Skip to content

📋 RedeDor Security Audit - File Manifest & Summary

Generated: 2026-02-26 22:58 UTC Location: /home/rx/lab/scan-dor/ Total Files: 9 Total Size: ~105 KB

📁 Complete File Listing

1. 00-INDEX.txt (Quick Reference)

  • Purpose: ASCII text index for quick navigation
  • Size: ~4 KB
  • Content:
  • File map and sizes
  • Quick start by role
  • Critical actions checklist
  • Key findings summary
  • Timelines and contacts
  • Audience: Everyone (first file to read after executive summary)

2. 01-executive-summary.md (C-Level Brief)

  • Purpose: Executive summary for decision makers
  • Size: 7.8 KB
  • Content:
  • 2-page overview of compromise
  • 6 critical findings
  • Attack timeline
  • Data breach implications
  • Immediate recommendations
  • Cost of inaction
  • Action checklist
  • Audience: CISO, CTO, CFO, Legal, Board
  • Read Time: 5 minutes
  • Decision: CEO can decide whether to notify regulators based on this

3. 02-attack-chain.md (Technical Attack Flow)

  • Purpose: Detailed attack chain with Mermaid diagram
  • Size: 6.3 KB
  • Content:
  • Flowchart of attack progression
  • 7 phases from initial access to full compromise
  • Credential flow diagram
  • Table of credentials by severity
  • Phase-by-phase analysis
  • Immediate recommendations
  • Audience: Security team, Incident Response, Engineering leadership
  • Diagram: Mermaid flowchart (interactive)
  • Key Finding: Shows how PAT Token → git history → MSAL Dev → 344 apps

4. 03-azure-ad-apps.md (Azure AD Ecosystem)

  • Purpose: Map of 344 Azure AD apps with secrets
  • Size: 9.1 KB
  • Content:
  • Network graph of app relationships
  • Tier 1: Comprometidas (Portal Dev, Portal Prod, PAT-Token-Manager)
  • Tier 2: Muito alta criticidade (APEX, CyberArk, Key Vault)
  • Tier 3: Média criticidade (Neoh, APISul, etc.)
  • Cadeia de comprometimento flowchart
  • Matriz de risco
  • Remediação checklist
  • Audience: Azure AD Admin, Security team, App owners
  • Diagram: Mermaid graph showing 344 apps and relationships
  • Key Finding: Key Vault Manager (1cd22fa9) has access to ALL 344 secrets

5. 04-infrastructure-map.md (System Architecture)

  • Purpose: Complete infrastructure map showing all systems
  • Size: 12 KB
  • Content:
  • Detailed architecture diagram (Mermaid)
  • Azure AD Tenant overview
  • Azure DevOps repositories (6 repos, 6,991 commits)
  • AWS Account 282525845483 (gestao-de-identidade)
  • AWS Account 485245438221 (portal-backend)
  • AWS Account 527905719568 (cinemed-prd)
  • RDS instances and databases
  • External services (ServiceNow, Cognito, CRM, APEX)
  • Attack flow visualization
  • System breakdown by component
  • Critical exposure points
  • Audience: Infrastructure team, DevOps, Cloud architects, CTO
  • Diagram: Mermaid graph showing all systems and data flows
  • Key Finding: TOKEN_SECRET duplicated across 2 AWS accounts

6. 05-secrets-graph.md (Credential Analysis)

  • Purpose: Detailed analysis of each secret and relationships
  • Size: 18 KB
  • Content:
  • Network graph of 15+ secrets
  • Where each secret was found
  • What each secret accesses
  • Timeline of expiration urgency
  • Blast radius analysis
  • Detailing of EACH secret (value, location, impact, action)
  • Dependency analysis (what breaks if rotated)
  • Prioritization matrix
  • Rotation timeline
  • Audience: Security team, Backend engineers, Database admins
  • Diagram: Mermaid graph showing secret relationships
  • Key Finding: 3 secrets expire TOMORROW - APEX iC_ expires TODAY

7. 06-remediation-plan.md (Action Plan)

  • Purpose: Step-by-step remediation instructions
  • Size: 24 KB (LARGEST - Most detailed)
  • Content:
  • Phase 1: Lockdown Immediate (Hours 0-2) - Revoke secrets
  • Phase 2: Secret Rotation (Hours 2-24) - Rotate each secret with detailed steps
  • Phase 3: Git History Remediation (Hours 24-72) - TruffleHog + force-push
  • Phase 4: Infrastructure Hardening (Days 3-30) - Security policies
  • Phase 5: Detection & Response (Ongoing) - Monitoring rules & playbook
  • Verification checklist
  • Timeline summary
  • Audience: Incident Response team, Ops, Engineering
  • Scripts: Bash examples for RDS, git cleanup, TruffleHog
  • Key Feature: Exact actionable steps, timelines, impact assessment, rollback plans

8. README.md (Navigation & Context)

  • Purpose: Main entry point - explains all documents
  • Size: 8 KB
  • Content:
  • Document roadmap
  • Navigation guide by role
  • Summary of findings
  • Critical actions for today
  • Lessons learned
  • Next steps
  • File manifest
  • Audience: Anyone (first file to read)

9. MANIFEST.md (This File)

  • Purpose: Metadata about all files
  • Size: This file (~3 KB)
  • Content:
  • Summary of all files
  • File purposes and sizes
  • Recommended reading order
  • Quick statistics

📊 Statistics

Metric Count
Total Files 9
Total Size ~105 KB
Total Diagrams 12+ (Mermaid)
Credentials Found 15+
Systems Compromised 7 (Azure AD, DevOps, 3x AWS, RDS, Medical pipeline)
Azure AD Apps 344
Git Repositories 6
Total Commits Scanned 6,991+
Secrets Requiring Rotation 15
Critical Actions (TODAY) 4
Remediation Phases 5

For C-Level Executives (10 minutes)

  1. 00-INDEX.txt - Orientation (2 min)
  2. 01-executive-summary.md - Decision making (5 min)
  3. Skim: 02-attack-chain.md (3 min)

For Security Team (1-2 hours)

  1. 00-INDEX.txt - Orientation
  2. 01-executive-summary.md - Context
  3. 02-attack-chain.md - Attack flow
  4. 05-secrets-graph.md - Credential analysis
  5. 06-remediation-plan.md - Implementation (focus on Phase 1-2)

For Engineering/DevOps (2-3 hours)

  1. 00-INDEX.txt - Orientation
  2. 04-infrastructure-map.md - Your systems
  3. 05-secrets-graph.md - Your secrets
  4. 06-remediation-plan.md - Your tasks (Phase 2-3)
  5. 03-azure-ad-apps.md - Apps you use

For Cloud Admins (2-3 hours)

  1. 00-INDEX.txt - Orientation
  2. 03-azure-ad-apps.md - Azure AD overview
  3. 04-infrastructure-map.md - AWS accounts + RDS
  4. 06-remediation-plan.md - Your tasks (Phase 4-5)

For Legal/Compliance (30 minutes)

  1. 01-executive-summary.md - Data exposure summary
  2. Skim: 04-infrastructure-map.md - Patient data access
  3. Read: 06-remediation-plan.md Phase 5 - Notification timeline

🎯 Key Findings Quick Reference

Severity Breakdown

  • 🔴 CRÍTICA: 6 findings (require IMMEDIATE action)
  • 🟠 ALTA: 5+ findings (rotate within 24-48h)
  • 🟡 EXPIRADO: 2 findings (historical analysis needed)

Systems Affected

  • ✅ Azure AD: 344 apps with secrets
  • ✅ Azure DevOps: 6 repos, 6,991+ commits
  • ✅ AWS: 3 accounts compromised
  • ✅ Databases: RDS with patient identities exposed
  • ✅ Medical Pipeline: LGPD/HIPAA violation risk

Credentials Count by Category

Category Count Timeline
CRÍTICA (Revoke NOW) 6 TODAY
ALTA (Rotate 24-48h) 7 Next 48h
EXPIRADO (Analyze) 2 Historical
TOTAL 15+ Immediate

🔥 Action Items Summary

Priority Action Owner Timeline Document
🔴 Revoke MSAL Dev Azure AD Admin NOW (2h) 06-remediation (1.1)
🔴 Revoke APEX iC_ APEX Admin NOW (expires today!) 06-remediation (1.2)
🔴 Revoke PAT Token DevOps Admin NOW (2h) 06-remediation (1.3)
🔴 Rotate TOKEN_SECRET Backend Team 24h 06-remediation (2.1)
🔴 Rotate MSAL Prod Azure AD + Backend 24h 06-remediation (2.2)
🔴 Rotate RDS Creds DBA 48h 06-remediation (2.3)
🟠 Git history scan Security Team 24h 06-remediation (3.1)
🟠 Git rewrite (force-push) Git Admin 72h 06-remediation (3.2)
🟠 Rotate remaining secrets Various 48-72h 06-remediation (2.4-2.5)
🟠 Enable monitoring Security/Ops 2-24h 06-remediation (1.5)

📌 Critical Deadlines

  • TODAY (2026-02-26): Revoke 3 critical secrets
  • TODAY + 24h (2026-02-27): Rotate 5 major secrets
  • TODAY + 48h (2026-02-28): Complete rotating all exposed secrets
  • TODAY + 72h (2026-03-02): Git history rewrite
  • TODAY + 7 days (2026-03-05): All systems operational with new secrets
  • TODAY + 30 days (2026-03-28): Infrastructure hardening complete

🛡️ Post-Remediation Status

Once all phases are complete:

  • ✅ No credentials exposed in git history
  • ✅ All secrets rotated and centralized in Keyvault/Secrets Manager
  • ✅ CI/CD secret scanning enabled
  • ✅ 90-day secret rotation policy implemented
  • ✅ Azure AD MFA for sensitive operations
  • ✅ AWS CloudTrail + Config enabled
  • ✅ Sentinel/SIEM monitoring active
  • ✅ Incident response playbook tested
  • ✅ Training completed for all teams

Target Risk Level: 🟡 MEDIUM (down from 🔴 CRÍTICA)

📞 Document Owners

Document Primary Owner Contact
00-INDEX.txt Security Team [Email]
01-executive-summary.md CISO [Email]
02-attack-chain.md Security Architect [Email]
03-azure-ad-apps.md Azure AD Admin [Email]
04-infrastructure-map.md Infrastructure Lead [Email]
05-secrets-graph.md Security Engineer [Email]
06-remediation-plan.md Incident Response Lead [Email]
README.md Security Team [Email]

⚠️ Confidentiality Notice

CLASSIFICATION: CONFIDENTIAL - Internal Use Only

DISTRIBUTION: - ✅ Authorized: CISO, CTO, Security, Legal, Compliance - ❌ Unauthorized: Public, media, social, unauthorized third parties

RETENTION: 90 days maximum after remediation completion

HANDLING: - Keep in secure storage (encrypted drive) - No email distribution (use Keyvault/secure portal) - No printing (except for CISO briefing) - Shred after retention period

📝 Document Version History

Version Date Changes
1.0 2026-02-26 Initial audit report
TBD TBD Updates during remediation

🎓 How to Use These Documents

If you're the CISO: - Read: 01-executive-summary.md - Make decision: Notify customers? Engage IR firm? - Approve: 06-remediation-plan.md timeline - Monitor: Weekly status updates from incident commander

If you're the Incident Commander: - Read: All documents (2-3 hours) - Create: War room + daily standups - Execute: 06-remediation-plan.md phases in order - Report: Daily updates to CISO

If you're an Engineer: - Read: Your role's section in README.md - Focus on: 06-remediation-plan.md your phase - Implement: Exact steps from remediation plan - Test: Verify each step before moving to next

If you're Legal/Compliance: - Read: 01-executive-summary.md + LGPD/HIPAA section - Assess: Data exposure scope - Prepare: Customer notification if required - Timeline: Review 06-remediation-plan.md timeline

✅ Verification Checklist

Before distributing to stakeholders:

  • [ ] All 9 files created and readable
  • [ ] Mermaid diagrams render correctly
  • [ ] No plaintext credentials exposed (only partial masks)
  • [ ] Timelines are realistic and coordinated
  • [ ] Contacts/escalation chains updated
  • [ ] Confidentiality notice on all files
  • [ ] CISO review + approval
  • [ ] Legal review (for data exposure statements)

📬 Distribution Plan

  1. Immediately (1h):

  2. 01-executive-summary.md → CISO, CTO, CFO, Legal

  3. Short-term (4h):

  4. Security docs → Security team

  5. 06-remediation-plan.md → Incident Response

  6. Medium-term (24h):

  7. Role-specific docs → Each team

  8. War room access → All incident responders

  9. Post-remediation:

  10. Public post-mortem (sanitized version)
  11. Lessons learned training

🔍 Audit Completeness

Documented: - ✅ 15+ credentials with exact details - ✅ 344 Azure AD apps enumerated - ✅ 3 AWS accounts mapped - ✅ 6 Git repos analyzed (6,991 commits) - ✅ Attack chain from PAT to full compromise - ✅ Detailed remediation plan (5 phases) - ✅ Monitoring recommendations - ✅ Timeline for executive visibility

Not Included (out of scope): - ❌ Live exploit demonstrations - ❌ Forensic analysis of previous breaches - ❌ Customer notification templates - ❌ Insurance claim procedures

📊 Final Stats

Metric Value
Audit Depth COMPREHENSIVE
Credential Exposure 15+ found
System Compromise Complete
Remediation Effort 2-4 weeks
Estimated Cost 50K-200K EUR
Data at Risk Medical (LGPD violation)
Business Impact HIGH
Regulatory Impact HIGH
Incident Severity CRÍTICA

Document Generated: 2026-02-26 22:58 UTC Status: ACTIVE - IMMEDIATE REMEDIATION REQUIRED Next Review: Daily during remediation (Phases 1-5)

For questions or clarifications, contact your Incident Response Lead.

Remember: SPEED MATTERS - Every hour counts in an active security incident.