This document outlines the security policies, best practices, and procedures implemented in the homelab environment.

1. Defense in Depth: Multiple layers of security controls
2. Least Privilege: Minimum necessary access rights
3. Zero Trust: Verify explicitly, never assume trust
4. Security by Design: Security considered from the start
5. Continuous Monitoring: Constant vigilance and alerting

pfSense/OPNsense Firewall

• Stateful packet inspection
• Default deny policy
• Explicit allow rules only
• Geo-blocking for high-risk countries
• Rate limiting and DDoS protection

Example Firewall Rules

# Management VLAN access to servers
allow tcp from 192.168.1.0/24 to 192.168.10.0/24 port 22,443 stateful

# Block IoT devices from LAN
block from 192.168.20.0/24 to 192.168.0.0/16

# Allow specific IoT cloud services
allow from 192.168.20.0/24 to any port 443 stateful log

WireGuard Configuration

• Modern cryptography (Curve25519, ChaCha20)
• Per-device keys
• Split-tunnel for home access
• Kill-switch enabled
• Regular key rotation

Multi-Factor Authentication (MFA)

• Required for all administrative access
• TOTP (Time-based One-Time Password)
• Hardware keys (YubiKey) for critical systems
• Backup codes securely stored

Password Policy

• Minimum 16 characters for admin accounts
• Complexity requirements enforced
• Password manager recommended (Vaultwarden)
• No password reuse across services
• Regular password rotation (90 days for admin)

Role-Based Access Control (RBAC)

Roles:
- Administrator: Full system access
- Operator: Day-to-day operations, no security changes
- Developer: Development environments only
- ReadOnly: Monitoring and reporting
- Guest: Limited internet access

Principle of Least Privilege

• Service accounts with minimal permissions
• Just-in-time access for elevated privileges
• Regular access reviews
• Automatic revocation of unused accounts

SSH Hardening

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers admin-user
Port 22022  # Non-standard port
Protocol 2

Key Management

• ED25519 keys preferred
• Keys encrypted with passphrase
• SSH keys rotated annually
• Separate keys per device

Linux Systems

• Minimal installation (no unnecessary packages)
• Regular security updates (unattended-upgrades)
• SELinux/AppArmor enabled
• File system encryption where applicable
• Secure boot enabled

Update Management

# Automated security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Update schedule
Daily:   Security updates
Weekly:  Package updates
Monthly: Kernel updates (with reboot)

Docker Security

• Run containers as non-root user
• Read-only root filesystem where possible
• Drop unnecessary capabilities
• Use official or verified images only
• Regular image scanning for vulnerabilities

# Example secure docker-compose.yml
services:
  app:
    image: app:latest
    user: "1000:1000"
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true

Kubernetes Security

• Network policies enforced
• Pod Security Standards (restricted)
• RBAC for all service accounts
• Secrets encrypted at rest
• Regular security audits

Data at Rest

• Full disk encryption (LUKS)
• Encrypted ZFS pools
• Database encryption enabled
• Backup encryption (AES-256)

Data in Transit

• TLS 1.3 for all web services
• Strong cipher suites only
• HSTS enabled
• Certificate pinning where applicable

Vault/Secret Management

• Centralized secrets storage
• Encrypted at rest and in transit
• Automatic secret rotation
• Audit logging of access
• No secrets in git repositories

# Example: Using environment variables
# Never commit .env files
source /secure/path/.env

• Backups encrypted before storage
• Off-site backups in secure locations
• Access logs for all restore operations
• Regular restore testing
• Immutable backup copies (ransomware protection)

Intrusion Detection/Prevention

• Suricata IDS/IPS deployed
• Signature-based and anomaly detection
• Real-time alerting
• Automatic blocking of threats

Log Management

• Centralized logging (Loki/Elasticsearch)
• Log retention: 90 days online, 1 year archive
• Log integrity verification
• Tamper-proof log storage

• Failed authentication attempts
• Privilege escalation
• Unusual network traffic
• File integrity changes
• Service anomalies
• Resource exhaustion

Alert Categories

• Critical: Immediate action required (active breach)
• High: Security incident (investigate within 1 hour)
• Medium: Suspicious activity (review within 24 hours)
• Low: Informational (weekly review)

Regular Scans

• Weekly automated vulnerability scans
• Container image scanning (Trivy/Clair)
• Web application scanning (OWASP ZAP)
• Network vulnerability assessment

Patch Management

• Critical patches: 24 hours
• High severity: 7 days
• Medium severity: 30 days
• Low severity: Quarterly

Monthly Reviews

• Firewall rule review
• Access control review
• Certificate expiration check
• Service exposure assessment

Quarterly Audits

• Comprehensive security assessment
• Penetration testing
• Compliance verification
• Policy review and updates

Phase 1: Detection and Analysis

1. Detect security event
2. Determine scope and severity
3. Classify incident type
4. Activate response team

Phase 2: Containment

1. Isolate affected systems
2. Preserve evidence
3. Prevent lateral movement
4. Maintain business continuity

Phase 3: Eradication and Recovery

1. Remove threat from environment
2. Apply security patches
3. Restore from clean backups
4. Verify system integrity

Phase 4: Post-Incident

1. Document incident details
2. Conduct lessons learned
3. Update security controls
4. Communicate to stakeholders

• Primary Contact: [Admin Email]
• Backup Contact: [Secondary Email]
• Emergency: [Phone Number]

• NIST Cybersecurity Framework
• CIS Controls
• OWASP Top 10
• ISO 27001 principles

• Security policies reviewed annually
• All security changes documented
• Runbooks for common security tasks
• Regular security training

• Locked server cabinet
• Video surveillance
• Access logging
• Environmental monitoring (temperature, humidity)

• Full disk encryption on all devices
• Automatic screen lock (5 minutes)
• Lost device wipe capability
• Physical security locks

• MFA enabled on all accounts
• API keys rotated regularly
• Least privilege IAM policies
• Audit logging enabled

• Security review before adoption
• Regular vendor security assessments
• Data processing agreements
• Exit strategy documented

• Firewall: pfSense/OPNsense
• IDS/IPS: Suricata
• Vulnerability Scanner: OpenVAS, Trivy
• SIEM: Wazuh
• Password Manager: Vaultwarden
• Secret Management: HashiCorp Vault
• Certificate Management: cert-manager

• Implement SIEM solution
• Deploy EDR on endpoints
• Add honeypots for threat intelligence
• Implement security automation (SOAR)
• Enhance DLP capabilities
• Add biometric authentication
• Implement micro-segmentation

• CIS Benchmarks
• OWASP Security Guidelines
• NIST Cybersecurity Framework
• Docker Security Best Practices

Document Version: 1.0 Last Updated: 2025-11 Next Review: Quarterly