project initialization

backend/security/middleware.py

@@ -0,0 +1,806 @@
+"""
+Security middleware for comprehensive protection.
+Implements Malaysian data protection and security best practices.
+"""
+
+import re
+import json
+import logging
+import time
+from datetime import datetime, timedelta
+from typing import Dict, List, Any, Optional, Tuple
+from django.conf import settings
+from django.http import HttpRequest, HttpResponse, JsonResponse
+from django.core.cache import cache
+from django.contrib.auth import get_user_model
+from django.utils import timezone
+from django.utils.crypto import get_random_string
+from django.middleware.security import SecurityMiddleware as DjangoSecurityMiddleware
+from django.middleware.clickjacking import XFrameOptionsMiddleware
+from django.middleware.csrf import CsrfViewMiddleware
+from django.views.decorators.csrf import csrf_exempt
+from django.utils.deprecation import MiddlewareMixin
+from prometheus_client import Counter, Histogram, Gauge
+import redis
+
+logger = logging.getLogger(__name__)
+User = get_user_model()
+
+# Security metrics
+SECURITY_EVENTS = Counter(
+    'security_events_total',
+    'Security events',
+    ['event_type', 'severity', 'ip_address', 'user_agent', 'tenant']
+)
+
+RATE_LIMIT_EVENTS = Counter(
+    'rate_limit_events_total',
+    'Rate limit events',
+    ['type', 'ip_address', 'endpoint', 'tenant']
+)
+
+MALAYSIAN_DATA_ACCESS = Counter(
+    'malaysian_data_access_total',
+    'Malaysian data access events',
+    ['data_type', 'operation', 'user_role', 'tenant']
+)
+
+THREAT_DETECTION = Counter(
+    'threat_detection_total',
+    'Threat detection events',
+    ['threat_type', 'confidence', 'ip_address', 'tenant']
+)
+
+class SecurityHeadersMiddleware(MiddlewareMixin):
+    """Enhanced security headers middleware."""
+
+    def process_response(self, request: HttpRequest, response: HttpResponse) -> HttpResponse:
+        """Add comprehensive security headers."""
+        # Security headers
+        response['X-Content-Type-Options'] = 'nosniff'
+        response['X-Frame-Options'] = 'DENY'
+        response['X-XSS-Protection'] = '1; mode=block'
+        response['Referrer-Policy'] = 'strict-origin-when-cross-origin'
+        response['Permissions-Policy'] = self._get_permissions_policy()
+        response['Content-Security-Policy'] = self._get_csp(request)
+        response['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains; preload'
+
+        # Malaysian data protection headers
+        response['X-Malaysian-Data-Protection'] = 'PDPA-Compliant'
+        response['X-Data-Residency'] = 'Malaysia'
+
+        # Remove sensitive headers
+        sensitive_headers = ['Server', 'X-Powered-By', 'X-AspNet-Version']
+        for header in sensitive_headers:
+            if header in response:
+                del response[header]
+
+        return response
+
+    def _get_permissions_policy(self) -> str:
+        """Get permissions policy."""
+        policies = [
+            'accelerometer=()',
+            'ambient-light-sensor=()',
+            'battery=()',
+            'bluetooth=()',
+            'camera=()',
+            'cross-origin-isolated=()',
+            'display-capture=()',
+            'document-domain=()',
+            'encrypted-media=()',
+            'execution-while-not-rendered=()',
+            'execution-while-out-of-viewport=()',
+            'focus-without-user-activation=()',
+            'fullscreen=()',
+            'geolocation=()',
+            'gyroscope=()',
+            'hid=()',
+            'identity-credentials-get=()',
+            'idle-detection=()',
+            'local-fonts=()',
+            'magnetometer=()',
+            'microphone=()',
+            'midi=()',
+            'otp-credentials=()',
+            'payment=()',
+            'picture-in-picture=()',
+            'publickey-credentials-get=()',
+            'screen-wake-lock=()',
+            'serial=()',
+            'storage-access=()',
+            'usb=()',
+            'web-share=()',
+            'window-management=()',
+            'xr-spatial-tracking=()'
+        ]
+        return ', '.join(policies)
+
+    def _get_csp(self, request: HttpRequest) -> str:
+        """Get Content Security Policy."""
+        # Base CSP
+        csp = [
+            "default-src 'self'",
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://www.google.com https://www.gstatic.com",
+            "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com",
+            "img-src 'self' data: https: https://*.malaysian-sme-platform.com",
+            "font-src 'self' https://fonts.gstatic.com https://fonts.googleapis.com",
+            "connect-src 'self' https://api.malaysian-sme-platform.com wss://api.malaysian-sme-platform.com",
+            "frame-ancestors 'none'",
+            "form-action 'self'",
+            "base-uri 'self'",
+            "require-trusted-types-for 'script'",
+            "report-uri /api/security/csp-report/",
+        ]
+
+        # Add development-specific policies
+        if settings.DEBUG:
+            csp[1] = csp[1].replace("'unsafe-inline'", "'unsafe-inline' 'unsafe-eval'")
+            csp.append("upgrade-insecure-requests")
+
+        return '; '.join(csp)
+
+class RateLimitingMiddleware(MiddlewareMixin):
+    """Advanced rate limiting middleware with Malaysian considerations."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self.redis_client = self._get_redis_client()
+        self.limits = self._get_rate_limits()
+
+    def process_request(self, request: HttpRequest) -> Optional[HttpResponse]:
+        """Process request for rate limiting."""
+        if self._should_skip_rate_limiting(request):
+            return None
+
+        ip_address = self._get_client_ip(request)
+        user_id = self._get_user_id(request)
+        endpoint = self._get_endpoint(request)
+        tenant = self._get_tenant_info(request)
+
+        # Check all applicable limits
+        for limit_type, limit_config in self.limits.items():
+            if self._should_apply_limit(request, limit_type):
+                limited = self._check_rate_limit(
+                    ip_address, user_id, endpoint, tenant, limit_type, limit_config
+                )
+
+                if limited:
+                    return self._create_rate_limit_response(limit_type, limit_config)
+
+        return None
+
+    def _get_redis_client(self):
+        """Get Redis client for rate limiting."""
+        try:
+            return redis.from_url(settings.REDIS_URL)
+        except Exception:
+            logger.warning("Redis not available for rate limiting")
+            return None
+
+    def _get_rate_limits(self) -> Dict[str, Dict[str, Any]]:
+        """Get rate limit configurations."""
+        return {
+            'api': {
+                'requests': 1000,
+                'window': 3600,  # 1 hour
+                'scope': 'ip',
+                'message': 'API rate limit exceeded'
+            },
+            'login': {
+                'requests': 5,
+                'window': 300,  # 5 minutes
+                'scope': 'ip',
+                'message': 'Too many login attempts'
+            },
+            'malaysian_data': {
+                'requests': 100,
+                'window': 3600,  # 1 hour
+                'scope': 'user',
+                'message': 'Malaysian data access rate limit exceeded'
+            },
+            'file_upload': {
+                'requests': 50,
+                'window': 3600,  # 1 hour
+                'scope': 'user',
+                'message': 'File upload rate limit exceeded'
+            },
+            'sensitive_operations': {
+                'requests': 10,
+                'window': 3600,  # 1 hour
+                'scope': 'user',
+                'message': 'Sensitive operations rate limit exceeded'
+            },
+        }
+
+    def _should_skip_rate_limiting(self, request: HttpRequest) -> bool:
+        """Check if request should skip rate limiting."""
+        # Skip for health checks and static files
+        skip_paths = ['/health/', '/metrics/', '/static/']
+        if any(request.path.startswith(path) for path in skip_paths):
+            return True
+
+        # Skip for authenticated staff users
+        if hasattr(request, 'user') and request.user.is_authenticated and request.user.is_staff:
+            return True
+
+        return False
+
+    def _get_client_ip(self, request: HttpRequest) -> str:
+        """Get client IP address with proxy support."""
+        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+        if x_forwarded_for:
+            ip = x_forwarded_for.split(',')[0].strip()
+        else:
+            ip = request.META.get('REMOTE_ADDR', 'unknown')
+
+        # Handle IPv6 loopback
+        if ip == '::1':
+            ip = '127.0.0.1'
+
+        return ip
+
+    def _get_user_id(self, request: HttpRequest) -> Optional[str]:
+        """Get user ID for rate limiting."""
+        if hasattr(request, 'user') and request.user.is_authenticated:
+            return str(request.user.id)
+        return None
+
+    def _get_endpoint(self, request: HttpRequest) -> str:
+        """Get endpoint for rate limiting."""
+        return request.path
+
+    def _get_tenant_info(self, request: HttpRequest) -> Dict[str, Any]:
+        """Get tenant information."""
+        if hasattr(request, 'tenant') and request.tenant:
+            return {
+                'id': request.tenant.id,
+                'name': request.tenant.name,
+                'schema': request.tenant.schema_name
+            }
+        return {'id': None, 'name': 'public', 'schema': 'public'}
+
+    def _should_apply_limit(self, request: HttpRequest, limit_type: str) -> bool:
+        """Check if limit should be applied to request."""
+        if limit_type == 'api' and request.path.startswith('/api/'):
+            return True
+        elif limit_type == 'login' and '/login' in request.path:
+            return True
+        elif limit_type == 'malaysian_data' and self._is_malaysian_data_endpoint(request):
+            return True
+        elif limit_type == 'file_upload' and request.method == 'POST' and 'upload' in request.path:
+            return True
+        elif limit_type == 'sensitive_operations' and self._is_sensitive_operation(request):
+            return True
+
+        return False
+
+    def _is_malaysian_data_endpoint(self, request: HttpRequest) -> bool:
+        """Check if endpoint accesses Malaysian data."""
+        malaysian_endpoints = [
+            '/api/malaysian/',
+            '/api/ic-validation/',
+            '/api/sst/',
+            '/api/postcode/',
+            '/api/business-registration/',
+        ]
+        return any(request.path.startswith(endpoint) for endpoint in malaysian_endpoints)
+
+    def _is_sensitive_operation(self, request: HttpRequest) -> bool:
+        """Check if operation is sensitive."""
+        sensitive_operations = [
+            '/api/users/',
+            '/api/tenants/',
+            '/api/admin/',
+            '/api/payments/',
+            '/api/export/',
+        ]
+        return any(request.path.startswith(op) for op in sensitive_operations)
+
+    def _check_rate_limit(
+        self,
+        ip_address: str,
+        user_id: Optional[str],
+        endpoint: str,
+        tenant: Dict[str, Any],
+        limit_type: str,
+        limit_config: Dict[str, Any]
+    ) -> bool:
+        """Check if rate limit is exceeded."""
+        if not self.redis_client:
+            return False
+
+        # Generate key based on scope
+        if limit_config['scope'] == 'user' and user_id:
+            key = f"rate_limit:{limit_type}:{user_id}:{tenant['id']}"
+        else:
+            key = f"rate_limit:{limit_type}:{ip_address}:{tenant['id']}"
+
+        # Check current count
+        current_count = self.redis_client.get(key)
+        if current_count is None:
+            current_count = 0
+        else:
+            current_count = int(current_count)
+
+        # Check if limit exceeded
+        if current_count >= limit_config['requests']:
+            RATE_LIMIT_EVENTS.labels(
+                type=limit_type,
+                ip_address=ip_address,
+                endpoint=endpoint,
+                tenant=tenant.get('name', 'unknown')
+            ).inc()
+
+            SECURITY_EVENTS.labels(
+                event_type='rate_limit_exceeded',
+                severity='warning',
+                ip_address=ip_address,
+                user_agent=request.META.get('HTTP_USER_AGENT', 'unknown'),
+                tenant=tenant.get('name', 'unknown')
+            ).inc()
+
+            return True
+
+        # Increment counter
+        self.redis_client.incr(key)
+        self.redis_client.expire(key, limit_config['window'])
+
+        return False
+
+    def _create_rate_limit_response(self, limit_type: str, limit_config: Dict[str, Any]) -> JsonResponse:
+        """Create rate limit response."""
+        response_data = {
+            'error': limit_config['message'],
+            'type': 'rate_limit_exceeded',
+            'retry_after': limit_config['window'],
+            'limit_type': limit_type
+        }
+
+        return JsonResponse(response_data, status=429)
+
+class InputValidationMiddleware(MiddlewareMixin):
+    """Input validation and sanitization middleware."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self.suspicious_patterns = self._get_suspicious_patterns()
+        self.max_input_size = getattr(settings, 'MAX_INPUT_SIZE', 1024 * 1024)  # 1MB
+
+    def process_request(self, request: HttpRequest) -> Optional[HttpResponse]:
+        """Validate and sanitize input."""
+        # Check input size
+        if not self._check_input_size(request):
+            return JsonResponse(
+                {'error': 'Request size too large'},
+                status=413
+            )
+
+        # Validate input for POST/PUT/PATCH
+        if request.method in ['POST', 'PUT', 'PATCH']:
+            if not self._validate_input(request):
+                return JsonResponse(
+                    {'error': 'Invalid input detected'},
+                    status=400
+                )
+
+        return None
+
+    def _get_suspicious_patterns(self) -> List[re.Pattern]:
+        """Get suspicious input patterns."""
+        patterns = [
+            # SQL injection
+            re.compile(r'(?i)\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|EXEC|ALTER|CREATE|TRUNCATE)\b.*\b(FROM|INTO|TABLE|DATABASE)\b'),
+            re.compile(r'(?i)\b(OR\s+1\s*=\s*1|OR\s+TRUE|AND\s+1\s*=\s*1)\b'),
+            re.compile(r'(?i)\b(WAITFOR\s+DELAY|SLEEP\(|PG_SLEEP\(|BENCHMARK\()\b'),
+
+            # XSS
+            re.compile(r'(?i)<(script|iframe|object|embed|form|input)\b.*?>'),
+            re.compile(r'(?i)javascript:'),
+            re.compile(r'(?i)on\w+\s*='),
+            re.compile(r'(?i)(eval|Function|setTimeout|setInterval)\s*\('),
+
+            # Path traversal
+            re.compile(r'\.\./'),
+            re.compile(r'(?i)\b(/etc|/var|/usr|/home)/'),
+            re.compile(r'(?i)\.(htaccess|htpasswd|env)\b'),
+
+            # Command injection
+            re.compile(r'(?i);\s*(rm|ls|cat|pwd|whoami|id|ps|netstat|curl|wget)\s'),
+            re.compile(r'(?i)\|(\s*)(rm|ls|cat|pwd|whoami|id|ps|netstat|curl|wget)\s'),
+            re.compile(r'(?i)&(\s*)(rm|ls|cat|pwd|whoami|id|ps|netstat|curl|wget)\s'),
+
+            # NoSQL injection
+            re.compile(r'(?i)\$where\b'),
+            re.compile(r'(?i)\b(db\.eval|mapReduce|group)\b'),
+
+            # LDAP injection
+            re.compile(r'(?i)\*\)\)(\|\()'),
+            re.compile(r'(?i)\)\)(\|\()'),
+
+            # XML injection
+            re.compile(r'<!ENTITY\s+'),
+            re.compile(r'<\?xml\s+'),
+        ]
+
+        return patterns
+
+    def _check_input_size(self, request: HttpRequest) -> bool:
+        """Check if request size is within limits."""
+        # Check GET parameters
+        for key, value in request.GET.items():
+            if len(str(value)) > self.max_input_size:
+                return False
+
+        # Check POST data
+        if hasattr(request, 'POST'):
+            for key, value in request.POST.items():
+                if len(str(value)) > self.max_input_size:
+                    return False
+
+        # Check JSON body
+        if hasattr(request, 'body') and request.body:
+            if len(request.body) > self.max_input_size:
+                return False
+
+        return True
+
+    def _validate_input(self, request: HttpRequest) -> bool:
+        """Validate request input for malicious patterns."""
+        ip_address = self._get_client_ip(request)
+        user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+        tenant = self._get_tenant_info(request)
+
+        # Check GET parameters
+        for key, value in request.GET.items():
+            if self._contains_suspicious_pattern(str(value)):
+                SECURITY_EVENTS.labels(
+                    event_type='suspicious_input',
+                    severity='warning',
+                    ip_address=ip_address,
+                    user_agent=user_agent,
+                    tenant=tenant.get('name', 'unknown')
+                ).inc()
+                return False
+
+        # Check POST data
+        if hasattr(request, 'POST'):
+            for key, value in request.POST.items():
+                if self._contains_suspicious_pattern(str(value)):
+                    SECURITY_EVENTS.labels(
+                        event_type='suspicious_input',
+                        severity='warning',
+                        ip_address=ip_address,
+                        user_agent=user_agent,
+                        tenant=tenant.get('name', 'unknown')
+                    ).inc()
+                    return False
+
+        # Check JSON body
+        if hasattr(request, 'body') and request.body:
+            try:
+                body_str = request.body.decode('utf-8')
+                if self._contains_suspicious_pattern(body_str):
+                    SECURITY_EVENTS.labels(
+                        event_type='suspicious_input',
+                        severity='warning',
+                        ip_address=ip_address,
+                        user_agent=user_agent,
+                        tenant=tenant.get('name', 'unknown')
+                    ).inc()
+                    return False
+            except UnicodeDecodeError:
+                SECURITY_EVENTS.labels(
+                    event_type='invalid_encoding',
+                    severity='warning',
+                    ip_address=ip_address,
+                    user_agent=user_agent,
+                    tenant=tenant.get('name', 'unknown')
+                ).inc()
+                return False
+
+        return True
+
+    def _contains_suspicious_pattern(self, input_str: str) -> bool:
+        """Check if input contains suspicious patterns."""
+        for pattern in self.suspicious_patterns:
+            if pattern.search(input_str):
+                return True
+        return False
+
+    def _get_client_ip(self, request: HttpRequest) -> str:
+        """Get client IP address."""
+        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+        if x_forwarded_for:
+            return x_forwarded_for.split(',')[0].strip()
+        return request.META.get('REMOTE_ADDR', 'unknown')
+
+    def _get_tenant_info(self, request: HttpRequest) -> Dict[str, Any]:
+        """Get tenant information."""
+        if hasattr(request, 'tenant') and request.tenant:
+            return {
+                'id': request.tenant.id,
+                'name': request.tenant.name,
+                'schema': request.tenant.schema_name
+            }
+        return {'id': None, 'name': 'public', 'schema': 'public'}
+
+class DataProtectionMiddleware(MiddlewareMixin):
+    """Malaysian data protection compliance middleware."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self.sensitive_data_fields = self._get_sensitive_data_fields()
+        self.required_consent_version = getattr(settings, 'REQUIRED_CONSENT_VERSION', '1.0')
+
+    def process_response(self, request: HttpRequest, response: HttpResponse) -> HttpResponse:
+        """Process response for data protection."""
+        # Add Malaysian data protection headers
+        response['X-Malaysian-Data-Protection'] = 'PDPA-Compliant'
+        response['X-Data-Residency'] = 'Malaysia'
+
+        # Log Malaysian data access
+        if self._is_malaysian_data_access(request):
+            self._log_malaysian_data_access(request)
+
+        # Sanitize response data
+        if hasattr(response, 'data') and isinstance(response.data, dict):
+            response.data = self._sanitize_response_data(response.data)
+
+        return response
+
+    def _get_sensitive_data_fields(self) -> List[str]:
+        """Get sensitive data fields that require protection."""
+        return [
+            'ic_number',
+            'passport_number',
+            'email',
+            'phone_number',
+            'address',
+            'bank_account',
+            'salary',
+            'business_registration_number',
+            'tax_id',
+        ]
+
+    def _is_malaysian_data_access(self, request: HttpRequest) -> bool:
+        """Check if request accesses Malaysian data."""
+        malaysian_endpoints = [
+            '/api/malaysian/',
+            '/api/ic-validation/',
+            '/api/sst/',
+            '/api/postcode/',
+            '/api/business-registration/',
+        ]
+
+        return any(request.path.startswith(endpoint) for endpoint in malaysian_endpoints)
+
+    def _log_malaysian_data_access(self, request: HttpRequest):
+        """Log Malaysian data access for compliance."""
+        user_role = 'anonymous'
+        if hasattr(request, 'user') and request.user.is_authenticated:
+            user_role = request.user.role
+
+        tenant = self._get_tenant_info(request)
+
+        # Determine data type
+        data_type = 'unknown'
+        if '/ic-validation/' in request.path:
+            data_type = 'ic_data'
+        elif '/sst/' in request.path:
+            data_type = 'tax_data'
+        elif '/postcode/' in request.path:
+            data_type = 'location_data'
+        elif '/business-registration/' in request.path:
+            data_type = 'business_data'
+
+        MALAYSIAN_DATA_ACCESS.labels(
+            data_type=data_type,
+            operation=request.method,
+            user_role=user_role,
+            tenant=tenant.get('name', 'unknown')
+        ).inc()
+
+    def _sanitize_response_data(self, data: Any) -> Any:
+        """Sanitize response data to remove sensitive information."""
+        if isinstance(data, dict):
+            sanitized = {}
+            for key, value in data.items():
+                if key.lower() in [field.lower() for field in self.sensitive_data_fields]:
+                    sanitized[key] = self._mask_sensitive_data(key, value)
+                else:
+                    sanitized[key] = self._sanitize_response_data(value)
+            return sanitized
+        elif isinstance(data, list):
+            return [self._sanitize_response_data(item) for item in data]
+        else:
+            return data
+
+    def _mask_sensitive_data(self, field: str, value: Any) -> str:
+        """Mask sensitive data for logging/display."""
+        if field.lower() in ['ic_number', 'passport_number']:
+            return value[:2] + '*' * (len(value) - 4) + value[-2:]
+        elif field.lower() in ['email']:
+            return value[:3] + '*' * (len(value.split('@')[0]) - 3) + '@' + value.split('@')[1]
+        elif field.lower() in ['phone_number']:
+            return value[:3] + '*' * (len(value) - 6) + value[-3:]
+        elif field.lower() in ['bank_account']:
+            return '*' * (len(value) - 4) + value[-4:]
+        else:
+            return '*' * len(str(value))
+
+    def _get_tenant_info(self, request: HttpRequest) -> Dict[str, Any]:
+        """Get tenant information."""
+        if hasattr(request, 'tenant') and request.tenant:
+            return {
+                'id': request.tenant.id,
+                'name': request.tenant.name,
+                'schema': request.tenant.schema_name
+            }
+        return {'id': None, 'name': 'public', 'schema': 'public'}
+
+class SecurityLoggingMiddleware(MiddlewareMixin):
+    """Security event logging middleware."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self.security_log_fields = [
+            'ip_address',
+            'user_agent',
+            'timestamp',
+            'endpoint',
+            'method',
+            'user_id',
+            'tenant',
+            'event_type',
+            'severity',
+            'details'
+        ]
+
+    def process_request(self, request: HttpRequest) -> Optional[HttpResponse]:
+        """Log security-relevant requests."""
+        # Log authentication attempts
+        if '/login' in request.path or '/auth/' in request.path:
+            self._log_auth_attempt(request)
+
+        # Log admin access
+        if '/admin/' in request.path:
+            self._log_admin_access(request)
+
+        # Log Malaysian data access
+        if self._is_malaysian_data_access(request):
+            self._log_malaysian_access(request)
+
+        return None
+
+    def process_response(self, request: HttpRequest, response: HttpResponse) -> HttpResponse:
+        """Log security-relevant responses."""
+        # Log failed requests
+        if response.status_code >= 400:
+            self._log_failed_request(request, response)
+
+        # Log rate limiting
+        if response.status_code == 429:
+            self._log_rate_limit(request, response)
+
+        return response
+
+    def _log_auth_attempt(self, request: HttpRequest):
+        """Log authentication attempt."""
+        event_type = 'login_attempt'
+        severity = 'info'
+
+        ip_address = self._get_client_ip(request)
+        user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+        tenant = self._get_tenant_info(request)
+
+        SECURITY_EVENTS.labels(
+            event_type=event_type,
+            severity=severity,
+            ip_address=ip_address,
+            user_agent=user_agent,
+            tenant=tenant.get('name', 'unknown')
+        ).inc()
+
+    def _log_admin_access(self, request: HttpRequest):
+        """Log admin area access."""
+        if not hasattr(request, 'user') or not request.user.is_authenticated:
+            event_type = 'unauthorized_admin_access'
+            severity = 'warning'
+        elif not request.user.is_staff:
+            event_type = 'unauthorized_admin_access'
+            severity = 'warning'
+        else:
+            event_type = 'admin_access'
+            severity = 'info'
+
+        ip_address = self._get_client_ip(request)
+        user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+        tenant = self._get_tenant_info(request)
+
+        SECURITY_EVENTS.labels(
+            event_type=event_type,
+            severity=severity,
+            ip_address=ip_address,
+            user_agent=user_agent,
+            tenant=tenant.get('name', 'unknown')
+        ).inc()
+
+    def _log_malaysian_access(self, request: HttpRequest):
+        """Log Malaysian data access."""
+        event_type = 'malaysian_data_access'
+        severity = 'info'
+
+        ip_address = self._get_client_ip(request)
+        user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+        tenant = self._get_tenant_info(request)
+
+        SECURITY_EVENTS.labels(
+            event_type=event_type,
+            severity=severity,
+            ip_address=ip_address,
+            user_agent=user_agent,
+            tenant=tenant.get('name', 'unknown')
+        ).inc()
+
+    def _log_failed_request(self, request: HttpRequest, response: HttpResponse):
+        """Log failed requests."""
+        event_type = 'failed_request'
+        severity = 'warning' if response.status_code < 500 else 'error'
+
+        ip_address = self._get_client_ip(request)
+        user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+        tenant = self._get_tenant_info(request)
+
+        SECURITY_EVENTS.labels(
+            event_type=event_type,
+            severity=severity,
+            ip_address=ip_address,
+            user_agent=user_agent,
+            tenant=tenant.get('name', 'unknown')
+        ).inc()
+
+    def _log_rate_limit(self, request: HttpRequest, response: HttpResponse):
+        """Log rate limiting events."""
+        event_type = 'rate_limit'
+        severity = 'warning'
+
+        ip_address = self._get_client_ip(request)
+        user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+        tenant = self._get_tenant_info(request)
+
+        RATE_LIMIT_EVENTS.labels(
+            type='api',
+            ip_address=ip_address,
+            endpoint=request.path,
+            tenant=tenant.get('name', 'unknown')
+        ).inc()
+
+    def _get_client_ip(self, request: HttpRequest) -> str:
+        """Get client IP address."""
+        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+        if x_forwarded_for:
+            return x_forwarded_for.split(',')[0].strip()
+        return request.META.get('REMOTE_ADDR', 'unknown')
+
+    def _get_tenant_info(self, request: HttpRequest) -> Dict[str, Any]:
+        """Get tenant information."""
+        if hasattr(request, 'tenant') and request.tenant:
+            return {
+                'id': request.tenant.id,
+                'name': request.tenant.name,
+                'schema': request.tenant.schema_name
+            }
+        return {'id': None, 'name': 'public', 'schema': 'public'}
+
+    def _is_malaysian_data_access(self, request: HttpRequest) -> bool:
+        """Check if request accesses Malaysian data."""
+        malaysian_endpoints = [
+            '/api/malaysian/',
+            '/api/ic-validation/',
+            '/api/sst/',
+            '/api/postcode/',
+            '/api/business-registration/',
+        ]
+
+        return any(request.path.startswith(endpoint) for endpoint in malaysian_endpoints)