Cybersecurity Best Practices 2025: Essential Guide for Developers and Businesses

// Example: AI-powered phishing detection
const detectPhishing = async (email) => {
  const indicators = {
    suspiciousLinks: checkURLReputation(email.links),
    senderAuthentication: verifySPF_DKIM_DMARC(email.sender),
    contentAnalysis: analyzeLanguagePatterns(email.content),
    behavioralAnalysis: checkSenderHistory(email.sender)
  };
  
  const riskScore = calculateRiskScore(indicators);
  return riskScore > 0.8 ? 'HIGH_RISK' : 'SAFE';
};

# Zero Trust Implementation Framework
Identity_Verification:
  - Multi-factor authentication (MFA)
  - Continuous authentication
  - Risk-based access controls
  - Just-in-time access

Device_Security:
  - Device compliance checking
  - Endpoint detection and response (EDR)
  - Device encryption
  - Mobile device management (MDM)

Network_Segmentation:
  - Micro-segmentation
  - Software-defined perimeters
  - Network access control (NAC)
  - Least privilege networking

Data_Protection:
  - Data classification
  - Encryption at rest and in transit
  - Data loss prevention (DLP)
  - Rights management

// Implementing TOTP-based MFA
const speakeasy = require('speakeasy');
const QRCode = require('qrcode');

class MFAService {
  static generateSecret(userEmail) {
    return speakeasy.generateSecret({
      name: userEmail,
      issuer: 'YourApp',
      length: 32
    });
  }
  
  static async generateQRCode(secret) {
    const otpauthUrl = speakeasy.otpauthURL({
      secret: secret.ascii,
      label: secret.name,
      issuer: secret.issuer
    });
    
    return await QRCode.toDataURL(otpauthUrl);
  }
  
  static verifyToken(secret, token) {
    return speakeasy.totp.verify({
      secret: secret,
      encoding: 'ascii',
      token: token,
      window: 2
    });
  }
}

// Usage example
const userSecret = MFAService.generateSecret('user@example.com');
const qrCode = await MFAService.generateQRCode(userSecret);
const isValid = MFAService.verifyToken(userSecret.ascii, '123456');

// Secure password hashing with bcrypt
const bcrypt = require('bcrypt');
const crypto = require('crypto');

class PasswordSecurity {
  static async hashPassword(password) {
    // Use salt rounds of 12 or higher for production
    const saltRounds = 12;
    return await bcrypt.hash(password, saltRounds);
  }
  
  static async verifyPassword(password, hash) {
    return await bcrypt.compare(password, hash);
  }
  
  static checkPasswordStrength(password) {
    const criteria = {
      length: password.length >= 12,
      uppercase: /[A-Z]/.test(password),
      lowercase: /[a-z]/.test(password),
      numbers: /\d/.test(password),
      symbols: /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password),
      noCommonPatterns: !this.hasCommonPatterns(password)
    };
    
    const score = Object.values(criteria).filter(Boolean).length;
    return {
      score,
      criteria,
      strength: this.getStrengthLevel(score)
    };
  }
  
  static hasCommonPatterns(password) {
    const commonPatterns = [
      /password/i, /123456/, /qwerty/i, /admin/i,
      /letmein/i, /welcome/i, /monkey/i
    ];
    return commonPatterns.some(pattern => pattern.test(password));
  }
  
  static getStrengthLevel(score) {
    if (score < 3) return 'WEAK';
    if (score < 5) return 'MEDIUM';
    return 'STRONG';
  }
}

// Input validation with Joi
const Joi = require('joi');
const validator = require('validator');

const userSchema = Joi.object({
  email: Joi.string().email().required(),
  password: Joi.string().min(12).pattern(
    /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]/
  ).required(),
  age: Joi.number().integer().min(13).max(120),
  username: Joi.string().alphanum().min(3).max(30).required()
});

// SQL injection prevention
const db = require('better-sqlite3')('database.db');

// ❌ Vulnerable to SQL injection
const getUserVulnerable = (userId) => {
  return db.prepare(`SELECT * FROM users WHERE id = ${userId}`).get();
};

// ✅ Safe with parameterized queries
const getUserSafe = (userId) => {
  const stmt = db.prepare('SELECT * FROM users WHERE id = ?');
  return stmt.get(userId);
};

// XSS prevention
const sanitizeHTML = require('sanitize-html');

const sanitizeUserInput = (input) => {
  return sanitizeHTML(input, {
    allowedTags: ['b', 'i', 'em', 'strong'],
    allowedAttributes: {},
    allowedSchemes: ['http', 'https', 'mailto']
  });
};

// JWT implementation with proper security
const jwt = require('jsonwebtoken');
const crypto = require('crypto');

class AuthService {
  constructor() {
    this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(64).toString('hex');
    this.refreshTokens = new Map(); // Use Redis in production
  }
  
  generateTokens(userId, permissions) {
    const payload = {
      userId,
      permissions,
      iat: Math.floor(Date.now() / 1000),
      iss: 'your-app'
    };
    
    const accessToken = jwt.sign(payload, this.jwtSecret, {
      expiresIn: '15m',
      algorithm: 'HS256'
    });
    
    const refreshToken = crypto.randomBytes(32).toString('hex');
    this.refreshTokens.set(refreshToken, { userId, expiresAt: Date.now() + 7 * 24 * 60 * 60 * 1000 });
    
    return { accessToken, refreshToken };
  }
  
  verifyAccessToken(token) {
    try {
      return jwt.verify(token, this.jwtSecret);
    } catch (error) {
      throw new Error('Invalid token');
    }
  }
  
  refreshAccessToken(refreshToken) {
    const tokenData = this.refreshTokens.get(refreshToken);
    if (!tokenData || tokenData.expiresAt < Date.now()) {
      throw new Error('Invalid refresh token');
    }
    
    // Generate new tokens
    const { userId } = tokenData;
    return this.generateTokens(userId, tokenData.permissions);
  }
}

// Role-based access control middleware
const rbac = (requiredPermissions) => {
  return (req, res, next) => {
    const { permissions } = req.user;
    
    const hasPermission = requiredPermissions.every(permission =>
      permissions.includes(permission)
    );
    
    if (!hasPermission) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    
    next();
  };
};

// Rate limiting and API security
const rateLimit = require('express-rate-limit');
const helmet = require('helmet');
const cors = require('cors');

// Rate limiting configuration
const createRateLimiter = (windowMs, max, message) => {
  return rateLimit({
    windowMs,
    max,
    message: { error: message },
    standardHeaders: true,
    legacyHeaders: false,
    handler: (req, res) => {
      res.status(429).json({
        error: message,
        retryAfter: Math.ceil(windowMs / 1000)
      });
    }
  });
};

// API security middleware
const apiSecurity = (app) => {
  // Security headers
  app.use(helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        styleSrc: ["'self'", "'unsafe-inline'"],
        scriptSrc: ["'self'"],
        imgSrc: ["'self'", "data:", "https:"],
      },
    },
    hsts: {
      maxAge: 31536000,
      includeSubDomains: true,
      preload: true
    }
  }));
  
  // CORS configuration
  app.use(cors({
    origin: process.env.ALLOWED_ORIGINS?.split(',') || 'http://localhost:3000',
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'DELETE'],
    allowedHeaders: ['Content-Type', 'Authorization']
  }));
  
  // Rate limiting
  app.use('/api/', createRateLimiter(15 * 60 * 1000, 100, 'Too many requests'));
  app.use('/api/auth/login', createRateLimiter(15 * 60 * 1000, 5, 'Too many login attempts'));
  
  // Request size limiting
  app.use(express.json({ limit: '10mb' }));
  app.use(express.urlencoded({ extended: true, limit: '10mb' }));
};

// Security testing with Jest
const request = require('supertest');
const app = require('../app');

describe('Security Tests', () => {
  test('should prevent SQL injection', async () => {
    const maliciousInput = "1'; DROP TABLE users; --";
    const response = await request(app)
      .get(`/api/users/${maliciousInput}`)
      .expect(400);
    
    expect(response.body.error).toContain('Invalid input');
  });
  
  test('should prevent XSS attacks', async () => {
    const maliciousScript = '<script>alert("XSS")</script>';
    const response = await request(app)
      .post('/api/comments')
      .send({ content: maliciousScript })
      .expect(400);
    
    expect(response.body.error).toContain('Invalid content');
  });
  
  test('should enforce rate limiting', async () => {
    const promises = Array(10).fill().map(() =>
      request(app).post('/api/auth/login').send({
        email: 'test@example.com',
        password: 'wrongpassword'
      })
    );
    
    const responses = await Promise.all(promises);
    const rateLimitedResponses = responses.filter(r => r.status === 429);
    expect(rateLimitedResponses.length).toBeGreaterThan(0);
  });
});

// Automated security scanning script
const { execSync } = require('child_process');

const runSecurityScan = () => {
  try {
    // Run npm audit
    console.log('Running npm audit...');
    execSync('npm audit --audit-level moderate', { stdio: 'inherit' });
    
    // Run Snyk scan (requires Snyk CLI)
    console.log('Running Snyk scan...');
    execSync('snyk test', { stdio: 'inherit' });
    
    // Run ESLint security rules
    console.log('Running ESLint security scan...');
    execSync('eslint . --ext .js,.ts --config .eslintrc.security.js', { stdio: 'inherit' });
    
  } catch (error) {
    console.error('Security scan failed:', error.message);
    process.exit(1);
  }
};

# UFW (Uncomplicated Firewall) setup for Ubuntu
# Enable UFW
sudo ufw enable

# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (change port if custom)
sudo ufw allow 22/tcp

# Allow HTTP and HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow specific application
sudo ufw allow from 192.168.1.0/24 to any port 3000

# Rate limiting for SSH
sudo ufw limit ssh

# Check status
sudo ufw status verbose

# Advanced iptables rules
# Block common attack patterns
sudo iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
sudo iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
sudo iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

# Rate limit SSH connections
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j REJECT

# Nginx SSL configuration
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;
    
    # SSL certificates
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    # SSL protocols and ciphers
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # SSL optimization
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;
    
    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;
    
    # Disable server tokens
    server_tokens off;
    
    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

# AWS CloudFormation template for secure infrastructure
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Secure web application infrastructure'

Resources:
  # VPC with private subnets
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      
  # Security Groups
  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for web servers
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
          
  DatabaseSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for database
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !Ref WebServerSecurityGroup
          
  # WAF for application protection
  WebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Scope: REGIONAL
      DefaultAction:
        Allow: {}
      Rules:
        - Name: AWSManagedRulesCommonRuleSet
          Priority: 1
          OverrideAction:
            None: {}
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: CommonRuleSetMetric

// Data encryption at rest and in transit
const crypto = require('crypto');
const fs = require('fs');

class EncryptionService {
  constructor() {
    this.algorithm = 'aes-256-gcm';
    this.keyLength = 32;
    this.ivLength = 16;
    this.tagLength = 16;
  }
  
  // Generate encryption key
  generateKey() {
    return crypto.randomBytes(this.keyLength);
  }
  
  // Encrypt data
  encrypt(data, key) {
    const iv = crypto.randomBytes(this.ivLength);
    const cipher = crypto.createCipher(this.algorithm, key, iv);
    
    let encrypted = cipher.update(data, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    
    const tag = cipher.getAuthTag();
    
    return {
      encrypted,
      iv: iv.toString('hex'),
      tag: tag.toString('hex')
    };
  }
  
  // Decrypt data
  decrypt(encryptedData, key) {
    const decipher = crypto.createDecipher(
      this.algorithm,
      key,
      Buffer.from(encryptedData.iv, 'hex')
    );
    
    decipher.setAuthTag(Buffer.from(encryptedData.tag, 'hex'));
    
    let decrypted = decipher.update(encryptedData.encrypted, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    
    return decrypted;
  }
  
  // File encryption
  encryptFile(filePath, key) {
    const data = fs.readFileSync(filePath, 'utf8');
    const encrypted = this.encrypt(data, key);
    
    fs.writeFileSync(filePath + '.enc', JSON.stringify(encrypted));
    fs.unlinkSync(filePath); // Remove original file
  }
  
  // Hash sensitive data
  hashData(data, salt = null) {
    if (!salt) {
      salt = crypto.randomBytes(16).toString('hex');
    }
    
    const hash = crypto.pbkdf2Sync(data, salt, 100000, 64, 'sha512');
    return {
      hash: hash.toString('hex'),
      salt
    };
  }
}

// Database field encryption
class SecureModel {
  static encryptedFields = ['ssn', 'creditCard', 'bankAccount'];
  
  static async create(data) {
    const encryptedData = { ...data };
    
    for (const field of this.encryptedFields) {
      if (encryptedData[field]) {
        encryptedData[field] = encryption.encrypt(
          encryptedData[field],
          process.env.DB_ENCRYPTION_KEY
        );
      }
    }
    
    return await db.collection('users').insertOne(encryptedData);
  }
  
  static async findDecrypted(query) {
    const result = await db.collection('users').findOne(query);
    
    if (result) {
      for (const field of this.encryptedFields) {
        if (result[field]) {
          result[field] = encryption.decrypt(
            result[field],
            process.env.DB_ENCRYPTION_KEY
          );
        }
      }
    }
    
    return result;
  }
}

// GDPR compliance utilities
class GDPRCompliance {
  static async handleDataRequest(userId, requestType) {
    switch (requestType) {
      case 'ACCESS':
        return await this.exportUserData(userId);
      case 'RECTIFICATION':
        return await this.updateUserData(userId);
      case 'ERASURE':
        return await this.deleteUserData(userId);
      case 'PORTABILITY':
        return await this.exportPortableData(userId);
      default:
        throw new Error('Invalid request type');
    }
  }
  
  static async exportUserData(userId) {
    const collections = ['users', 'orders', 'activities', 'preferences'];
    const userData = {};
    
    for (const collection of collections) {
      userData[collection] = await db.collection(collection)
        .find({ userId })
        .toArray();
    }
    
    // Log the export request
    await this.logDataRequest(userId, 'EXPORT', 'COMPLETED');
    
    return userData;
  }
  
  static async deleteUserData(userId) {
    const collections = ['users', 'orders', 'activities', 'preferences'];
    const results = {};
    
    // Anonymize instead of delete for compliance requirements
    for (const collection of collections) {
      if (collection === 'orders') {
        // Keep order data but anonymize
        results[collection] = await db.collection(collection)
          .updateMany(
            { userId },
            { 
              $set: { 
                userId: 'ANONYMIZED',
                personalData: 'REMOVED',
                updatedAt: new Date()
              }
            }
          );
      } else {
        results[collection] = await db.collection(collection)
          .deleteMany({ userId });
      }
    }
    
    await this.logDataRequest(userId, 'DELETE', 'COMPLETED');
    return results;
  }
  
  static async logDataRequest(userId, type, status) {
    await db.collection('gdpr_requests').insertOne({
      userId,
      type,
      status,
      timestamp: new Date(),
      ipAddress: this.getClientIP(),
      userAgent: this.getUserAgent()
    });
  }
  
  // Consent management
  static async recordConsent(userId, consentType, granted) {
    await db.collection('consents').insertOne({
      userId,
      consentType,
      granted,
      timestamp: new Date(),
      ipAddress: this.getClientIP(),
      version: process.env.PRIVACY_POLICY_VERSION
    });
  }
  
  static async checkConsent(userId, consentType) {
    const consent = await db.collection('consents')
      .findOne(
        { userId, consentType },
        { sort: { timestamp: -1 } }
      );
    
    return consent && consent.granted;
  }
}

// DLP implementation
class DataLossPrevention {
  static sensitivePatterns = {
    creditCard: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g,
    ssn: /\b\d{3}-\d{2}-\d{4}\b/g,
    email: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
    ipAddress: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
    phoneNumber: /\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g
  };
  
  static scanContent(content) {
    const findings = [];
    
    for (const [type, pattern] of Object.entries(this.sensitivePatterns)) {
      const matches = content.match(pattern);
      if (matches) {
        findings.push({
          type,
          count: matches.length,
          matches: matches.slice(0, 5) // Limit for logging
        });
      }
    }
    
    return findings;
  }
  
  static redactContent(content) {
    let redacted = content;
    
    for (const [type, pattern] of Object.entries(this.sensitivePatterns)) {
      redacted = redacted.replace(pattern, `[REDACTED_${type.toUpperCase()}]`);
    }
    
    return redacted;
  }
  
  static async monitorFileUpload(file) {
    const content = file.buffer.toString();
    const findings = this.scanContent(content);
    
    if (findings.length > 0) {
      await this.logSecurityEvent({
        type: 'SENSITIVE_DATA_DETECTED',
        findings,
        fileName: file.originalname,
        timestamp: new Date()
      });
      
      throw new Error('Sensitive data detected in file upload');
    }
    
    return true;
  }
  
  static async logSecurityEvent(event) {
    await db.collection('security_events').insertOne(event);
    
    // Alert security team for critical events
    if (event.findings.length > 10) {
      await this.sendSecurityAlert(event);
    }
  }
}

// Automated incident response system
class IncidentResponse {
  static severity = {
    LOW: 1,
    MEDIUM: 2,
    HIGH: 3,
    CRITICAL: 4
  };
  
  static async handleIncident(incident) {
    const response = {
      id: this.generateIncidentId(),
      timestamp: new Date(),
      severity: this.assessSeverity(incident),
      status: 'DETECTED',
      incident
    };
    
    await this.logIncident(response);
    await this.notifyTeam(response);
    
    // Automated response based on severity
    switch (response.severity) {
      case this.severity.CRITICAL:
        await this.criticalResponse(response);
        break;
      case this.severity.HIGH:
        await this.highSeverityResponse(response);
        break;
      default:
        await this.standardResponse(response);
    }
    
    return response;
  }
  
  static async criticalResponse(incident) {
    // Immediate actions for critical incidents
    await this.isolateAffectedSystems(incident);
    await this.notifyManagement(incident);
    await this.activateBackupSystems(incident);
    await this.preserveEvidence(incident);
  }
  
  static async isolateAffectedSystems(incident) {
    // Automatically block suspicious IPs
    if (incident.incident.type === 'BRUTE_FORCE_ATTACK') {
      const suspiciousIPs = incident.incident.data.sourceIPs;
      for (const ip of suspiciousIPs) {
        await this.blockIP(ip);
      }
    }
    
    // Disable compromised accounts
    if (incident.incident.type === 'ACCOUNT_COMPROMISE') {
      const affectedUsers = incident.incident.data.userIds;
      for (const userId of affectedUsers) {
        await this.disableAccount(userId);
      }
    }
  }
  
  static async blockIP(ipAddress) {
    // Add to firewall block list
    await db.collection('blocked_ips').insertOne({
      ip: ipAddress,
      reason: 'Automated incident response',
      timestamp: new Date(),
      expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000) // 24 hours
    });
    
    // Update firewall rules
    await this.updateFirewallRules();
  }
  
  static async generateIncidentReport(incidentId) {
    const incident = await db.collection('incidents').findOne({ id: incidentId });
    const timeline = await this.getIncidentTimeline(incidentId);
    const impact = await this.assessImpact(incident);
    
    return {
      summary: this.generateSummary(incident),
      timeline,
      impact,
      rootCause: await this.analyzeRootCause(incident),
      remediation: await this.getRemediationSteps(incident),
      lessonsLearned: await this.extractLessonsLearned(incident)
    };
  }
}

// Security monitoring and alerting
class SecurityMonitoring {
  static async setupRealTimeMonitoring() {
    // Monitor failed login attempts
    setInterval(async () => {
      const failedLogins = await this.getFailedLogins(5); // Last 5 minutes
      if (failedLogins.length > 10) {
        await IncidentResponse.handleIncident({
          type: 'BRUTE_FORCE_ATTACK',
          data: { attempts: failedLogins.length, sourceIPs: this.extractIPs(failedLogins) }
        });
      }
    }, 5 * 60 * 1000);
    
    // Monitor unusual data access patterns
    setInterval(async () => {
      const unusualAccess = await this.detectUnusualDataAccess();
      if (unusualAccess.length > 0) {
        await IncidentResponse.handleIncident({
          type: 'UNUSUAL_DATA_ACCESS',
          data: unusualAccess
        });
      }
    }, 10 * 60 * 1000);
  }
  
  static async detectUnusualDataAccess() {
    const recentAccess = await db.collection('access_logs')
      .find({
        timestamp: { $gte: new Date(Date.now() - 60 * 60 * 1000) } // Last hour
      })
      .toArray();
    
    // Detect unusual patterns
    const patterns = this.analyzeAccessPatterns(recentAccess);
    return patterns.filter(p => p.risk > 0.8);
  }
}

#!/bin/bash
# Automated backup script with encryption

BACKUP_DIR="/var/backups/application"
DB_NAME="myapp_production"
ENCRYPTION_KEY="/etc/backup/encryption.key"
RETENTION_DAYS=30

# Create backup directory
mkdir -p $BACKUP_DIR

# Database backup
echo "Starting database backup..."
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
BACKUP_FILE="$BACKUP_DIR/db_backup_$TIMESTAMP.sql"

# MongoDB backup
mongodump --db $DB_NAME --out $BACKUP_DIR/mongo_$TIMESTAMP

# MySQL backup
mysqldump --single-transaction --routines --triggers $DB_NAME > $BACKUP_FILE

# Encrypt backup
echo "Encrypting backup..."
gpg --cipher-algo AES256 --compress-algo 1 --s2k-mode 3 \
    --s2k-digest-algo SHA512 --s2k-count 65536 \
    --symmetric --output $BACKUP_FILE.gpg $BACKUP_FILE

# Remove unencrypted backup
rm $BACKUP_FILE

# Application files backup
echo "Backing up application files..."
tar -czf $BACKUP_DIR/app_backup_$TIMESTAMP.tar.gz /var/www/myapp \
    --exclude=/var/www/myapp/node_modules \
    --exclude=/var/www/myapp/logs

# Encrypt application backup
gpg --cipher-algo AES256 --symmetric \
    --output $BACKUP_DIR/app_backup_$TIMESTAMP.tar.gz.gpg \
    $BACKUP_DIR/app_backup_$TIMESTAMP.tar.gz

rm $BACKUP_DIR/app_backup_$TIMESTAMP.tar.gz

# Upload to cloud storage
echo "Uploading to cloud storage..."
aws s3 cp $BACKUP_DIR/ s3://my-secure-backups/$(date +%Y/%m/%d)/ --recursive

# Clean old backups
find $BACKUP_DIR -name "*.gpg" -mtime +$RETENTION_DAYS -delete

echo "Backup completed successfully"

# Disaster recovery script
#!/bin/bash
# Disaster recovery restoration

restore_from_backup() {
    local backup_date=$1
    local backup_type=$2
    
    echo "Starting restoration from $backup_date..."
    
    # Download from cloud storage
    aws s3 cp s3://my-secure-backups/$backup_date/ /tmp/restore/ --recursive
    
    case $backup_type in
        "database")
            restore_database /tmp/restore/
            ;;
        "application")
            restore_application /tmp/restore/
            ;;
        "full")
            restore_database /tmp/restore/
            restore_application /tmp/restore/
            ;;
    esac
    
    echo "Restoration completed"
}

restore_database() {
    local restore_dir=$1
    
    # Decrypt database backup
    gpg --decrypt $restore_dir/db_backup_*.sql.gpg > /tmp/restored_db.sql
    
    # Restore database
    mysql $DB_NAME < /tmp/restored_db.sql
    
    # Clean up
    rm /tmp/restored_db.sql
}

# NIST Cybersecurity Framework implementation checklist
NIST_Framework:
  Identify:
    - Asset inventory management
    - Risk assessment procedures
    - Governance policies
    - Business environment understanding
    
  Protect:
    - Access controls implementation
    - Data security measures
    - Information protection processes
    - Maintenance procedures
    - Protective technology deployment
    
  Detect:
    - Anomaly detection systems
    - Security monitoring
    - Detection processes
    
  Respond:
    - Response planning
    - Communications procedures
    - Analysis protocols
    - Mitigation strategies
    - Improvements tracking
    
  Recover:
    - Recovery planning
    - Improvements implementation
    - Communications management

// Automated compliance checking
class ComplianceMonitor {
  static async checkSOC2Compliance() {
    const checks = {
      accessControls: await this.verifyAccessControls(),
      dataEncryption: await this.verifyEncryption(),
      logging: await this.verifyLogging(),
      backups: await this.verifyBackups(),
      incidentResponse: await this.verifyIncidentResponse()
    };
    
    const score = this.calculateComplianceScore(checks);
    await this.generateComplianceReport(checks, score);
    
    return { score, checks };
  }
  
  static async verifyAccessControls() {
    const checks = {
      mfaEnabled: await this.checkMFAEnforcement(),
      passwordPolicy: await this.checkPasswordPolicy(),
      roleBasedAccess: await this.checkRBAC(),
      sessionManagement: await this.checkSessionSecurity()
    };
    
    return {
      passed: Object.values(checks).every(Boolean),
      details: checks
    };
  }
  
  static async generateComplianceReport(checks, score) {
    const report = {
      timestamp: new Date(),
      framework: 'SOC2',
      score,
      checks,
      recommendations: this.generateRecommendations(checks),
      nextReview: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000) // 90 days
    };
    
    await db.collection('compliance_reports').insertOne(report);
    
    if (score < 80) {
      await this.alertComplianceTeam(report);
    }
    
    return report;
  }
}

## Daily Security Tasks
- [ ] Review security alerts and logs
- [ ] Check for system updates
- [ ] Monitor backup status
- [ ] Verify access controls

## Weekly Security Tasks
- [ ] Security patch management
- [ ] Access review and cleanup
- [ ] Backup testing
- [ ] Security metrics review

## Monthly Security Tasks
- [ ] Vulnerability scanning
- [ ] Penetration testing
- [ ] Security training updates
- [ ] Compliance reporting

## Quarterly Security Tasks
- [ ] Complete security audit
- [ ] Update incident response plan
- [ ] Review and update policies
- [ ] Disaster recovery testing

// Essential security tools configuration
const securityTools = {
  // Vulnerability scanning
  nmap: {
    command: 'nmap -sV -sC target-ip',
    purpose: 'Network discovery and security auditing'
  },
  
  // SSL testing
  ssllabs: {
    url: 'https://www.ssllabs.com/ssltest/',
    purpose: 'SSL/TLS configuration testing'
  },
  
  // Web application security
  owasp_zap: {
    command: 'zap-cli quick-scan http://target-url',
    purpose: 'Web application vulnerability scanning'
  },
  
  // Code security
  snyk: {
    command: 'snyk test',
    purpose: 'Dependency vulnerability scanning'
  },
  
  // Container security
  clair: {
    purpose: 'Container vulnerability scanning'
  }
};

// Security monitoring dashboard
const createSecurityDashboard = () => {
  return {
    metrics: [
      'failed_login_attempts',
      'suspicious_ip_addresses',
      'malware_detections',
      'data_exfiltration_alerts',
      'system_vulnerabilities'
    ],
    alerts: [
      'critical_vulnerabilities',
      'unauthorized_access_attempts',
      'data_breach_indicators',
      'compliance_violations'
    ],
    reports: [
      'daily_security_summary',
      'weekly_vulnerability_report',
      'monthly_compliance_status',
      'quarterly_risk_assessment'
    ]
  };
};

// AI-powered threat detection
class AISecurityAnalyzer {
  static async analyzeBehavioralPatterns(userActivity) {
    // Use machine learning to detect anomalies
    const features = this.extractFeatures(userActivity);
    const anomalyScore = await this.runAnomalyDetection(features);
    
    if (anomalyScore > 0.8) {
      return {
        risk: 'HIGH',
        reasons: this.explainAnomaly(features, anomalyScore),
        recommendations: this.getSecurityRecommendations(anomalyScore)
      };
    }
    
    return { risk: 'LOW' };
  }
  
  static async detectAdvancedThreats(networkTraffic) {
    // AI-powered network traffic analysis
    const patterns = await this.analyzeTrafficPatterns(networkTraffic);
    const threats = await this.identifyThreats(patterns);
    
    return threats.filter(threat => threat.confidence > 0.9);
  }
}