This repository contains a proof-of-concept demonstration of an agentic AI system for insurance claims processing and financial AML. The code is designed for educational and demonstration purposes.

This is a proof-of-concept demonstration. Before deploying to production, you MUST implement the following security measures:

• Replace ALL placeholder credentials with real values from a secure secrets management system
• NEVER commit credentials to version control
• Use AWS Secrets Manager, HashiCorp Vault, or similar for production credentials
• Implement automatic credential rotation
• Enable audit logging for secret access

Placeholder patterns used in this codebase:

• <API_KEY> - Replace with actual API keys
• <USERNAME> - Replace with actual usernames
• <PASSWORD> - Replace with actual passwords
• <AWS_ACCOUNT_ID> - Replace with your AWS account ID
• <MONGODB_PASSWORD> - Replace with secure MongoDB password

Files containing placeholders:

• applications/insurance-claims-processing/src/external_integrations/third_party_data_apis.py
• scripts/load-data.sh
• docs/DEPLOYMENT_GUIDE.md
• docs/PRODUCTION_DEPLOYMENT.md
• docs/SECRETS_MANAGEMENT.md

AWS Infrastructure:

• Enable S3 versioning and encryption at rest
• Add KMS encryption for CloudWatch logs
• Implement least-privilege IAM policies with condition-based access
• Add AWS WAF protection for Application Load Balancer
• Enable VPC Flow Logs for network monitoring
• Use AWS PrivateLink for sensitive service-to-service communication
• Enable GuardDuty for threat detection
• Configure AWS Config for compliance monitoring

Network Security:

• Implement Network Policies in Kubernetes to restrict pod-to-pod communication
• Use private subnets for all workload nodes
• Restrict security group rules to minimum required access
• Enable TLS 1.2+ for all external communications
• Implement API rate limiting and throttling

Pod Security Standards:

• Implement Kubernetes Pod Security Standards (restricted profile)
• All containers run as non-root users (already implemented)
• Read-only root filesystems enabled (already implemented)
• Privilege escalation disabled (already implemented)
• Drop all capabilities, add only required ones
• Use distroless or minimal base images
• Implement image scanning in CI/CD pipeline
• Sign and verify container images

Resource Management:

• Add resource limits and requests for all containers
• Implement Pod Disruption Budgets for high availability
• Configure proper liveness and readiness probes
• Use Vertical Pod Autoscaler for right-sizing

Security Contexts Implemented:

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true

These have been added to all deployment files:

• infrastructure/kubernetes/financial-aml-processing/aml-deployment.yaml
• infrastructure/kubernetes/mongodb-deployment.yaml
• infrastructure/kubernetes/ollama-deployment.yaml
• infrastructure/kubernetes/redis-deployment.yaml

Input Validation:

• Implement comprehensive input validation and sanitization
• Use parameterized queries to prevent injection attacks
• Validate file uploads and restrict file types
• Implement content security policies

Authentication & Authorization:

• Implement proper CSRF protection
• Use secure session management
• Implement multi-factor authentication for privileged users
• Use OAuth 2.0 or OIDC for authentication
• Implement role-based access control (RBAC)

Cryptography:

• Use cryptographically secure random number generators for production
• Implement proper encryption for data at rest and in transit
• Use strong encryption algorithms (AES-256, RSA-2048+)
• Implement secure key management

Error Handling:

• Implement proper error handling without exposing sensitive information
• Use structured logging with appropriate log levels
• Sanitize error messages sent to clients
• Log security-relevant events for audit trails

Logging:

• Enable comprehensive application and infrastructure logging
• Ship logs to centralized logging system (CloudWatch, ELK, Splunk)
• Set appropriate log retention policies (minimum 90 days for production)
• Implement log monitoring and alerting for security events
• Sanitize logs to prevent credential leakage

Metrics:

• Monitor resource usage (CPU, memory, network)
• Track application performance metrics
• Set up alerts for anomalous behavior
• Monitor failed authentication attempts
• Track API rate limits and quota usage

Tracing:

• Implement distributed tracing for request flows
• Enable AWS X-Ray or OpenTelemetry
• Monitor service dependencies and latency

Security Monitoring:

• Enable CloudTrail for API audit logging
• Configure AWS Security Hub for security posture management
• Set up SNS topics for critical security alerts
• Implement SIEM integration for security event correlation
• Regular vulnerability scanning of infrastructure and applications

Encryption:

• Enable encryption at rest for all data stores (MongoDB, S3, EBS)
• Use TLS/SSL for all data in transit
• Implement field-level encryption for sensitive PII/PHI data
• Use AWS KMS for key management with automatic rotation

Data Classification:

• Classify data based on sensitivity levels
• Implement data retention and deletion policies
• Ensure compliance with data protection regulations (GDPR, CCPA, HIPAA)
• Implement data masking for non-production environments

Backup and Recovery:

• Implement automated backup strategy for critical data
• Test backup restoration regularly
• Store backups in separate regions/accounts
• Encrypt all backups
• Define and test disaster recovery procedures

Audit Logging:

• Enable EKS audit logs
• Enable CloudTrail for all AWS API calls
• Log all secret access and rotation events
• Implement tamper-proof audit logs

Compliance:

• Regular security assessments and penetration testing
• Implement vulnerability scanning and patching processes
• Maintain compliance with relevant standards (SOC 2, PCI-DSS, etc.)
• Document security controls and procedures
• Conduct regular security training for developers

1. S3 Security:

   • Enable S3 versioning and object lock
   • Enable S3 encryption at rest with KMS
   • Block public access to S3 buckets
   • Enable S3 access logging
   • Implement lifecycle policies

2. CloudWatch Security:

   • Enable KMS encryption for CloudWatch logs
   • Set appropriate log retention (90+ days)
   • Create metric filters for security events
   • Set up CloudWatch alarms for critical events

3. IAM Best Practices:

   • Implement least-privilege policies
   • Use IAM roles instead of access keys
   • Enable MFA for privileged accounts
   • Regular access reviews and rotation
   • Use IAM conditions for fine-grained control

4. WAF Protection:

   • Deploy AWS WAF in front of ALB
   • Implement rate limiting rules
   • Block common attack patterns (SQL injection, XSS)
   • Enable AWS Shield for DDoS protection

1. Image Security:

   • Use minimal/distroless base images
   • Scan images for vulnerabilities in CI/CD
   • Sign images with Notary/Cosign
   • Use private ECR repositories
   • Enable ECR image scanning on push

2. Runtime Security:

   • Implement Pod Security Policies/Standards
   • Use Falco or similar for runtime threat detection
   • Enable seccomp and AppArmor profiles
   • Implement network policies
   • Regular security patching

3. Resource Management:

   • Add CPU and memory limits to prevent resource exhaustion
   • Implement Pod Disruption Budgets
   • Use Horizontal Pod Autoscaler for scaling
   • Set up resource quotas per namespace

1. CSRF Protection:

   • Implement anti-CSRF tokens
   • Use SameSite cookie attribute
   • Validate Origin and Referer headers

2. Input Validation:

   • Validate all user inputs
   • Sanitize data before processing
   • Use allow-lists instead of deny-lists
   • Implement proper file upload validation

3. Secure Coding:

   • Use parameterized queries for database access
   • Implement proper error handling
   • Avoid exposing stack traces to users
   • Use secure random generators (secrets module in Python)
   • Regular code security reviews

4. API Security:

   • Implement rate limiting
   • Use API keys or JWT for authentication
   • Validate all API requests
   • Implement proper CORS policies
   • Use HTTPS for all API endpoints

Before deploying to production, ensure you have completed:

• Replaced all placeholder credentials with actual secure values
• Configured AWS Secrets Manager or similar for credential storage
• Enabled encryption at rest for all data stores
• Enabled TLS/SSL for all communications
• Implemented least-privilege IAM policies
• Enabled VPC Flow Logs and CloudTrail
• Configured AWS WAF and Shield
• Implemented Pod Security Standards
• Enabled container image scanning
• Added resource limits to all pods
• Implemented comprehensive logging and monitoring
• Set up security alerting
• Conducted security assessment/penetration testing
• Documented security procedures
• Trained team on security best practices
• Implemented backup and disaster recovery procedures
• Enabled MFA for privileged accounts
• Regular security patching process in place
• Compliance requirements documented and met

If you discover a security vulnerability in this codebase, please report it responsibly:

1. Do NOT open a public GitHub issue
2. Email security details to the maintainers
3. Include steps to reproduce the vulnerability
4. Allow reasonable time for fixes before public disclosure

• AWS Security Best Practices
• Kubernetes Security Best Practices
• OWASP Top 10
• CIS Benchmarks
• NIST Cybersecurity Framework

This code is provided for demonstration purposes only. The authors and contributors make no warranties regarding the security or suitability of this code for production use. Users are solely responsible for ensuring appropriate security measures are implemented before deploying to production environments.

Last Updated: 2025-10-31 Version: 1.0