20-Point Production IT Security & Sovereignty Checklist
Specification Matrix
Core Engineering Requirements
- ›Zero open management ports to the public internet: all administration must transit through WireGuard VPN with mTLS.
- ›Data at rest must enforce AES-256-GCM encryption with tenant-isolated keys managed on Moroccan sovereign soil.
- ›Containerized production workloads must execute as unprivileged rootless users with read-only filesystems.
- ›Telephony SIP trunks must enforce strict carrier IP whitelisting to eliminate toll fraud and unauthorized SIP INVITE attacks.
1. Network & Perimeter Defense: 5 Non-Negotiable Rules
The perimeter of production telecom and AI systems must enforce a Zero-Trust default-deny architecture. Control 1: Block all incoming traffic by default using `nftables` or eBPF packet filters. Control 2: Zero public SSH ports; all engineering access requires a dedicated WireGuard VPN mesh with mutual TLS (mTLS) authentication. Control 3: Strict IP whitelisting for SIP trunk interconnects, allowing only carrier SBC IP blocks (Maroc Telecom, Orange, Inwi). Control 4: Enforce rate limiting on SIP INVITE packets via Kamailio to eliminate volumetric DDoS attacks. Control 5: Implement strict network segmentation between media processing nodes and internal database backends.
# Production Linux nftables Default-Deny Firewall Configuration (/etc/nftables.conf)
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
# Allow established and related connections
ct state established,related accept
# Loopback interface
iif "lo" accept
# WireGuard VPN administration port only
udp dport 51820 accept
# SIP Signaling & Media strictly from Carrier SBC Whitelist
ip saddr { 196.200.0.0/19, 105.159.0.0/18 } udp dport { 5060, 5061, 10000-20000 } accept
# Log and drop everything else
log prefix "SECURITY_DROP: " drop
}
}2. Data Sovereignty & Cryptography: 5 Storage Controls
Storage security requires end-to-end cryptographic separation. Control 6: Full Disk Encryption (FDE) across all server nodes using LUKS2 with AES-256-XTS. Control 7: Database column-level encryption (pgcrypto) for PII customer fields (national ID, phone numbers, addresses). Control 8: Ephemeral audio processing in RAM; raw audio buffers are purged from volatile memory upon call completion unless explicit caller consent is registered. Control 9: Automated daily encrypted backups (GPG asymmetric keys) mirrored exclusively to sovereign Moroccan Tier-III facilities. Control 10: Automatic PII scrubbing in transcript logs via streaming regex and NER masking.
3. Application & Host Hardening: 5 Execution Controls
Securing the execution runtime prevents container breakout and privilege escalation. Control 11: Production containers must run as rootless, unprivileged users (`user: 10001:10001`). Control 12: Enforce read-only root filesystems (`read_only: true`) with ephemeral tmpfs mounts for temporary files. Control 13: Drop all Linux capabilities (`cap_drop: [ALL]`), granting only strictly necessary permissions like `CAP_NET_BIND_SERVICE`. Control 14: Restrict kernel system calls using custom AppArmor and seccomp profiles. Control 15: Zero plaintext secrets in code repositories or environment files; all credentials must be dynamically injected via HashiCorp Vault or encrypted systemd credentials.
4. Governance, Audit Trails & Incident Response: 5 Observability Controls
Maintaining operational transparency is mandatory for regulatory compliance. Control 16: Immutable tamper-evident audit logging with forward-secure SHA-256 hash chaining. Control 17: Real-time Prometheus/Grafana anomaly alerting on abnormal SIP INVITE spikes or unusual call duration patterns. Control 18: Dual-custody authorization for production database exports or customer record queries. Control 19: An automated emergency kill-switch that severs carrier SIP interconnects within 2 seconds of verified intrusion detection. Control 20: Annual third-party penetration testing and formal CNDP Law 09-08 compliance certification.
| Security Domain | Verification Command / Artifact | Risk Severity | Pass Criteria |
|---|---|---|---|
| Network Perimeter | nmap -sS -p- <server-ip> | Critical (P0) | Zero open public ports (Only WireGuard) |
| Transport Security | testssl.sh sip.vext.ma:5061 | Critical (P0) | Grade A+ (TLS 1.3 only, SRTP enabled) |
| Host Hardening | apparmor_status && docker ps --quiet | High (P1) | All containers rootless with read-only root |
| Database Storage | SELECT * FROM pg_tables WHERE schemaname='public' | High (P1) | All PII columns encrypted with AES-256 |
| Audit Log Tampering | vext-verify-audit-chain /var/log/audit.log | Critical (P0) | SHA-256 hash digests match with zero gaps |
Specification FAQ
Need technical guidance on this specification?
Speak directly with our systems engineers in Casablanca.