🔒 Privileged Access Auditor

A Docker-based security monitoring tool designed to detect and log privileged access attempts, specifically addressing insider threat scenarios in Nigerian financial institutions.

🎯 The Problem This Solves

Recent cybersecurity reports from Nigeria reveal sophisticated attacks on financial institutions where insider collaboration enables external threat actors:

• The EFCC has recovered over N20 billion from coordinated cyberattacks targeting Nigerian banks
• Rogue bank employees are intentionally granting access to external hacker networks
• Attacks are coming from regions including Eastern Europe and the United States
• This has been declared a threat to national financial stability

This tool provides a practical solution for monitoring privileged access and creating immutable audit trails.

🚀 Features

• ✅ Real-time Access Logging - Captures every access with timestamp and source IP
• ✅ Docker Isolation - Runs in a container, preventing tampering by insiders
• ✅ JSON Audit Trail - Creates structured, machine-readable logs
• ✅ Security Headers - Implements security best practices
• ✅ Health Monitoring - Built-in health checks for production
• ✅ Web Log Viewer - Optional component to view logs in browser

📋 Prerequisites

• Docker Desktop (free from docker.com)
• 1GB RAM minimum
• Basic understanding of command line

🛠️ Quick Start (5 Minutes)

1. Clone this repository

git clone https://github.com/toye-cyberlabs/docker-privileged-access-auditor.git
cd docker-privileged-access-auditor

2. Build and run

docker-compose up -d

3. Test it works

Open your browser to: http://localhost:8888

You should see: "🔒 Access Audit System"

4. View the audit logs

# See real-time logs
docker logs privileged-access-auditor

# Or view the JSON log file
cat logs/audit.log

📖 How Docker Works (Beginner Explanation)

Docker packages your application with everything it needs to run. Think of it like a shipping container:

Concept	Analogy	In This Project
Image	Blueprint/Recipe	The Dockerfile defines how to build our auditor
Container	The actual shipping container	A running instance of our audit tool
Docker Hub	Shipping port/warehouse	Where we get base images like Python
Volume	Storage container	Where we save logs persistently
Network	Shipping routes	How containers communicate

Why Docker for Security?

1. Isolation - The auditor runs in its own environment. A compromised host can't easily disable it
2. Immutability - The container is rebuilt from scratch, ensuring consistency
3. Portability - Runs the same on your laptop, a server, or in the cloud

🏗️ Architecture Diagram

┌─────────────────────────────────────────────────┐
│           Your Computer (Docker Host)            │
│                                                   │
│  ┌──────────────────┐      ┌──────────────────┐ │
│  │   Auditor        │      │   Log Viewer     │ │
│  │   Container      │      │   Container      │ │
│  │                  │      │                  │ │
│  │  Python App      │      │   Nginx Web      │ │
│  │  Port: 8080      │      │   Server         │ │
│  └────────┬─────────┘      │   Port: 80       │ │
│           │                └────────┬─────────┘ │
│           │                         │           │
│           ▼                         ▼           │
│  ┌─────────────────────────────────────────┐    │
│  │         Shared Volume: ./logs           │    │
│  │         (Persistent Storage)            │    │
│  └─────────────────────────────────────────┘    │
│                                                   │
│  Your Browser → localhost:8888 → Auditor         │
│  Your Browser → localhost:8889 → Log Viewer      │
└─────────────────────────────────────────────────┘

🔧 Testing Security Features

Simulate normal access:

curl http://localhost:8888

Simulate suspicious data upload (insider threat):

curl -X POST http://localhost:8888 -d "customer_data=leaked"

Check alerts:

docker logs privileged-access-auditor | grep "⚠️"

📊 Real-World Application

This tool demonstrates security controls required for:

Standard	Requirement
PCI DSS	Requirement 10: Track and monitor all access
ISO 27001	A.12.4: Logging and monitoring
NIST 800-53	AU family: Audit and accountability
NITDA Guidelines	Nigerian cybersecurity framework

🤝 Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Submit a pull request

📝 License

MIT License - Free for educational and commercial use

⚠️ Disclaimer

This tool is for authorized security testing and educational purposes only. Users are responsible for complying with all applicable laws.

📧 Connect With Me

• GitHub: @toye-cyberlabs
• LinkedIn: https://linkedin.com/in/www.linkedin.com/in/adewale-adetoye-elemoro-662b44299
• Twitter: @AdetoyeElemoro

🙏 Acknowledgments

• Nigerian EFCC for highlighting insider threat challenges
• Docker community for excellent documentation
• Security researchers protecting financial infrastructure

---

⭐ Star this repository if you found it useful!