COMPLIANCE FEATURES ARE IN ALPHA/EXPERIMENTAL STATUS

This documentation contains examples and configuration options for GDPR, HIPAA, and PCI-DSS compliance features. These features are currently in Alpha/Experimental status and should be used with caution in production environments.

• Compliance frameworks are implemented but require extensive testing
• Core functionality works but may need refinement for specific use cases
• Audit logging is partially implemented and being enhanced
• Policy conditions are functional but may need customization
• Using this system for compliance-critical workloads requires THOROUGH TESTING AND VALIDATION

Do not deploy Fortress in production environments requiring regulatory compliance without conducting comprehensive testing and validation of the compliance features for your specific requirements.

See the Production Readiness Matrix for current implementation status.

Fortress is designed with security as the primary concern. This guide covers the security model, features, and best practices for deploying and maintaining a secure Fortress deployment.

Fortress implements multiple layers of security controls:

1. Authentication: Verify user/service identity
2. Authorization: Enforce access controls
3. Encryption: Protect data at rest and in transit
4. Audit: Monitor and log all security events
5. Network Security: Secure network communications
6. Infrastructure Security: Secure underlying infrastructure

Fortress follows zero trust principles:

• Never trust, always verify
• Least privilege access
• Micro-segmentation
• Continuous monitoring
• Assume breach mentality

# Generate JWT token
curl -X POST http://localhost:8080/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin",
    "password": "secure-password"
  }'

# Use JWT token
curl -X GET http://localhost:8080/api/v1/databases \
  -H "Authorization: Bearer <jwt-token>"

# Create API key
curl -X POST http://localhost:8080/api/v1/auth/api-keys \
  -H "Authorization: Bearer <jwt-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "production-api-key",
    "permissions": ["read", "write"],
    "expires_at": "2024-12-31T23:59:59Z"
  }'

# Use API key
curl -X GET http://localhost:8080/api/v1/databases \
  -H "X-API-Key: <api-key>"

# Configure OAuth provider
fortress config set auth.oauth.provider google
fortress config set auth.oauth.client_id <client-id>
fortress config set auth.oauth.client_secret <client-secret>

# Configure SAML provider
fortress config set auth.saml.idp_url <idp-url>
fortress config set auth.saml.entity_id <entity-id>
fortress config set auth.saml.certificate_path <cert-path>

1. Use Strong Authentication Methods

   • Prefer JWT or OAuth 2.0 over basic auth
   • Implement multi-factor authentication (MFA)
   • Use short-lived tokens

2. Secure Token Management

   • Store tokens securely (environment variables, secret managers)
   • Rotate tokens regularly
   • Revoke compromised tokens immediately

3. Authentication Configuration

   [auth]
   jwt_secret = "your-very-secure-jwt-secret"
   token_expiry = "1h"
   refresh_token_expiry = "7d"
   
   [auth.oauth]
   enabled = true
   provider = "google"
   client_id = "your-client-id"
   client_secret = "your-client-secret"

• admin: Full system access
• user: Read/write access to assigned resources
• readonly: Read-only access to assigned resources
• auditor: Read-only access to audit logs

# Create custom role
curl -X POST http://localhost:8080/api/v1/auth/roles \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "database-admin",
    "permissions": [
      "database:create",
      "database:read",
      "database:write",
      "database:delete",
      "key:rotate"
    ],
    "resource_constraints": {
      "databases": ["production-*"],
      "tenants": ["company-a"]
    }
  }'

{
  "permissions": {
    "database": ["create", "read", "write", "delete"],
    "table": ["create", "read", "write", "delete"],
    "key": ["read", "rotate", "delete"],
    "audit": ["read", "export"],
    "admin": ["users", "roles", "config"]
  }
}

{
  "policy": {
    "name": "data-access-policy",
    "rules": [
      {
        "effect": "allow",
        "actions": ["read", "write"],
        "resources": ["database:production-*"],
        "conditions": {
          "user.department": "engineering",
          "data.sensitivity": ["low", "medium"],
          "time.range": ["09:00-17:00"]
        }
      }
    ]
  }
}

• Security Level: Very High (Post-quantum resistant)
• Performance: 1500+ MB/s (fastest)
• Use Cases: General purpose, high-performance applications
• Configuration:

  fortress config set encryption.default_algorithm aegis256

• Security Level: High
• Performance: 1200+ MB/s
• Use Cases: Mobile apps, battery-powered devices
• Configuration:

  fortress config set encryption.default_algorithm chacha20poly1305

• Security Level: High
• Performance: 1000+ MB/s (with hardware acceleration)
• Use Cases: Enterprise, compliance-driven applications
• Configuration:

  fortress config set encryption.default_algorithm aes256gcm

• Security Level: Very High
• Performance: 1100+ MB/s
• Use Cases: Maximum security requirements, long-term data storage
• Configuration:

  fortress config set encryption.default_algorithm xchacha20poly1305

{
  "table": "users",
  "columns": [
    {"name": "id", "type": "uuid", "primary_key": true},
    {"name": "name", "type": "text"},
    {"name": "email", "type": "text", "unique": true},
    {
      "name": "ssn",
      "type": "encrypted",
      "algorithm": "aes256gcm",
      "sensitivity": "high",
      "searchable": false
    },
    {
      "name": "credit_card",
      "type": "encrypted",
      "algorithm": "chacha20poly1305",
      "sensitivity": "high",
      "searchable": false,
      "tokenization": true
    }
  ]
}

from fortress_db import FortressClient

client = FortressClient('http://localhost:8080')

# Create table with encrypted fields
table = client.create_table('myapp_db', 'users', [
    {'name': 'id', 'type': 'uuid', 'primary_key': True},
    {'name': 'name', 'type': 'text'},
    {'name': 'email', 'type': 'text', 'unique': True},
    {'name': 'ssn', 'type': 'encrypted', 'sensitivity': 'high'},
    {'name': 'credit_card', 'type': 'encrypted', 'sensitivity': 'high', 'tokenization': True}
])

# Insert data (automatically encrypted)
user = client.insert_data('myapp_db', 'users', {
    'id': '550e8400-e29b-41d4-a716-446655440000',
    'name': 'Alice Johnson',
    'email': 'alice@example.com',
    'ssn': '123-45-6789',
    'credit_card': '4111-1111-1111-1111'
})

# Data is automatically decrypted when retrieved
retrieved_user = client.get_data('myapp_db', 'users', user['id'])
print(retrieved_user['name'])  # Alice Johnson
print(retrieved_user['ssn'])   # 123-45-6789 (decrypted)

# Generate new key
fortress key generate --algorithm aegis256 --database myapp_db

# Generate key with custom parameters
fortress key generate \
  --algorithm aes256gcm \
  --database myapp_db \
  --key-size 256 \
  --derivation pbkdf2 \
  --iterations 100000

# Rotate keys for database
fortress key rotate --database myapp_db

# Rotate specific key
fortress key rotate --key-id key_123456

# Schedule automatic rotation
fortress key rotate --database myapp_db --schedule "0 2 * * 0"

[key_management]
storage_backend = "hsm"
hsm_provider = "aws_cloudhsm"
hsm_region = "us-west-2"
hsm_cluster_id = "cluster-12345"

[key_rotation]
auto_rotate = true
rotation_interval = "90d"
grace_period = "7d"

# Configure CloudHSM
fortress config set key_management.hsm.provider aws_cloudhsm
fortress config set key_management.hsm.cluster_id cluster-12345
fortress config set key_management.hsm.region us-west-2
fortress config set key_management.hsm.user_name fortress-user
fortress config set key_management.hsm.password secure-password

# Configure Azure Key Vault
fortress config set key_management.hsm.provider azure_keyvault
fortress config set key_management.hsm.vault_url https://fortress-kv.vault.azure.net/
fortress config set key_management.hsm.tenant_id tenant-12345
fortress config set key_management.hsm.client_id client-67890
fortress config set key_management.hsm.client_secret client-secret

1. Use Hardware Security Modules (HSM)

   • Protect master keys in HSM
   • Use FIPS 140-2 Level 3+ certified HSMs
   • Implement multi-person authorization for key operations

2. Implement Key Separation

   • Use different keys for different data types
   • Separate encryption and signing keys
   • Implement key hierarchy (master keys, data keys)

3. Regular Key Rotation

   • Rotate keys at least every 90 days
   • Use automatic key rotation
   • Maintain key history for data decryption

[network]
tls_enabled = true
tls_version = "1.3"
tls_cert_file = "/path/to/cert.pem"
tls_key_file = "/path/to/key.pem"
tls_ca_file = "/path/to/ca.pem"
tls_min_version = "1.3"
tls_cipher_suites = [
  "TLS_AES_256_GCM_SHA384",
  "TLS_CHACHA20_POLY1305_SHA256",
  "TLS_AES_128_GCM_SHA256"
]

# Generate self-signed certificate (development)
fortress cert generate --self-signed --localhost

# Request certificate from Let's Encrypt
fortress cert request --domains fortress.example.com --email admin@example.com

# Install certificate
fortress cert install --cert-file cert.pem --key-file key.pem

# Allow only necessary ports
ufw allow 22/tcp    # SSH
ufw allow 8080/tcp  # Fortress API
ufw allow 8443/tcp  # Fortress HTTPS
ufw enable

# Configure VPN access
fortress config set network.vpn.enabled true
fortress config set network.vpn.provider wireguard
fortress config set network.vpn.port 51820

{
  "event_type": "data_access",
  "timestamp": "2024-01-15T10:30:00Z",
  "user_id": "user_12345",
  "action": "read",
  "resource": "database:production.users",
  "ip_address": "192.168.1.100",
  "user_agent": "FortressClient/1.0.0",
  "outcome": "success",
  "details": {
    "record_count": 1,
    "fields_accessed": ["name", "email"],
    "encryption_algorithm": "aegis256"
  }
}

[audit]
enabled = true
log_level = "info"
storage_backend = "file"
log_file = "/var/log/fortress/audit.log"
rotation_interval = "1d"
retention_days = 365

[audit.events]
data_access = true
authentication = true
authorization = true
key_operations = true
config_changes = true
system_events = true

⚠️ ALPHA/EXPERIMENTAL - USE WITH TESTING AND VALIDATION

The following sections describe compliance features that are implemented but in Alpha/Experimental status. These features are functional and require comprehensive testing and validation before production use.

# Enable GDPR features (ALPHA/EXPERIMENTAL - requires testing)
fortress config set compliance.gdpr.enabled true

# Configure data retention (FUNCTIONAL - validate for your use case)
fortress config set compliance.gdpr.data_retention_days 2555

# Enable consent management (IMPLEMENTED - test thoroughly)
fortress config set compliance.gdpr.consent_management true

# Enable HIPAA features (ALPHA/EXPERIMENTAL - requires testing)
fortress config set compliance.hipaa.enabled true

# Configure audit requirements (FUNCTIONAL - validate for your use case)
fortress config set compliance.hipaa.audit_retention_years 6

# Enable access controls (IMPLEMENTED - test thoroughly)
fortress config set compliance.hipaa.strict_access_controls true

# Enable PCI-DSS features (ALPHA/EXPERIMENTAL - requires testing)
fortress config set compliance.pci_dss.enabled true

# Configure encryption requirements (FUNCTIONAL - validate for your use case)
fortress config set compliance.pci_dss.encryption_algorithm aes256gcm
fortress config set compliance.pci_dss.key_rotation_days 90

# Enable tokenization (IMPLEMENTED - test thoroughly)
fortress config set compliance.pci_dss.tokenization_enabled true

Current Status: All compliance frameworks are in Alpha/Experimental phase with core functionality implemented. Features include data protection, audit trails, consent management, and reporting capabilities. Requires comprehensive testing and validation for production compliance requirements. See Production Readiness Matrix for detailed implementation status.

1. Infrastructure Security

   • Use dedicated servers or containers
   • Implement network segmentation
   • Regular security updates and patches
   • Monitor for security vulnerabilities

2. Configuration Security

   • Use strong, unique passwords
   • Secure configuration file permissions
   • Enable all security features
   • Regular security audits

3. Operational Security

   • Implement least privilege access
   • Regular security training
   • Incident response procedures
   • Backup and disaster recovery

1. Secure Coding Practices

   • Input validation and sanitization
   • Secure error handling
   • Proper memory management
   • Security testing

2. API Security

   • Rate limiting
   • Input validation
   • Secure headers
   • API versioning

1. Security Monitoring

   • Failed authentication attempts
   • Unusual access patterns
   • Privilege escalation attempts
   • Data access anomalies

2. Alert Configuration

   [alerts]
   enabled = true
   webhook_url = "https://hooks.slack.com/services/..."
   email_recipients = ["security@example.com"]
   
   [alerts.rules]
   failed_auth_threshold = 10
   unusual_access_threshold = 5
   key_rotation_reminder = "7d"

1. Authentication Threats

   • Brute force attacks
   • Credential stuffing
   • Token abuse
   • Session hijacking

2. Authorization Threats

   • Privilege escalation
   • Access control bypass
   • Role abuse
   • Policy violations

3. Data Threats

   • Data exfiltration
   • Unauthorized access
   • Data tampering
   • Sensitive data exposure

{
  "rules": [
    {
      "name": "brute_force_detection",
      "condition": "failed_auth_count > 10 in 5m",
      "action": "block_ip",
      "severity": "high"
    },
    {
      "name": "unusual_access_pattern",
      "condition": "data_access_volume > 1000% baseline",
      "action": "alert_admin",
      "severity": "medium"
    },
    {
      "name": "privilege_escalation",
      "condition": "role_change AND new_role_higher_privilege",
      "action": "require_approval",
      "severity": "high"
    }
  ]
}

1. Detection

   • Automated monitoring alerts
   • Manual security reviews
   • Third-party security scans
   • User reports

2. Analysis

   • Incident classification
   • Impact assessment
   • Root cause analysis
   • Evidence collection

3. Containment

   • Isolate affected systems
   • Block malicious actors
   • Preserve evidence
   • Prevent further damage

4. Recovery

   • Restore from backups
   • Patch vulnerabilities
   • Update security controls
   • Monitor for recurrence

# Create incident response plan
fortress security incident-response create \
  --name "data_breach_response" \
  --severity "critical" \
  --actions [
    "isolate_system",
    "preserve_evidence", 
    "notify_stakeholders",
    "restore_from_backup"
  ]

# Test incident response
fortress security incident-response test --name "data_breach_response"

This security guide provides comprehensive coverage of Fortress's security features and best practices for maintaining a secure deployment.