GeDefense

GeDefense - A Comprehensive Local Sovereign Linux Security Fabric

GeDefense is an advanced Linux Security Fabric designed to enhance system security through several key functionalities including kernel-near network defense, Host XDR (Extended Detection and Response), an encrypted evidence ledger, reversible system hardening, and GaiaOS-native isolation. Notably, it operates independent of any cloud control plane, ensuring complete local sovereignty and control over security measures.

Key Features

• Kernel-Near Network Defense: Provides robust, low-latency protection that operates close to the kernel level, effectively mitigating incoming threats before they reach critical system components.
• Host XDR: Enhances detection and response capabilities, offering a detailed view of suspicious activity directly on the host, which is often undetectable by traditional firewalls.
• Encrypted Evidence Ledger: All forensic data is securely logged and verifiable, utilizing advanced cryptographic techniques, facilitating incident response, and compliance.
• Reversible System Hardening: Enables safe system configuration changes, allowing administrators to revert modifications if necessary, significantly reducing operational risks.
• GaiaOS-Native Isolation: Ensures that security processes operate in an isolated manner, enhancing the security posture without external dependencies.

Current Release: Version 5.0.0-beta.2

The recent release includes several important updates and fixes, including:

• Enhanced deception canaries that act as active sensors within the kernel, detecting unauthorized access attempts.
• A verified Ed25519 pipeline for managing threat feeds, ensuring only legitimate data is applied to the system.
• Improved inline Layer 7 (L7) protections capable of blocking various attack vectors such as SQL injection and cross-site scripting at the ingress level.
• A detailed protection status report that accurately reflects the efficacy of security measures in place.

Note: This release is currently in public beta and should be used for testing and qualification purposes only. Operators are encouraged to review the SECURITY.md document and report any issues through GitHub.

GeDefense Titan

GeDefense Titan is the specialized module within GeDefense that focuses on unauthorized file manipulation defenses. By not attributing actions to specific actors, it emphasizes evaluating changes for authorization and establishing a robust response based on evidence.

• Monitors and reacts to file changes, maintaining strict policies on what constitutes authorized modifications.
• Supports insightful tracking of integrity states and policy enforcement modes for enhanced security oversight.

Designed for Security Researchers and System Administrators

GeDefense is engineered for secure environments requiring utmost transparency and verifiability. Its extensive architecture is documented in detail through ARCHITECTURE.md, ensuring that every claim made by the system can be independently verified, fundamentally supporting a zero-trust approach.

Testing and Verification

GeDefense offers a full suite for automated testing that can be executed locally, promoting confidence in the software's integrity and operational security. Each operator can ensure thorough validation through extensive documentation and scripts provided with the release.

Conclusion

GeDefense represents a significant advancement in Linux security, combining multiple dimensions of protection into a cohesive framework. Its focus on local sovereignty, encryption, and advanced incident response sets it apart as a formidable tool for securing systems against an evolving threat landscape.