awsideman Advanced Cache Security Guide

This comprehensive security guide covers encryption setup, key management, security best practices, and disaster recovery procedures for awsideman's advanced cache features.

Security Overview

awsideman's advanced cache features provide enterprise-grade security through:

AES-256 encryption for cache data at rest
Secure key management using OS keyring integration
Backend security for both file and DynamoDB storage
Audit logging for security operations
Protection against common attacks (timing attacks, key exposure)

Security Architecture

┌─────────────────────────────────────────────────────────────────┐
│                    Security Layer Architecture                  │
├─────────────────────────────────────────────────────────────────┤
│  Application Layer                                              │
│  ├── Cache Manager (Transparent Encryption/Decryption)         │
│  └── CLI Commands (Security Operations)                        │
├─────────────────────────────────────────────────────────────────┤
│  Encryption Layer                                               │
│  ├── AES-256-CBC Encryption                                     │
│  ├── PKCS7 Padding                                              │
│  ├── Random IV Generation                                       │
│  └── Timing Attack Protection                                   │
├─────────────────────────────────────────────────────────────────┤
│  Key Management Layer                                           │
│  ├── OS Keyring Integration                                     │
│  ├── Secure Key Generation                                      │
│  ├── Key Rotation                                               │
│  └── Secure Key Deletion                                        │
├─────────────────────────────────────────────────────────────────┤
│  Storage Security                                               │
│  ├── File System Permissions                                    │
│  ├── DynamoDB Encryption at Rest                                │
│  ├── DynamoDB Encryption in Transit                             │
│  └── IAM Access Control                                         │
└─────────────────────────────────────────────────────────────────┘

Encryption Setup

Initial Encryption Setup

1. Enable Encryption in Configuration

Configuration File Method:

# ~/.awsideman/config.yaml
cache:
  encryption_enabled: true
  encryption_type: "aes256"

Environment Variable Method:

export AWSIDEMAN_CACHE_ENCRYPTION=true
export AWSIDEMAN_CACHE_ENCRYPTION_TYPE=aes256

2. Enable Encryption via CLI

# Enable encryption on existing cache
awsideman cache encryption enable

# Enable with confirmation prompt
awsideman cache encryption enable --interactive

# Enable and re-encrypt existing data
awsideman cache encryption enable --migrate-data

3. Verify Encryption Status

# Check encryption status
awsideman cache encryption status

# Test encryption functionality
awsideman cache encryption test

# Verify key availability
awsideman cache encryption key-status

Encryption Configuration Options

Basic Encryption Settings

cache:
  # Enable/disable encryption
  encryption_enabled: true

  # Encryption algorithm (currently only aes256 supported)
  encryption_type: "aes256"

  # Key rotation settings
  key_rotation_days: 90  # Rotate keys every 90 days

  # Security settings
  secure_memory: true    # Use secure memory for keys
  timing_protection: true # Protection against timing attacks

Advanced Security Settings

cache:
  encryption_enabled: true
  encryption_type: "aes256"

  # Advanced security options
  security:
    # Key derivation settings
    key_derivation_iterations: 100000

    # Memory protection
    secure_memory_enabled: true
    memory_lock_enabled: true

    # Audit settings
    audit_encryption_operations: true
    log_key_operations: false  # Never log actual keys

    # Backup settings
    automatic_key_backup: true
    backup_encryption: true

Backend-Specific Encryption

File Backend Encryption

cache:
  backend_type: "file"
  encryption_enabled: true

  # File-specific security
  file_permissions: "600"  # Owner read/write only
  directory_permissions: "700"  # Owner access only

DynamoDB Backend Encryption

cache:
  backend_type: "dynamodb"
  encryption_enabled: true

  # DynamoDB-specific security
  dynamodb_encryption_at_rest: true
  dynamodb_encryption_in_transit: true

  # Additional DynamoDB security
  dynamodb_vpc_endpoint: true
  dynamodb_iam_role: "arn:aws:iam::123456789012:role/awsideman-cache-role"

Key Management

Key Generation and Storage

Automatic Key Generation

# Generate new encryption key (automatic on first use)
awsideman cache encryption generate-key

# Generate key with specific parameters
awsideman cache encryption generate-key --algorithm aes256 --key-size 256

# Generate key with custom entropy
awsideman cache encryption generate-key --entropy-source /dev/urandom

Key Storage Locations

macOS (Keychain):

Service: awsideman-cache
Account: encryption-key
Location: ~/Library/Keychains/login.keychain-db

Windows (Credential Manager):

Target: awsideman-cache:encryption-key
Location: Windows Credential Manager

Linux (Secret Service):

Service: awsideman-cache
Username: encryption-key
Backend: GNOME Keyring, KWallet, or compatible

Manual Key Management

# Check key status
awsideman cache encryption key-status

# Backup encryption key
awsideman cache encryption backup-key --output ~/secure-backup/

# Restore encryption key
awsideman cache encryption restore-key --input ~/secure-backup/key-backup.enc

# Delete encryption key (dangerous!)
awsideman cache encryption delete-key --confirm

Key Rotation

Automatic Key Rotation

# Configure automatic rotation
cache:
  encryption_enabled: true
  key_rotation:
    enabled: true
    interval_days: 90
    automatic: true
    backup_old_keys: true

Manual Key Rotation

# Rotate encryption key
awsideman cache encryption rotate

# Rotate with backup
awsideman cache encryption rotate --backup

# Rotate and re-encrypt all data
awsideman cache encryption rotate --re-encrypt-all

# Check rotation status
awsideman cache encryption rotation-status

Key Rotation Process

Generate New Key: Create cryptographically secure new key
Backup Old Key: Securely backup current key (optional)
Re-encrypt Data: Re-encrypt all cache entries with new key
Update Keyring: Store new key in OS keyring
Secure Deletion: Securely delete old key from memory and storage
Verification: Verify all data can be decrypted with new key

Key Recovery and Backup

Creating Key Backups

# Create encrypted key backup
awsideman cache encryption backup-key \
  --output ~/secure-backup/awsideman-key-$(date +%Y%m%d).enc \
  --password

# Create key backup with metadata
awsideman cache encryption backup-key \
  --output ~/secure-backup/ \
  --include-metadata \
  --encrypt-backup

Restoring from Backup

# Restore key from backup
awsideman cache encryption restore-key \
  --input ~/secure-backup/awsideman-key-20240101.enc \
  --password

# Restore and verify
awsideman cache encryption restore-key \
  --input ~/secure-backup/awsideman-key-20240101.enc \
  --verify-data

Emergency Key Recovery

# If keyring is corrupted or unavailable
awsideman cache encryption emergency-recovery \
  --backup-file ~/secure-backup/awsideman-key-20240101.enc

# Recover from multiple backup sources
awsideman cache encryption emergency-recovery \
  --backup-file ~/secure-backup/awsideman-key-20240101.enc \
  --fallback-keyring \
  --verify-integrity

Security Best Practices

Encryption Best Practices

1. Always Enable Encryption in Production

# Production configuration
cache:
  encryption_enabled: true
  encryption_type: "aes256"

  # Production security settings
  security:
    secure_memory_enabled: true
    audit_encryption_operations: true
    automatic_key_backup: true

2. Use Strong Key Management

# Regular key rotation (quarterly)
awsideman cache encryption rotate --schedule quarterly

# Secure key backup
awsideman cache encryption backup-key --encrypt-backup --secure-location

3. Protect Against Key Exposure

cache:
  security:
    # Never log encryption keys
    log_key_operations: false

    # Use secure memory for key operations
    secure_memory_enabled: true

    # Clear keys from memory after use
    clear_memory_after_use: true

Access Control Best Practices

1. File System Permissions

# Set restrictive permissions on cache directory
chmod 700 ~/.awsideman/cache/
chmod 600 ~/.awsideman/cache/*

# Verify permissions
ls -la ~/.awsideman/cache/

2. DynamoDB IAM Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "awsidemanCacheAccess",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/awsideman-cache*",
      "Condition": {
        "StringEquals": {
          "dynamodb:LeadingKeys": ["${aws:userid}"]
        }
      }
    }
  ]
}

3. Principle of Least Privilege

# Use dedicated AWS profile for cache operations
cache:
  dynamodb_profile: "awsideman-cache-only"

# Limit cache table access
dynamodb_iam_role: "arn:aws:iam::123456789012:role/awsideman-cache-readonly"

Network Security Best Practices

1. Use VPC Endpoints for DynamoDB

cache:
  backend_type: "dynamodb"

  # Network security
  dynamodb_vpc_endpoint: true
  dynamodb_endpoint_url: "https://vpce-12345-abcdef.dynamodb.us-east-1.vpce.amazonaws.com"

2. Enable Encryption in Transit

cache:
  backend_type: "dynamodb"

  # Always use HTTPS
  dynamodb_use_ssl: true
  dynamodb_verify_ssl: true

Environment-Specific Security

Development Environment

# Development - balanced security and usability
cache:
  encryption_enabled: false  # Optional for development
  backend_type: "file"

  security:
    audit_operations: true
    debug_mode: true

Staging Environment

# Staging - production-like security
cache:
  encryption_enabled: true
  backend_type: "dynamodb"

  security:
    audit_encryption_operations: true
    key_rotation_days: 30  # More frequent rotation

Production Environment

# Production - maximum security
cache:
  encryption_enabled: true
  backend_type: "dynamodb"

  security:
    secure_memory_enabled: true
    audit_encryption_operations: true
    automatic_key_backup: true
    key_rotation_days: 90
    timing_protection: true

Disaster Recovery

Backup Strategies

1. Encryption Key Backups

# Create comprehensive key backup
awsideman cache encryption backup-key \
  --output ~/disaster-recovery/keys/ \
  --encrypt-backup \
  --include-metadata \
  --timestamp

# Automated backup script
#!/bin/bash
BACKUP_DIR="/secure/backup/awsideman/$(date +%Y/%m)"
mkdir -p "$BACKUP_DIR"

awsideman cache encryption backup-key \
  --output "$BACKUP_DIR/key-backup-$(date +%Y%m%d-%H%M%S).enc" \
  --encrypt-backup \
  --password-file /secure/backup-password.txt

2. Cache Data Backups

# Export cache data
awsideman cache export \
  --output ~/disaster-recovery/data/cache-export-$(date +%Y%m%d).json \
  --include-metadata \
  --encrypt-export

# DynamoDB-specific backup
awsideman cache dynamodb export \
  --output ~/disaster-recovery/data/dynamodb-export-$(date +%Y%m%d).json \
  --include-ttl \
  --compress

3. Configuration Backups

# Backup configuration
cp ~/.awsideman/config.yaml ~/disaster-recovery/config/config-$(date +%Y%m%d).yaml

# Backup with encryption keys removed
awsideman config export \
  --output ~/disaster-recovery/config/config-sanitized-$(date +%Y%m%d).yaml \
  --remove-sensitive

Recovery Procedures

1. Complete System Recovery

# Step 1: Restore configuration
cp ~/disaster-recovery/config/config-20240101.yaml ~/.awsideman/config.yaml

# Step 2: Restore encryption keys
awsideman cache encryption restore-key \
  --input ~/disaster-recovery/keys/key-backup-20240101.enc \
  --password-file /secure/recovery-password.txt

# Step 3: Restore cache data
awsideman cache import \
  --input ~/disaster-recovery/data/cache-export-20240101.json \
  --verify-integrity

# Step 4: Verify recovery
awsideman cache status
awsideman cache encryption test

2. Key Recovery Only

# If only encryption keys are lost
awsideman cache encryption restore-key \
  --input ~/disaster-recovery/keys/key-backup-latest.enc

# Verify key restoration
awsideman cache encryption key-status
awsideman cache encryption test

3. DynamoDB Table Recovery

# Recreate DynamoDB table
awsideman cache dynamodb create-table

# Restore data from backup
awsideman cache dynamodb import \
  --input ~/disaster-recovery/data/dynamodb-export-20240101.json \
  --verify-checksums

# Verify table recovery
awsideman cache dynamodb table-info
awsideman cache health connectivity

Recovery Testing

1. Regular Recovery Drills

# Monthly recovery test script
#!/bin/bash
echo "Starting disaster recovery test..."

# Create test backup
awsideman cache encryption backup-key --output /tmp/test-backup.enc

# Simulate key loss
awsideman cache encryption delete-key --confirm --test-mode

# Restore from backup
awsideman cache encryption restore-key --input /tmp/test-backup.enc

# Verify recovery
awsideman cache encryption test

echo "Recovery test completed successfully"

2. Automated Recovery Validation

# Validate backup integrity
awsideman cache backup validate \
  --key-backup ~/disaster-recovery/keys/key-backup-latest.enc \
  --data-backup ~/disaster-recovery/data/cache-export-latest.json

# Test recovery process
awsideman cache recovery test \
  --simulate-key-loss \
  --simulate-data-loss \
  --verify-restoration

Business Continuity Planning

1. Recovery Time Objectives (RTO)

Key Recovery: < 15 minutes
Cache Data Recovery: < 30 minutes
Full System Recovery: < 1 hour

2. Recovery Point Objectives (RPO)

Key Backups: Daily
Cache Data Backups: Every 4 hours
Configuration Backups: On every change

3. Emergency Contacts and Procedures

# Document in disaster recovery plan
emergency_contacts:
  primary_admin: "admin@company.com"
  backup_admin: "backup-admin@company.com"
  security_team: "security@company.com"

recovery_procedures:
  key_loss: "docs/recovery/key-loss-procedure.md"
  data_corruption: "docs/recovery/data-corruption-procedure.md"
  complete_failure: "docs/recovery/complete-failure-procedure.md"

Security Monitoring

Audit Logging

1. Enable Comprehensive Audit Logging

cache:
  security:
    audit_encryption_operations: true
    audit_key_operations: true
    audit_access_operations: true

    # Log destinations
    audit_log_file: "~/.awsideman/logs/security-audit.log"
    audit_log_syslog: true
    audit_log_cloudwatch: true  # If using AWS

2. Monitor Security Events

# View recent security events
awsideman cache audit show --recent --security-only

# Monitor key operations
awsideman cache audit show --filter key-operations --last 24h

# Check for suspicious activity
awsideman cache audit analyze --detect-anomalies

Security Metrics and Alerting

1. Key Security Metrics

# Key rotation status
awsideman cache encryption rotation-status

# Failed decryption attempts
awsideman cache audit show --filter failed-decryption --count

# Unauthorized access attempts
awsideman cache audit show --filter unauthorized-access --last 7d

2. Automated Security Monitoring

# Security monitoring script
#!/bin/bash
LOG_FILE="/var/log/awsideman-security-monitor.log"

# Check key rotation status
if ! awsideman cache encryption rotation-status --check-overdue; then
    echo "$(date): WARNING - Key rotation overdue" >> "$LOG_FILE"
    # Send alert
fi

# Check for failed decryption attempts
FAILED_COUNT=$(awsideman cache audit show --filter failed-decryption --last 1h --count)
if [ "$FAILED_COUNT" -gt 5 ]; then
    echo "$(date): ALERT - Multiple decryption failures: $FAILED_COUNT" >> "$LOG_FILE"
    # Send alert
fi

Intrusion Detection

1. Detect Unauthorized Access

# Monitor for unusual access patterns
awsideman cache audit analyze \
  --detect-unusual-access \
  --baseline-days 30 \
  --alert-threshold 3-sigma

# Check for access from new locations (DynamoDB)
awsideman cache audit show \
  --filter new-source-ip \
  --last 24h

2. Detect Data Tampering

# Verify cache integrity
awsideman cache verify --deep-check --report-anomalies

# Check for unauthorized modifications
awsideman cache audit show \
  --filter unauthorized-modifications \
  --include-checksums

Compliance and Auditing

Compliance Frameworks

1. SOC 2 Compliance

cache:
  compliance:
    soc2_mode: true

    # Required for SOC 2
    encryption_enabled: true
    audit_all_operations: true
    secure_key_management: true
    access_logging: true

    # Data retention
    audit_log_retention_days: 365
    cache_data_retention_days: 90

2. GDPR Compliance

cache:
  compliance:
    gdpr_mode: true

    # GDPR requirements
    data_encryption: true
    right_to_erasure: true
    data_portability: true

    # Privacy settings
    anonymize_logs: true
    data_minimization: true
    consent_tracking: true

3. HIPAA Compliance

cache:
  compliance:
    hipaa_mode: true

    # HIPAA requirements
    encryption_at_rest: true
    encryption_in_transit: true
    access_controls: true
    audit_trails: true

    # Additional security
    minimum_key_length: 256
    key_rotation_max_days: 30
    secure_deletion: true

Audit Reports

1. Generate Compliance Reports

# SOC 2 audit report
awsideman cache audit report \
  --format soc2 \
  --period "2024-01-01 to 2024-12-31" \
  --output soc2-audit-report-2024.pdf

# GDPR compliance report
awsideman cache audit report \
  --format gdpr \
  --include-data-flows \
  --include-consent-records \
  --output gdpr-compliance-report.pdf

2. Security Assessment Reports

# Comprehensive security assessment
awsideman cache security assess \
  --full-scan \
  --include-vulnerabilities \
  --output security-assessment-$(date +%Y%m%d).json

# Key management assessment
awsideman cache encryption assess \
  --check-key-strength \
  --check-rotation-compliance \
  --output key-management-assessment.json

Troubleshooting Security Issues

Common Security Issues

1. Encryption Key Problems

# Key not found
awsideman cache encryption key-status
awsideman cache encryption generate-key

# Key corruption
awsideman cache encryption test
awsideman cache encryption restore-key --input backup.enc

# Keyring unavailable
python -c "import keyring; print(keyring.get_keyring())"
awsideman cache encryption fallback-storage --enable

2. Permission Issues

# File permission problems
ls -la ~/.awsideman/cache/
chmod 700 ~/.awsideman/cache/
chmod 600 ~/.awsideman/cache/*

# DynamoDB permission problems
aws sts get-caller-identity
aws iam simulate-principal-policy --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) --action-names dynamodb:GetItem --resource-arns "arn:aws:dynamodb:us-east-1:123456789012:table/awsideman-cache"

3. Decryption Failures

# Test decryption
awsideman cache encryption test

# Check for corrupted data
awsideman cache verify --check-encryption

# Repair corrupted entries
awsideman cache repair --fix-encryption-errors

Security Incident Response

1. Suspected Key Compromise

# Immediate response
echo "SECURITY INCIDENT: Suspected key compromise at $(date)" >> /var/log/security-incidents.log

# Rotate keys immediately
awsideman cache encryption rotate --emergency

# Audit recent access
awsideman cache audit show --last 48h --detailed

# Clear all cache data
awsideman cache clear --force --security-incident

2. Unauthorized Access Detection

# Lock down cache access
awsideman cache security lockdown --temporary

# Investigate access patterns
awsideman cache audit analyze --detect-intrusion --last 7d

# Generate incident report
awsideman cache security incident-report \
  --incident-id "INC-$(date +%Y%m%d-%H%M%S)" \
  --output security-incident-report.json

3. Data Breach Response

# Immediate containment
awsideman cache security emergency-shutdown

# Assess scope of breach
awsideman cache audit analyze --assess-breach-scope

# Notify stakeholders
awsideman cache security notify-breach \
  --contacts security@company.com \
  --include-assessment

Security Hardening Checklist

Pre-Deployment Security Checklist

Ongoing Security Maintenance

Regular key rotation (quarterly)
Monthly backup verification
Weekly security log review
Quarterly security assessments
Annual disaster recovery testing
Continuous compliance monitoring
Regular security training for users
Keep security documentation updated

This security guide provides comprehensive coverage of all security aspects of awsideman's advanced cache features. Regular review and updates of security procedures are essential for maintaining a strong security posture.

Security: floccus-se/awsideman

Security

docs/SECURITY.md