# 🔒 Sistem Keamanan SIAKAD UNDARMA

Dokumentasi lengkap arsitektur keamanan Sistem Informasi Akademik (SIAKAD) Universitas Karyadarma.

## 📋 Daftar Isi

1. [Arsitektur Keamanan](#arsitektur-keamanan)
2. [Layer Keamanan](#layer-keamanan)
3. [Autentikasi & Otorisasi](#autentikasi--otorisasi)
4. [Proteksi Data](#proteksi-data)
5. [Monitoring & Audit](#monitoring--audit)
6. [Konfigurasi Server](#konfigurasi-server)
7. [Backup & Recovery](#backup--recovery)
8. [Incident Response](#incident-response)

---

## 🏗️ Arsitektur Keamanan

```
┌─────────────────────────────────────────────────────────────────┐
│                        INTERNET                                  │
└──────────────────────┬──────────────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────────────┐
│  🔥 UFW Firewall (Deny All, Allow 22/80/443)                    │
│  🔥 Fail2Ban (Brute Force Protection)                           │
└──────────────────────┬──────────────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────────────┐
│  🌐 NGINX Reverse Proxy                                          │
│     ├── Rate Limiting (5 req/min login)                         │
│     ├── SSL/TLS 1.2+ (Let's Encrypt)                            │
│     ├── Security Headers (CSP, HSTS, X-Frame)                   │
│     └── Bad Bot Blocking                                        │
└──────────────────────┬──────────────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────────────┐
│  🐘 PHP-FPM (Application Layer)                                  │
│     ├── Laravel Application                                     │
│     ├── Input Validation & Sanitization                         │
│     ├── CSRF Protection                                         │
│     └── Session Security (HttpOnly, Secure, SameSite)           │
└──────────────────────┬──────────────────────────────────────────┘
                       │
┌──────────────────────▼──────────────────────────────────────────┐
│  🗄️  MariaDB (Database Layer)                                     │
│     ├── Isolated Network (No Direct Internet Access)            │
│     ├── Encrypted Connections (SSL)                             │
│     ├── Row-Level Security                                      │
│     └── Audit Logging                                           │
└─────────────────────────────────────────────────────────────────┘
```

---

## 🔐 Layer Keamanan

### Layer 1: Network Security
- **UFW Firewall**: Hanya port 22 (SSH), 80 (HTTP), 443 (HTTPS) yang terbuka
- **Fail2Ban**: Blokir IP setelah 5x percobaan login gagal
- **Rate Limiting**: Maksimal 5 request/menit untuk endpoint login
- **IP Whitelisting**: Akses database hanya dari internal network

### Layer 2: Transport Security
- **SSL/TLS 1.2+**: Enkripsi end-to-end dengan Let's Encrypt
- **HSTS**: Force HTTPS selama 1 tahun
- **Perfect Forward Secrecy**: ECDHE cipher suites

### Layer 3: Application Security
- **Laravel Security**: CSRF tokens, XSS protection, SQL injection prevention
- **Input Validation**: Semua input divalidasi dan disanitasi
- **Password Security**: Bcrypt hashing dengan cost factor 12
- **Session Security**: HttpOnly, Secure, SameSite=Strict cookies

### Layer 4: Data Security
- **Database Encryption**: Koneksi SSL ke MariaDB
- **Data Integrity**: SHA-256 checksums untuk data kritis
- **Audit Logging**: Semua perubahan data tercatat
- **Backup Encryption**: AES-256-CBC untuk file backup

---

## 👤 Autentikasi & Otorisasi

### Role-Based Access Control (RBAC)

| Role | Akses |
|------|-------|
| **Super Admin** | Full access ke semua modul |
| **Admin Akademik** | Master data, KRS, KHS, jadwal, laporan |
| **Admin Keuangan** | Tagihan, pembayaran, laporan keuangan |
| **Bendahara** | Validasi pembayaran, cicilan, denda |
| **Dosen** | Jadwal, nilai, presensi, e-learning, profil |
| **Mahasiswa** | KRS, KHS, transkrip, e-learning, keuangan |
| **Pegawai BAAK** | Verifikasi mahasiswa, surat, helpdesk |
| **Pegawai BAUK** | Arsip dokumen, administrasi umum |
| **PMB** | Pendaftaran, seleksi, registrasi ulang |
| **Perpustakaan** | Koleksi buku, peminjaman, ebook |
| **Alumni** | Profil, tracer study, legalisir |

### Login Security

1. **Password Requirements**:
   - Minimum 8 karakter
   - Kombinasi huruf besar, huruf kecil, angka
   - Tidak boleh sama dengan username/email
   - Wajib diganti setiap 90 hari (admin)

2. **Rate Limiting**:
   - Maksimal 5 percobaan login per IP per menit
   - Blokir 30 menit setelah 5x gagal
   - Blokir 24 jam setelah 10x gagal

3. **Captcha**:
   - Muncul setelah 3x percobaan gagal
   - Google reCAPTCHA v2/v3

4. **Two-Factor Authentication (2FA)**:
   - Wajib untuk Super Admin, Admin, Keuangan
   - Google Authenticator / TOTP
   - Backup codes (8 kode)

5. **Session Management**:
   - Session timeout: 30 menit idle
   - Maksimal 3 session aktif per user
   - Notifikasi login dari device baru

---

## 🛡️ Proteksi Data

### Data Integrity Checksums

Tabel yang diproteksi:
- `nilai` - Nilai akademik mahasiswa
- `krs` - Kartu Rencana Studi
- `khs` - Kartu Hasil Studi
- `pembayaran` - Pembayaran mahasiswa
- `presensi` - Absensi perkuliahan
- `mahasiswa` - Data mahasiswa
- `dosen` - Data dosen

```bash
# Generate checksums
php artisan security:generate-checksums nilai

# Verify integrity
php artisan security:integrity-check

# Schedule daily check in cron
0 3 * * * cd /var/www/siakad && php artisan security:integrity-check >> /var/log/siakad-integrity.log
```

### Audit Logging

Semua aktivitas tercatat:
- Login/logout (success & failed)
- CRUD operations pada data kritis
- Perubahan nilai, KRS, KHS, pembayaran
- Akses tidak sah
- Perubahan role/permission

```bash
# View recent audit logs
php artisan security:report

# Cleanup old logs
php artisan security:cleanup-logs --days=90
```

---

## 📊 Monitoring & Audit

### Security Alerts

Alert otomatis untuk:
- Brute force attempts
- Unauthorized access
- Data tampering (checksum mismatch)
- Login dari lokasi mencurigakan
- Perubahan data kritis

### Real-time Monitoring

```bash
# Monitor failed logins
tail -f /var/log/nginx/siakad-access.log | grep " 403\| 401"

# Monitor Laravel logs
tail -f /var/www/siakad/storage/logs/laravel.log

# Check active blocks
sudo fail2ban-client status nginx-login

# View security report
php artisan security:report
```

### Dashboard Monitoring

Akses `/admin/security/dashboard` untuk melihat:
- Login attempts (24h)
- Active threats
- Unresolved alerts
- System health
- Backup status

---

## 🖥️ Konfigurasi Server

### Prerequisites

```bash
# Ubuntu 22.04 LTS
sudo apt update && sudo apt upgrade -y

# Install required packages
sudo apt install -y nginx mariadb-server php8.2-fpm \
    php8.2-mysql php8.2-mbstring php8.2-xml php8.2-curl \
    php8.2-zip php8.2-bcmath php8.2-gd php8.2-intl \
    redis-server fail2ban ufw certbot python3-certbot-nginx
```

### NGINX Setup

```bash
# Copy configuration
sudo cp scripts/security/nginx-siakad.conf /etc/nginx/sites-available/siakad
sudo ln -s /etc/nginx/sites-available/siakad /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
```

### SSL Certificate

```bash
# Generate certificate
sudo certbot --nginx -d siakad.undarma.ac.id

# Auto-renewal test
sudo certbot renew --dry-run
```

### Firewall Setup

```bash
# Make executable and run
chmod +x scripts/security/ufw-rules.sh
sudo ./scripts/security/ufw-rules.sh
```

### Fail2Ban Setup

```bash
# Copy filters
sudo cp scripts/security/fail2ban-siakad.conf /etc/fail2ban/jail.local
sudo systemctl restart fail2ban

# Check status
sudo fail2ban-client status
```

### Database Security

```sql
-- Create dedicated backup user
CREATE USER 'siakad_backup'@'localhost' IDENTIFIED BY 'STRONG_PASSWORD_HERE';
GRANT SELECT, LOCK TABLES, SHOW VIEW, RELOAD, REPLICATION CLIENT ON *.* TO 'siakad_backup'@'localhost';
FLUSH PRIVILEGES;

-- Disable remote root access
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
FLUSH PRIVILEGES;

-- Enable SSL
REQUIRE SSL;
```

---

## 💾 Backup & Recovery

### Automated Daily Backup

```bash
# Setup backup script
chmod +x scripts/security/backup-encrypted.sh

# Add to crontab
sudo crontab -e

# Add line:
0 2 * * * /var/www/siakad/scripts/security/backup-encrypted.sh >> /var/log/siakad-backup.log 2>&1
```

### Backup Contents

1. **Database**: Full dump dengan `mysqldump` + gzip + AES-256 encryption
2. **Application Files**: Laravel app (exclude vendor/node_modules)
3. **Config**: `.env` dan folder `config/`
4. **Checksums**: SHA-256 untuk verifikasi integrity

### Recovery Procedure

```bash
# 1. Decrypt backup
openssl enc -aes-256-cbc -d -pbkdf2 -pass pass:"YOUR_KEY" \
    -in backup_database.sql.gz.enc | gunzip > backup.sql

# 2. Restore database
mysql -u siakad_backup -p siakad_db < backup.sql

# 3. Restore files
tar xzf backup_files.tar.gz -C /var/www/

# 4. Verify checksums
cd /backup && sha256sum -c checksums.sha256
```

---

## 🚨 Incident Response

### Checklist Respons Insiden

1. **Identifikasi**
   - Cek log: `tail -f /var/log/nginx/siakad-error.log`
   - Cek alert: `php artisan security:report`
   - Identifikasi scope dan impact

2. **Containment**
   - Blokir IP: `sudo fail2ban-client set nginx-login banip <IP>`
   - Disable user account jika diperlukan
   - Backup evidence sebelum cleanup

3. **Eradication**
   - Patch vulnerability
   - Update credentials
   - Scan malware

4. **Recovery**
   - Restore dari backup jika data corrupt
   - Verifikasi integrity dengan checksum
   - Monitor secara intensif

5. **Lessons Learned**
   - Dokumentasi insiden
   - Update security policies
   - Training team

### Emergency Contacts

| Role | Contact |
|------|---------|
| System Admin | admin@undarma.ac.id |
| Security Team | security@undarma.ac.id |
| Vendor Support | support@undarma.ac.id |

---

## 📅 Maintenance Schedule

| Task | Frequency | Command |
|------|-----------|---------|
| Security updates | Daily | `sudo apt update && sudo apt upgrade` |
| Backup | Daily | `backup-encrypted.sh` |
| Integrity check | Daily | `security:integrity-check` |
| Log cleanup | Weekly | `security:cleanup-logs` |
| Security report | Weekly | `security:report` |
| SSL renewal | Monthly | `certbot renew` |
| Password rotation | Quarterly | Manual |
| Security audit | Annually | External auditor |

---

## 📚 Referensi

- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [Laravel Security](https://laravel.com/docs/security)
- [NGINX Security](https://nginx.org/en/docs/security_controls.html)
- [MariaDB Security](https://mariadb.com/kb/en/security/)

---

**Universitas Karyadarma Kupang**  
*SIAKAD Security Team*  
Last Updated: 2026