Topics Covered:
- CIA Triad and security principles
- Threat modeling and risk assessment
- Canadian privacy and security regulations
- Security frameworks (ISO 27001, NIST)
Code Example - Security Assessment Script:
#!/usr/bin/env python3
"""
Toronto Banking Security Assessment Tool
Compliance with Canadian banking regulations
"""
import requests
import ssl
import socket
import subprocess
import json
from datetime import datetime, timedelta
class TorontoBankingSecurityAssessment:
def __init__(self, target_host, compliance_level="OSFI"):
self.target_host = target_host
self.compliance_level = compliance_level
self.results = {
"assessment_date": datetime.now().isoformat(),
"target": target_host,
"compliance_framework": compliance_level,
"checks": []
}
def check_ssl_configuration(self):
"""Check SSL/TLS configuration for Canadian banking standards"""
try:
context = ssl.create_default_context()
with socket.create_connection((self.target_host, 443), timeout=10) as sock:
with context.wrap_socket(sock, server_hostname=self.target_host) as ssock:
cert = ssock.getpeercert()
cipher = ssock.cipher()
# Check certificate expiry
not_after = datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y %Z')
days_until_expiry = (not_after - datetime.now()).days
# Canadian banking requirements
min_key_size = 2048
approved_ciphers = ['TLS_AES_256_GCM_SHA384', 'TLS_AES_128_GCM_SHA256']
check_result = {
"check_name": "SSL/TLS Configuration",
"status": "PASS" if days_until_expiry > 30 else "FAIL",
"details": {
"certificate_expiry_days": days_until_expiry,
"cipher_suite": cipher[0] if cipher else "Unknown",
"protocol_version": cipher[1] if cipher else "Unknown",
"key_size": cipher[2] if cipher else "Unknown",
"osfi_compliant": cipher[1] >= "TLSv1.2" if cipher else False
},
"recommendations": self._get_ssl_recommendations(cipher, days_until_expiry)
}
self.results["checks"].append(check_result)
return check_result
except Exception as e:
error_result = {
"check_name": "SSL/TLS Configuration",
"status": "ERROR",
"error": str(e)
}
self.results["checks"].append(error_result)
return error_result
def check_canadian_privacy_compliance(self, privacy_policy_url):
"""Verify PIPEDA compliance indicators"""
try:
response = requests.get(privacy_policy_url, timeout=10)
content = response.text.lower()
# PIPEDA compliance indicators
pipeda_indicators = [
"personal information protection",
"electronic documents act",
"pipeda",
"privacy officer",
"data retention policy",
"cross-border data transfer",
"consent to collect",
"right to access",
"right to correction"
]
found_indicators = []
for indicator in pipeda_indicators:
if indicator in content:
found_indicators.append(indicator)
compliance_score = len(found_indicators) / len(pipeda_indicators) * 100
check_result = {
"check_name": "PIPEDA Compliance Assessment",
"status": "PASS" if compliance_score >= 80 else "REVIEW",
"details": {
"compliance_score": round(compliance_score, 2),
"found_indicators": found_indicators,
"missing_indicators": [i for i in pipeda_indicators if i not in found_indicators]
},
"recommendations": self._get_privacy_recommendations(compliance_score)
}
self.results["checks"].append(check_result)
return check_result
except Exception as e:
error_result = {
"check_name": "PIPEDA Compliance Assessment",
"status": "ERROR",
"error": str(e)
}
self.results["checks"].append(error_result)
return error_result
def check_security_headers(self):
"""Check HTTP security headers for Toronto financial services"""
try:
response = requests.get(f"https://{self.target_host}", timeout=10)
headers = response.headers
# Required security headers for Canadian financial institutions
required_headers = {
"strict-transport-security": "HSTS protection",
"x-frame-options": "Clickjacking protection",
"x-content-type-options": "MIME type sniffing protection",
"x-xss-protection": "XSS protection",
"content-security-policy": "CSP protection",
"referrer-policy": "Referrer policy",
"permissions-policy": "Feature policy"
}
found_headers = {}
missing_headers = {}
for header, description in required_headers.items():
if header in [h.lower() for h in headers.keys()]:
found_headers[header] = headers.get(header)
else:
missing_headers[header] = description
security_score = len(found_headers) / len(required_headers) * 100
check_result = {
"check_name": "Security Headers Assessment",
"status": "PASS" if security_score >= 85 else "REVIEW",
"details": {
"security_score": round(security_score, 2),
"found_headers": found_headers,
"missing_headers": missing_headers,
"osfi_requirement": "Grade A security headers required"
},
"recommendations": self._get_header_recommendations(missing_headers)
}
self.results["checks"].append(check_result)
return check_result
except Exception as e:
error_result = {
"check_name": "Security Headers Assessment",
"status": "ERROR",
"error": str(e)
}
self.results["checks"].append(error_result)
return error_result
def check_cdn_security(self):
"""Assess CDN and DDoS protection for Toronto operations"""
try:
# Check for common CDN providers used in Canada
cdn_headers = [
"cf-ray", # Cloudflare
"x-amz-cf-id", # AWS CloudFront
"x-azure-ref", # Azure CDN
"x-cache" # Generic CDN
]
response = requests.get(f"https://{self.target_host}", timeout=10)
detected_cdns = []
for header in cdn_headers:
if header in [h.lower() for h in response.headers.keys()]:
detected_cdns.append({
"header": header,
"value": response.headers.get(header, "")
})
# Check response time from Toronto
start_time = datetime.now()
requests.get(f"https://{self.target_host}", timeout=10)
response_time = (datetime.now() - start_time).total_seconds()
check_result = {
"check_name": "CDN and DDoS Protection",
"status": "PASS" if detected_cdns and response_time < 2.0 else "REVIEW",
"details": {
"detected_cdns": detected_cdns,
"response_time_seconds": round(response_time, 3),
"toronto_performance": "Good" if response_time < 1.0 else "Acceptable" if response_time < 2.0 else "Poor"
},
"recommendations": self._get_cdn_recommendations(detected_cdns, response_time)
}
self.results["checks"].append(check_result)
return check_result
except Exception as e:
error_result = {
"check_name": "CDN and DDoS Protection",
"status": "ERROR",
"error": str(e)
}
self.results["checks"].append(error_result)
return error_result
def generate_compliance_report(self):
"""Generate comprehensive security assessment report"""
passed_checks = len([c for c in self.results["checks"] if c["status"] == "PASS"])
total_checks = len(self.results["checks"])
compliance_percentage = (passed_checks / total_checks * 100) if total_checks > 0 else 0
report = {
**self.results,
"summary": {
"total_checks": total_checks,
"passed_checks": passed_checks,
"compliance_percentage": round(compliance_percentage, 2),
"overall_status": self._get_overall_status(compliance_percentage),
"next_assessment": (datetime.now() + timedelta(days=90)).isoformat()
},
"canadian_compliance_notes": self._get_canadian_compliance_notes()
}
return report
def _get_ssl_recommendations(self, cipher, days_until_expiry):
recommendations = []
if days_until_expiry < 30:
recommendations.append("Renew SSL certificate immediately")
if cipher and cipher[1] < "TLSv1.2":
recommendations.append("Upgrade to TLS 1.2 or higher for OSFI compliance")
return recommendations
def _get_privacy_recommendations(self, score):
if score < 80:
return ["Review privacy policy for PIPEDA compliance", "Consult with Canadian privacy lawyer"]
return ["Maintain current privacy policy standards"]
def _get_header_recommendations(self, missing):
return [f"Implement {header}: {desc}" for header, desc in missing.items()]
def _get_cdn_recommendations(self, cdns, response_time):
recommendations = []
if not cdns:
recommendations.append("Implement CDN for improved Toronto area performance")
if response_time > 2.0:
recommendations.append("Optimize server response time for Canadian users")
return recommendations
def _get_overall_status(self, percentage):
if percentage >= 90:
return "EXCELLENT - OSFI Ready"
elif percentage >= 80:
return "GOOD - Minor improvements needed"
elif percentage >= 70:
return "ACCEPTABLE - Review required"
else:
return "POOR - Immediate action required"
def _get_canadian_compliance_notes(self):
return [
"Assessment based on OSFI cybersecurity guidelines",
"PIPEDA compliance verification included",
"Next review recommended in 90 days",
"Contact Canadian cyber security experts for detailed analysis"
]
# Usage example
if __name__ == "__main__":
# Example for Toronto banking application assessment
assessor = TorontoBankingSecurityAssessment("secure-bank.toronto.ca", "OSFI")
# Run security checks
assessor.check_ssl_configuration()
assessor.check_canadian_privacy_compliance("https://secure-bank.toronto.ca/privacy")
assessor.check_security_headers()
assessor.check_cdn_security()
# Generate compliance report
report = assessor.generate_compliance_report()
# Save report
with open(f"security_assessment_{datetime.now().strftime('%Y%m%d')}.json", "w") as f:
json.dump(report, f, indent=2)
print("Security assessment completed for Toronto banking application")
print(f"Overall compliance: {report['summary']['overall_status']}")
Hands-on Project:
Toronto Healthcare Security Audit - Perform comprehensive security assessment of a healthcare application handling Ontario patient data with PHIPA compliance requirements.
