Compliance: ISO 27001 (A.8.15) • PCI-DSS v4.0 (Req 10) • Zero-Trust SRE
1 Zero-Trust Infrastructure & Security Architecture
Opsora SRE is engineered according to Zero-Trust architecture principles. No operator, script, or automated job is granted implicit operational trust regardless of network perimeter or IP origination.
Encryption In Transit
Strict TLS 1.3 with forward secrecy. HTTP Strict Transport Security (HSTS) enforced across all subdomains with 31536000-second cache lifetimes.
Encryption At Rest
MySQL InnoDB tablespaces encrypted via AES-256 block ciphers. Salted bcrypt password hashing with minimum work factor of 12 rounds.
2 Polymorphic Forensic Audit Engine
To guarantee mathematical accountability during incident retrospectives, every mutating state change triggers an atomic audit write inside the same database transaction:
// Audit Trail Payload Structure
{
"actor_id": 2,
"actor_name": "Abena Owusu", // Denormalized identity snapshot
"subject_type": "App\\Models\\Activity",
"subject_id": 48,
"event": "status_changed",
"old_values": {"status": "pending", "remark": null},
"new_values": {"status": "done", "remark": "Verified payment reconciliation queue"},
"ip_address": "197.251.134.12",
"created_at": "2026-09-05T04:00:00Z"
}
Audit log entries are immutable. Database users utilized by the application have strictly INSERT and SELECT privileges on the audit_logs table; UPDATE and DELETE statements are rejected at the MySQL engine level.
3 Session Inactivity Safeguards & 419 Interception
- Automated 120-Minute Inactivity Expire: Active operator sessions automatically terminate after 2 hours of inactivity to prevent unattended cockpit takeover.
- Seamless 419 Interceptor: If a session expires during a long shift observation, Livewire requests gracefully trap HTTP 419 tokens and redirect the operator to the branded authentication recovery screen (
/login?expired=1) without raw browser error popups. - CSRF Token Binding: Every HTTP submission requires a valid, cryptographically random, per-session CSRF token.
Responsible Vulnerability Disclosure
If you discover a potential vulnerability in Opsora SRE systems or telemetry endpoints, submit your findings to the Security Operations Center. We acknowledge reports within 4 hours and coordinate patch deployment:
hello@johnokyere.xyz • PGP Fingerprint: 4F92 B102 D78A 5901