# =============================================================================
# COMPETENCY RECORD - Cedric Ancellin's demonstrated engineering skills and
# experience. Third-party technologies and vendors are named as the concrete
# skill surface. Professional background / track record.
# =============================================================================

# ============================================================
# SECURITY ENGINEERING - COMPETENCY RECORD
# ============================================================
# Core Purpose:
#   Demonstrated experience building defense-in-depth security:
#   a multi-layer request firewall, layered upload security,
#   secrets management, hardening, a formal controls registry,
#   and third-party penetration-test remediation.
# ============================================================

summary: >
  Designed and built the platform's security posture as
  defense-in-depth: a multi-layer request firewall with honeypot
  responses, layered upload security (magic-byte validation +
  antivirus + content sanitization), runtime secrets management,
  HTTP + session hardening, composed multi-factor infrastructure
  access, and a formal security-controls registry, validated by
  external penetration testing and driven to remediation.


# ==================================================================
# 1. REQUEST FIREWALL
# ==================================================================

request_firewall:
  description: >
    Built an application-layer firewall at the single request
    entry point that inspects every parameter before it reaches
    business logic.
  layers:
    blacklist: "Scans all request parameters against SQL-injection, OS-command-injection, and database-attack patterns."
    numeric_enforcement: "Strict type validation on declared numeric parameters."
    regex_enforcement: "Per-parameter pattern validation from declared parameter rules."
  honeypot: "On attack detection, returns plausible fake data (names, transactions, addresses) instead of errors, wasting attacker time and hiding real behavior."
  whitelisting: "Per-endpoint parameter allowlist; non-declared parameters are quarantined and never reach handlers."
  edge: "Ingress-only model behind an edge WAF with DDoS protection, managed challenges, rate limiting, and TLS enforcement; direct-IP access blocked."


# ==================================================================
# 2. UPLOAD SECURITY (DEFENSE-IN-DEPTH)
# ==================================================================

upload_security:
  description: >
    Engineered a layered upload-security subsystem integrated
    across many upload handlers, never trusting client-supplied
    content types.
  layers:
    magic_bytes: "Actual content-type detection via file magic bytes; client headers ignored."
    antivirus: "ClamAV scanning (daemon for throughput, standalone fallback)."
    sanitization:
      pdf: "Ghostscript re-render strips JavaScript, macros, embedded executables, and malicious metadata."
      svg_html: "DOMDocument sanitization allowlists elements/attributes/URIs and strips scripts, event handlers, and dangerous URIs."
      csv: "Formula-injection (DDE) protection via cell-value prefixing on export."
  design_choice: "Fail-open by design for availability, unavailable scanners log a warning rather than block, a deliberate, documented trade-off."
  logging: "Structured security-event logging with threat/reject/sanitize/warning/error levels."


# ==================================================================
# 3. AUTHENTICATION, AUTHORIZATION & PII GATING
# ==================================================================

authz:
  description: >
    Built access control spanning session hierarchy, feature
    gating, and explicit PII protection. (Auth mechanics in COMP-09.)
  mechanisms:
    - "Runtime permission checks against a system → account → venue access hierarchy."
    - "Feature gating per tenant and account scope."
    - "Explicit PII-visibility gating that even super-admins must be granted, not bypassable by god-mode."
    - "Per-request CSRF token validation for session-type requests."


# ==================================================================
# 4. SECRETS MANAGEMENT
# ==================================================================

secrets:
  description: >
    Removed credentials from code entirely.
  mechanism: "All keys/credentials/secrets retrieved at runtime from a cloud secrets manager, with a resilient short-TTL cache (silently no-ops if the cache is down); nothing baked into source."


# ==================================================================
# 5. INFRASTRUCTURE ACCESS & HARDENING
# ==================================================================

infrastructure:
  description: >
    Designed hardened infrastructure access and platform
    hardening.
  bridge_ssh: >
    Composed four-factor access to servers: a persistent bridge
    key, a platform password, a bridge-local password, and a
    weekly-expiring target-server key. Targets accept no direct
    internet SSH, all access routes through a single bridge.
  hardening:
    headers: "HSTS, nosniff, frame-options; content-security-policy rollout (report-only first)."
    sessions: "Secure + SameSite cookie attributes, reduced session timeout, split auth/XSRF cookie plan."
    rate_limiting: "Redis-based escalating lockout on auth endpoints (tiered cooldowns + admin alerts)."
    password_policy: "Length + complexity requirements, common-password dictionary check, non-equal-to-identity check."
  fleet: "Managed endpoint fleet via a device-management platform, layered on OS-native protections and edge DNS filtering."
  immutable_infra: "Versioned server images bound compromise dwell time and enable rapid redeploy-based recovery."


# ==================================================================
# 6. GOVERNANCE, AUDIT & PENTEST REMEDIATION
# ==================================================================

governance:
  description: >
    Ran security as a governed, measurable program.
  controls_registry: "A cross-cutting registry of security controls with coverage and status (active / partial / planned / remediation)."
  pentest:
    detail: "Commissioned an external penetration test; triaged findings by severity into a phased remediation plan (quick wins → core hardening → ongoing)."
    outcome: "Validated absence of injection/XSS/SSRF/SSTI/request-smuggling/session-fixation classes; enforced CSRF and vertical authorization; tracked each vulnerability to a remediation timeline with documented, reasoned exceptions."
  cross_reference:
    $ref: "https://zc8.com/competencies/10_reliability_operations"