Security & Compliance
Relevant source files
The following files were used as context for generating this wiki page:
Horizon implements a defense-in-depth security model designed to provide organizations with complete control over their IT asset data while maintaining high standards of data integrity and confidentiality. The system architecture emphasizes cryptographic rigor, secure communication, and automated compliance assessment to mitigate risks associated with IT infrastructure management.
The security framework encompasses multiple layers, including encryption at rest and in transit, robust authentication mechanisms (JWT and MFA), role-based access control (RBAC), and automated security configuration auditing against industry standards like CIS Benchmarks.
Sources: README.md:189-200, IMPLEMENTATION_PLAN.md:104-124
Cryptographic Standards
Horizon utilizes the RustCrypto ecosystem to implement modern cryptographic best practices. The project strictly avoids legacy algorithms in favor of high-performance, constant-time implementations that provide resistance against common side-channel attacks.
Symmetric and Asymmetric Operations
- Password Hashing: Argon2id is used for password storage to provide GPU/ASIC resistance.
- Symmetric Encryption: XChaCha20-Poly1305 (256-bit) is employed for sensitive data at rest and message encryption.
- Digital Signatures: Ed25519 is used for bidirectional message signing between agents and the server.
- Key Exchange: X25519 is utilized for establishing forward secrecy in communications.
- Hashing: BLAKE3 is the primary hashing algorithm for general data integrity and HMAC-BLAKE3 for message authentication codes. SHA3-256/512 is available for backup hashing requirements.
Sources: IMPLEMENTATION_PLAN.md:104-124, Cargo.toml:48-69, AGENTS.md:154-159
Secure Memory Management
To prevent sensitive data from leaking via memory dumps or swap files, the project implements the zeroize crate. This ensures that cryptographic keys and plaintext secrets are securely cleared from memory immediately after use.
Sources: IMPLEMENTATION_PLAN.md:118, Cargo.toml:72
Authentication and Authorization
The system employs a multi-tiered authentication strategy to verify identities and enforce the principle of least privilege through Role-Based Access Control (RBAC).
Identity Management
- JWT Tokens: Authentication is handled via JSON Web Tokens with support for session management in Redis, including token blacklisting.
- Multi-Factor Authentication (MFA): TOTP-based MFA is implemented using the
totp-rscrate, including support for backup codes. - API Keys: Users can generate scoped API keys with prefix-based hashing and expiration dates for programmatic access.
Sources: IMPLEMENTATION_PLAN.md:197-230, Cargo.toml:75-76
Access Control Logic
The RBAC system defines roles with specific permissions that can be scoped to different levels (e.g., system-wide or team-specific).
This diagram illustrates the relationships between users, roles, and teams within the authorization framework.
Sources: IMPLEMENTATION_PLAN.md:184-194
Secure Agent Communication
The Horizon agent is a lightweight component designed for secure data collection. Communication between agents and the central server is strictly controlled using Mutual TLS (mTLS).
mTLS and Message Flow
- Certificate Issuance: The server acts as a Certificate Authority (CA) using the
rcgencrate to issue unique certificates to agents during registration. - Mutual Authentication: Both the client (agent) and server verify each other's certificates before establishing a connection.
- Signed Payloads: In addition to TLS encryption, every message is signed using Ed25519 to ensure non-repudiation and integrity.
The sequence shows the secure registration and subsequent encrypted communication flow.
Sources: IMPLEMENTATION_PLAN.md:477-495, README.md:193
Compliance and Vulnerability Management
Horizon automates the assessment of IT assets against security benchmarks and tracks potential exposures through integrated vulnerability management.
Security Configuration Assessment
The system supports CIS Benchmarks to validate infrastructure configurations. An assessment engine compares collected agent data against predefined baseline rules to calculate compliance scores and identify configuration drift.
| Component | Description |
|---|---|
| Baseline Rules | Definitions of "secure" states based on industry standards. |
| Drift Detection | Real-time monitoring of changes away from the established baseline. |
| Remediation | AI-powered guidance for fixing identified security violations. |
Sources: IMPLEMENTATION_PLAN.md:377-400, README.md:73-77
Vulnerability Correlation
Horizon synchronizes with the National Vulnerability Database (NVD) to correlate CVEs with detected software installations. It also integrates findings from:
- Penetration Testing: Tracking engagements, findings, and remediation status.
- Red Team Operations: Mapping techniques to the MITRE ATT&CK framework and tracking Indicators of Compromise (IOC).
Sources: IMPLEMENTATION_PLAN.md:405-430, README.md:83-88
Error Handling and Audit Logging
Security-relevant events are captured through a structured error handling and logging system.
Categorized Error Codes
The error crate defines specific categories to distinguish between client-side mistakes, server failures, and security-related issues (Authentication/Authorization).
| Category | Description | HTTP Status |
|---|---|---|
Authentication | Failures related to tokens, credentials, or MFA. | 401 Unauthorized |
Authorization | Failures where a user lacks permissions for an action. | 403 Forbidden |
Validation | Input data that fails to meet security/format constraints. | 422 Unprocess. Entity |
Database | Internal persistence errors (Log-only, details hidden). | 500 Internal Error |
Sources: crates/error/src/codes.rs:16-160
Audit Trails
Every significant operation is logged via the tracing infrastructure. For internal or database errors, sensitive details are hidden from the API response but recorded in the server logs with unique error_id references for debugging.
Sources: crates/error/src/codes.rs:215-265, AGENTS.md:160
Summary
The Horizon security architecture is built on the principle of "Self-Hostable Sovereignty," ensuring that all sensitive cryptographic keys and asset data remain under the organization's control. By combining the safety of Rust, the rigor of RustCrypto, and automated compliance mapping, Horizon provides a secure foundation for IT infrastructure visibility.