This document is the security deliverable for the I-Terroni project. It follows the structure suggested in the lecture: a risk assessment (identification + analysis) followed by the concrete hardening steps that were applied to the system.

Mapped against the OWASP Top 10 (2021) categories the lecture references.

Following the Security Risk Management BoK levels referenced in the lecture:

• Likelihood: Rare / Unlikely / Possible / Likely / Certain
• Impact: Insignificant / Negligible / Marginal / Critical / Catastrophic

                       IMPACT →
                Insig. Negl. Marg. Crit.        Catastr.
LIKELIHOOD ↓
Certain                              R3 R6 R13   R5
Likely                               R8 R14
Possible                       R2    R4 R9 R16   R15
Unlikely                             R7           R1 R10 R11 R12
Rare

The top-right (Certain × Catastrophic / Critical) cluster is what we address first.

Two changes were made:

1. Vagrantfile provisioning now installs and configures ufw so the host firewall denies everything by default and only opens 22 (SSH), 80 (HTTP), 443 (HTTPS).
2. docker-compose.yml internal-only services (Prometheus, Grafana, Loki, node-exporter) now bind to 127.0.0.1:<port> instead of 0.0.0.0:<port>. The MiniTwit app port 8080 is also localhost-only because Nginx proxies into the swarm overlay network.

Why both. Docker rewrites iptables directly and bypasses ufw, so on its own, ufw allow 22/80/443 does not close the Grafana / Prometheus ports that -p opens. Binding to 127.0.0.1 ensures the kernel never accepts the connection from outside, which is the recommended mitigation when you don't want to disable iptables integration in /etc/docker/daemon.json. The two layers are intentional defense-in-depth ("never rely on a single security mechanism").

A new nginx service was added to docker-compose.yml and listens on 80 + 443 on the manager. It terminates TLS and proxies to the minitwit swarm service over the overlay network on port 5000.

The script issues a Let's Encrypt cert via certbot's standalone mode, drops the renewal hook into cron, and patches the Nginx config with the correct server_name. Renewal is automatic (90-day certs).

The previous Dockerfile-flagtool (Ubuntu base + gcc + libsqlite3 to build the legacy C admin tool) was hardened as part of this work, then removed entirely when the flag tool was rewritten as a Python script (flag_tool.py) that ships inside the main image. Removing it eliminated one base-image attack surface and one Docker Hub artifact (michaelfant/flagtoolimage).

A .dockerignore was also added to keep .env, .git/, the SQLite test DB, and the out/ folder out of every image, both for security and image size.

Image-vulnerability scanning is wired into CI (next section), so regressions are caught on every push.

includes two gates:

1. Semgrep (SAST) runs in the static-analysis job, before the test step. Uses the p/security-audit, p/owasp-top-ten, and p/python rule packs. Fails the job on findings of severity ≥ ERROR.
2. Trivy (image vulnerability scan) runs in a new security-scan job that depends on test and gates build-and-deploy. Scans the locally-built minitwitimage:ci for OS-package and Python-dependency CVEs. Fails on HIGH/CRITICAL severity.

Job ordering:

static-analysis (ruff, codespell, mypy, hadolint, shellcheck, semgrep)
      ↓
test (integration + API + UI/E2E with MySQL + Selenium)
      ↓
security-scan (trivy on the built image)
      ↓
build-and-deploy (push to Docker Hub + ssh deploy)

Result: a build with a security finding above the threshold cannot be pushed to Docker Hub or deployed

The existing code-quality.yml (SonarCloud + Codacy) is left untouched and continues to run in parallel.

• OWASP Top 10 (2021): https://owasp.org/Top10/
• Docker / UFW interaction: https://docs.docker.com/network/iptables/
• runc CVE-2024-21626 ("Leaky Vessels"): https://nvd.nist.gov/vuln/detail/CVE-2024-21626