Security Audit Report

The 2025 annual security audit was conducted between January 6 and January 31, 2025 by an independent team consisting of:

• External Auditor: Bureau Veritas Certification — ISO 27001 Lead Auditors (LA-27001 certified)
• Penetration Testing Team: CyberNile Security Ltd. (Nairobi / Djibouti) — OSCP, CEH, and CISM certified testers
• Internal Audit Oversight: SMCA Chief Information Security Officer (CISO) and DPO

The audit covered the following components and boundaries:

Africgreen is deployed on a sovereign, air-gap-capable infrastructure stack at BER-DC1, Berbera, Somaliland. The architecture follows a defense-in-depth model with multiple independent security layers:

• Perimeter: DDoS-mitigation appliances (Arbor Networks), ingress filtering, and a Web Application Firewall (WAF) with custom ruleset for maritime API patterns. All external traffic terminates at the WAF before reaching application servers.
• Network Segmentation: Production, staging, and management networks are physically separated on dedicated VLANs with inter-VLAN routing restricted by hardware firewall (Fortinet FortiGate 600E). AIS data ingestion network is isolated from the application network.
• Application Layer: Next.js frontend served from hardened Node.js instances. Go backend API with request signing, rate limiting (100 req/min per authenticated user), and strict input validation via Zod schemas.
• Database Layer: PostgreSQL (Supabase) with Row-Level Security (RLS) policies enforced at the database level for all tables. Column-level encryption for financial data using pgcrypto with HSM-stored keys.
• Audit Layer: Dedicated append-only audit database with SHA-256 hash chaining. The audit service runs in an isolated container with no write access to production data — only receives events via an authenticated write-only API.
• Secrets Management: HashiCorp Vault (BER-DC1 instance) for all secrets, API keys, and database credentials. No secrets stored in environment variables or container images. Automatic secret rotation every 90 days.

All cryptographic modules used in Africgreen are FIPS 140-3 validated (certificates #4765, #4822). Cipher suites below TLS 1.3 are disabled at the load balancer. Export-grade, null, and RC4 cipher suites have never been enabled.

Technical implementation of audit immutability:

• Hash chaining: Each log entry includes the SHA-256 hash of the previous entry, forming a verifiable chain. Any tampering with a historical entry invalidates all subsequent hashes, making manipulation detectable immediately.
• Write-only audit API: The audit service exposes only a POST endpoint. No GET (read), PUT (update), or DELETE endpoint exists at the service level. Read access is via a separate read-only replica.
• Daily off-site backup: The full audit log is backed up daily to an air-gapped archive system at the Ministry of Justice. Backup integrity is verified by Ed25519 signatures.
• Chain integrity checks: An automated job runs every 6 hours to verify the integrity of the entire hash chain. Alerts are sent to the CISO and SMCA Director if any inconsistency is detected.
• Legal standing: The audit log has been accepted as admissible electronic evidence in Somaliland Commercial Court proceedings (Case SCC-2024-117). Its integrity is certified by the National Forensic Institute.

• DDoS Protection: Arbor Networks Sightline (hardware) + Cloudflare Magic Transit for volumetric attack mitigation. Tested capacity: up to 40 Gbps. Last DDoS incident: none recorded in 2024.
• WAF: ModSecurity with OWASP CRS v3.3.4 + custom rules for maritime API endpoints. Average false positive rate: 0.02%.
• Intrusion Detection/Prevention (IDS/IPS): Suricata deployed on all network segments. Signatures updated every 4 hours. Alerts trigger automated response playbooks (Shuffle SOAR).
• Zero-Trust Network Access (ZTNA): Administrative access to BER-DC1 infrastructure requires Cloudflare Access (ZTNA) with identity verification, even from internal VPN. Implemented Q4 2024.
• AIS Data Isolation: AIS receiver network is physically air-gapped from the internet. Data is transferred to the application network via a one-way data diode (Waterfall Security WF-500). No return path exists.
• BGP Security: SMCA AS number protected by RPKI (Route Origin Authorization). All BGP sessions use MD5 authentication and are filtered by prefix lists.

Africgreen operates a formal Vulnerability Management Program (VMP) compliant with ISO 27001:2022 Annex A.8.8:

• Continuous scanning: Automated vulnerability scanning runs daily on all containers (Trivy), dependencies (Dependabot + Snyk), and infrastructure (Tenable.io). Results are triaged within 24 hours.
• Patch SLAs: Critical — 24 hours; High — 7 days; Medium — 30 days; Low — 90 days. Emergency patching process exists for zero-days (target: 4 hours).
• Dependency management: Node.js and Go dependencies are pinned with lockfiles. All transitive dependencies are reviewed. npm audit and go mod verify run in CI/CD pipeline.
• Zero-day policy: Active threat intelligence feeds (CISA KEV, CERT-EU, AfricaCERT). The SMCA is a member of the AfricaCERT national coordination network.

The SMCA maintains a formal Incident Response Plan (IRP) aligned with NIST SP 800-61r3 and ISO/IEC 27035:2023. The plan is tested quarterly via tabletop exercises and annually via a full red team simulation.

Security improvements are tracked in the SMCA Information Security Continuous Improvement Log (ISCIL/2025) and reviewed monthly by the CISO, DPO, and SMCA Director. Progress is reported annually to the Ministry of Finance and included in the next edition of this public Security Audit report.