Skip to main content

Security Services

Business Value: CCP includes a comprehensive security services catalogue that extends platform-level security (mTLS, IAM, RBAC) to active threat detection, workload protection, perimeter defence, and compliance monitoring. Security is available as self-service from the catalogue — not a separate procurement process.

Security Services Portfolio​

ServicePhaseDescription
SIEMSecurity Incident and Event Management — centralized threat detection and response
Log MonitoringContinuous security log analysis and anomaly detection
CSPMCloud Security Posture Management / Cloud Workload Protection
WAFWeb Application Firewall — Layer 7 protection for HTTP/HTTPS workloads
Cloud HSMCloud-based Hardware Security Module for key management and cryptographic operations
DDoS ProtectionVolumetric and application-layer DDoS mitigation
TLS/SSL Certificate ManagementAutomated certificate lifecycle management — issuance, renewal, revocation
Encryption as a ServiceManaged encryption for tenant workloads and data
Digital ForensicsForensic analysis capabilities for incident investigation and legal discovery
NAT GatewayManaged outbound-only internet access for private subnet resources
KMSKey Management Service — centralized creation, rotation, and storage of cryptographic keys and secrets

Platform Security Foundation​

Before the security services catalogue, the CCP platform itself provides a robust security baseline that applies to every tenant and resource automatically:

  • Authentication: Keycloak v24.0.5 with OAuth2/OIDC, MFA (TOTP, SMS, email, hardware keys)
  • Authorization: OpenFGA with 18 pre-defined RBAC roles; fine-grained permission enforcement on every operation
  • Transport Security: mTLS between all CCP microservices and APIs — no plaintext internal channels
  • Storage Security: AES-256 encryption at rest for all platform data — PostgreSQL, MongoDB, Redis, and backups
  • Network Security: VPC isolation with VXLAN/EVPN overlay; per-tenant routing; CheckPoint / Palo Alto firewall integration
  • Identity Isolation: Dedicated Keycloak realm per tenant — complete identity domain isolation
  • Audit Logging: All API gateway actions logged with authenticated identity, timestamp, and request details

The security services catalogue extends this baseline with active threat detection, workload scanning, and advanced cryptographic services.

SIEM — Security Incident and Event Management​

SIEM provides centralized collection, correlation, analysis, and response for security events across the platform and tenant workloads.

SIEM Capabilities​

  • Log Collection: Collects security events from all sources — authentication logs (Keycloak), API gateway audit logs, firewall logs (CheckPoint/Palo Alto), VPN access logs (Zscaler), and workload logs
  • Event Correlation: Cross-source event correlation to identify attack patterns, lateral movement, and anomalous behavior that single-source analysis would miss
  • Real-Time Alerting: Configurable alert rules trigger notifications for defined security events — failed authentication thresholds, privilege escalation attempts, unusual access patterns
  • Threat Intelligence: Integration with threat intelligence feeds to identify known-malicious IPs, domains, and file hashes in security events
  • Dashboards: Pre-built security dashboards for authentication events, access anomalies, network traffic patterns, and compliance reporting
  • Incident Response: SIEM cases track security incidents from detection through investigation and resolution; full event timeline reconstruction
  • Long-Term Retention: Security events retained for compliance requirements — configurable retention periods per regulation

SIEM Use Cases​

  • Detecting brute-force authentication attacks against the platform
  • Identifying compromised credentials via impossible travel or anomalous login patterns
  • Correlating firewall blocks with authentication failures to identify attack campaigns
  • Generating compliance audit reports showing access patterns and security posture

Log Monitoring​

Log Monitoring (via APM/NPM/IPM integration) provides continuous security-focused analysis of log streams across platform and workload components:

  • Real-Time Analysis: Log events analyzed in real time as they arrive; no lag in detection
  • Anomaly Detection: Machine learning models identify unusual patterns in access and activity logs
  • Compliance Reporting: Structured log reports for regulatory compliance — who accessed what, when, from where
  • Alerting: Trigger alarms on specific log patterns: error spikes, access to sensitive resources, configuration changes
  • Integration with SIEM: Log Monitoring forwards security-relevant events to SIEM for correlation and case management

CSPM — Cloud Security Posture Management​

CSPM (Cloud Workload Protection) continuously assesses the security configuration of cloud resources against best-practice security benchmarks:

CSPM Capabilities​

  • Continuous Assessment: Continuously scans VM configurations, network security group rules, storage access policies, and IAM configurations
  • Compliance Benchmarks: Assessment against CIS Benchmarks, NIST 800-53, and custom organizational security policies
  • Misconfiguration Detection: Identifies common misconfigurations — overly permissive security groups, public storage buckets, missing encryption, excessive IAM permissions
  • Remediation Guidance: For each finding, CSPM provides specific remediation steps and links to the affected resource in the portal
  • Risk Scoring: Resources assigned risk scores based on severity and exploitability of findings; highest-risk issues surfaced first
  • Drift Detection: Alerts when resource configurations change from a known-good baseline
  • Automated Remediation: Optional policy enforcement mode automatically corrects specific classes of misconfiguration

WAF — Web Application Firewall​

The Web Application Firewall provides Layer 7 protection for HTTP/HTTPS applications deployed in the platform:

WAF Capabilities​

  • OWASP Top 10 Protection: Pre-built rule sets protect against SQL injection, XSS, CSRF, path traversal, and other common web vulnerabilities
  • Bot Management: Detect and block malicious bot traffic (scrapers, credential stuffers, vulnerability scanners)
  • Rate Limiting: Per-IP and per-session rate limiting to prevent API abuse and brute-force attacks
  • Custom Rules: Tenant-defined WAF rules for application-specific protection requirements
  • SSL Termination: WAF terminates SSL/TLS, inspects decrypted traffic, then re-encrypts to backends
  • False Positive Management: Tunable rule sensitivity; fine-grained whitelisting to eliminate false positives without reducing protection
  • Attack Logging: All blocked requests logged with rule name, source IP, and payload; SIEM integration for correlation
  • DDoS Layer 7: WAF includes Layer 7 DDoS protection (slow POST, HTTP flood) complementing the Layer 3/4 DDoS service

Cloud HSM (MVP2)​

Cloud HSM provides a FIPS 140-2 compliant hardware root of trust for cryptographic key management:

Cloud HSM Capabilities​

  • Key Generation: Cryptographic key generation within the HSM hardware — keys never exist in software
  • Key Storage: Encrypted key material stored in HSM; keys protected by hardware root of trust
  • Encryption Operations: Symmetric encryption (AES), asymmetric encryption (RSA, EC), digital signing
  • Key Lifecycle Management: Creation, rotation, suspension, and destruction with full audit trail
  • Integration APIs: Standard PKCS#11, JCE, and REST APIs for application integration
  • Tenant Isolation: Dedicated key partitions per tenant; administrators of one partition cannot access another's keys
  • FIPS 140-2 Level 3: Tamper-evident hardware that meets FIPS 140-2 Level 3 requirements for regulated workloads requiring hardware-backed key security

Cloud HSM Use Cases​

  • Encryption key management for regulated data workloads (PCI DSS, HIPAA, government)
  • Code signing keys for software integrity verification
  • PKI root CA operations requiring hardware protection
  • TLS private key protection for high-value certificates

DDoS Protection (MVP2)​

DDoS Protection defends platform-facing resources against volumetric and application-layer distributed denial-of-service attacks:

  • Layer 3/4 Mitigation: Absorbs volumetric UDP flood, SYN flood, and reflection attacks before traffic reaches the platform
  • Layer 7 Mitigation: HTTP flood, slow attack, and application-layer DDoS protection (complements WAF)
  • Traffic Scrubbing: Malicious traffic scrubbed at network edge; clean traffic forwarded to the application
  • Always-On Detection: Continuous traffic baseline analysis; attacks detected and mitigated within seconds
  • Alert Integration: DDoS events trigger notifications and SIEM alerts with attack metadata (source ASNs, attack type, peak volume)

TLS/SSL Certificate Management (MVP2)​

Automated certificate lifecycle management for tenant workloads:

  • Issuance: Request and receive TLS certificates through the portal; supports public CA (Let's Encrypt, DigiCert) and private CA
  • Auto-Renewal: Certificates renewed automatically before expiry; no manual rotation required
  • Revocation: Immediate certificate revocation with CRL and OCSP propagation
  • Certificate Inventory: Centralized inventory of all certificates with expiry monitoring and alerts
  • Integration: Certificates deployable directly to Load Balancers, WAF, and other platform services

Digital Forensics (MVP2)​

Digital Forensics capabilities for security incident investigation and legal discovery:

  • Disk Imaging: Forensically sound disk images of VM instances for post-incident analysis
  • Memory Capture: RAM capture for live forensic analysis of running workloads
  • Timeline Reconstruction: Automated evidence timeline reconstruction from logs, file system metadata, and process activity
  • Chain of Custody: Documented evidence collection procedures with hash verification for legal admissibility
  • Reporting: Forensic investigation reports suitable for internal review or legal proceedings

NAT Gateway​

CCP's security service composed of NAT Gateway and KMS. A NAT (Network Address Translation) Gateway is a managed cloud service used to allow resources in a private subnet (like virtual machines, database servers, or containers) to initiate outbound connections to the internet or other cloud services, while preventing uninvited inbound connections from the outside world.

CCP's NAT Gateway enhances security, outbound internet Access, and provides high availability & scalability.

KMS​

KMS (Key Management Service) in CCP is a centralized, secure service used to create, manage, rotate, store, and control access to cryptographic keys and sensitive data.

KMS allows a user to create Key and Secret. In cryptography, a Key (specifically a symmetric or asymmetric cryptographic key) is a string of bits used by an algorithm to transform plain text into ciphertext (encryption) and back again (decryption).

Whereas, a Secret is sensitive information that grants access to systems, services, databases, or APIs. Examples include database passwords, SSH private keys, TLS/SSL certificates, OAuth tokens, and third-party API keys.

Note: KMS is a platform addons.