golemsec — Demo Organization
golemsec is a fully AWS-hosted simulation of a real ~200-employee Israeli finance company (insurance + stock brokerage). It exists to be a realistic, stable, long-lived scan target for Binary Networks' asset-discovery and security-architecture product — the kind of environment a real customer would point the scanner at.
Confidential. golemsec is a private lab. Real-world fidelity is the priority, not attack/IR theatre. This documentation is the canonical source of truth for what exists, where it lives, and how to get in.
What it is
- A mid-size enterprise with a real Active Directory forest, Exchange mailboxes, line-of-business apps (ERP, CRM, HR, accounting, helpdesk), a NOC/monitoring stack, a dev department (GitLab/Jenkins), databases, backup, and 200 realistic employees across 10 departments.
- A central PII / business database that ties it all together: employees, clients, insurance policies, claims, brokerage accounts, holdings, trades, and transactions — "data flowing like a real org."
- An identity fabric: AD is the source of truth, Keycloak federates it, and apps authenticate employees via SSO.
Guiding constraints
| Constraint | Decision |
|---|---|
| Exposure | Never exposed to the world — accessible only to the operator. Network plane is fully private (no public ingress). Access via VPN + AWS SSM Session Manager. |
| DNS | Real public golemsec.io zone in Cloudflare is allowed/wanted (so DNS recon returns real data) — records may point at private IPs or simply exist. |
| Cloud | AWS only. EC2 is the VM layer. Region us-east-1, single-AZ, cost-trimmed. |
| Identity realism | AD forest corp.golemsec.io, 200 user objects, but only ~6 Windows endpoints representing departments. |
| Real Microsoft Exchange 2019, outbound relayed via Amazon SES (port 25 is blocked by AWS). |
How to read these docs
| Page | Contents |
|---|---|
| Organization Architecture | The business: departments, the 200 employees, the finance domain, data flows |
| AWS Architecture | VPC, subnets, security groups, the instance fleet, egress/routing |
| Systems Inventory | Every service — host, IP, port, purpose, state |
| Identity & SSO | AD → Keycloak federation, OIDC clients, per-app SSO |
| Data Model | The central golemsec_corp PII/business database |
| Credentials & Break-Glass | All admin/service passwords and emergency access |
| Build Status | What's done, what's in flight, what's next |