based monitoring system for inspecting LLM context during conversations. It provides visibility into what’s being sent to and from AI models.

Features

Context Inspection: Monitor all prompts and responses going to LLM APIs
Security Logging: Capture and store interaction data for security analysis
Real-time Monitoring: Live view of active conversations
Data Export: Export conversation logs for analysis

Architecture

The tool sits as a proxy between your application and the LLM API, intercepting all traffic for inspection.

Secure Cloudflare Tunnel + Nginx

Mon, 20 May 2024 00:00:00 +0000

A comprehensive guide to exposing self-hosted services securely using Cloudflare Tunnel and Nginx reverse proxy.

Why This Setup?

No need to open ports on your firewall
Automatic SSL/TLS encryption
DDoS protection from Cloudflare
Access control via Cloudflare Access

Architecture Overview

User --> Cloudflare --> Tunnel --> Nginx --> Service

Configuration Steps

Create a Cloudflare account and add your domain
Install cloudflared on your server
Configure the tunnel with your services
Set up Nginx as a reverse proxy
Configure SSL certificates

Nginx Configuration

server {
    listen 443 ssl;
    server_name service.example.com;

    ssl_certificate /etc/ssl/certs/cert.pem;
    ssl_certificate_key /etc/ssl/private/key.pem;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Security Considerations

Enable authenticated origin pulls
Use Cloudflare Access for sensitive services
Implement rate limiting
Log all access attempts

Building a CSPM Pipeline: Lessons Learned

Wed, 15 May 2024 00:00:00 +0000

Cloud Security Posture Management (CSPM) pipelines help organizations continuously monitor and improve their security posture. Here’s what I learned building CSPM solutions.

Why CSPM Matters

Manual security reviews don’t scale. As cloud infrastructure grows, you need automated checks that run continuously.

Core Components

1. Data Collection

import boto3

def collect_iam_policies():
    iam = boto3.client('iam')
    policies = iam.list_policies(Scope='Local')['Policies']
    return [
        {
            'arn': p['Arn'],
            'name': p['PolicyName'],
            'version': iam.get_policy_version(
                PolicyArn=p['Arn'],
                VersionId=iam.get_default_version_id(p['Arn'])['DefaultVersionId']
            )['PolicyVersion']['Document']
        }
        for p in policies
    ]

2. Policy Evaluation

Each control should map to a security benchmark (CIS, NIST, SOC2). Example check:

Zero Trust Architecture: Implementation Guide

Mon, 08 Apr 2024 00:00:00 +0000

Zero Trust isn’t a product you buy—it’s a security philosophy you implement. Here’s a practical approach to building zero trust in cloud environments.

Core Principles

Never Trust, Always Verify
Assume Breach
Least Privilege Access
Verify Explicitly

Network Layer

Traditional perimeter security assumes everything inside is trusted. Zero trust rejects this.

Micro-segmentation

# Terraform: Security groups for micro-segmentation
resource "aws_security_group" "app_server" {
  name        = "app-server"
  vpc_id      = var.vpc_id

  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.load_balancer.id]
  }

  egress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.database.id]
  }
}

Services can only communicate with explicitly allowed paths.

Container Security Best Practices

Wed, 20 Mar 2024 00:00:00 +0000

Container security is critical in modern cloud-native applications. Here’s a comprehensive guide to securing your containerized workloads.

Container Images

Use Minimal Base Images

# Bad: Large base image with many dependencies
FROM ubuntu:22.04

# Good: Minimal image with just what's needed
FROM gcr.io/distroless/static-debian12

Distroless images contain only the application and its runtime dependencies, reducing the attack surface.

Multi-Stage Builds

# Build stage
FROM golang:1.22 AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 go build -o main

# Production stage
FROM gcr.io/distroless/static-debian12
COPY --from=builder /app/main /main
ENTRYPOINT ["/main"]

This keeps build tools and source code out of production images.

JWT Security Analysis

Tue, 05 Mar 2024 00:00:00 +0000

Tools and techniques for analyzing JWT tokens for authentication vulnerabilities.

JWT Overview

JSON Web Tokens (JWT) are commonly used for authentication but can introduce security issues if not implemented correctly.

Common Vulnerabilities

Algorithm Confusion (alg: none)

# Exploit: Change alg to "none" and remove signature
header = {"alg": "none", "typ": "JWT"}
payload = {"sub": "1234567890", "role": "admin"}

Key Confusion (RS256 to HS256)

If the server uses RS256 but the library accepts HS256 with the public key as the secret.

Analysis Tools

JWT.io for manual inspection
Custom Python scripts for batch analysis
Burp Suite extension for runtime inspection

Validation Checklist

Verify signature with correct algorithm
Check token expiration (exp claim)
Validate audience (aud claim)
Ensure proper key management
Use strong secret keys (256-bit minimum)

Best Practices

Always validate algorithm expected by your application
Use asymmetric algorithms (RS256) when possible
Implement token rotation
Set appropriate expiration times