SecureAnyCloud
Deployment guide

SimpleRisk

Overview

SimpleRisk is the widely used open source governance, risk and compliance (GRC) platform. It lets you capture and score risks using the CLASSIC, CVSS, DREAD or OWASP methodologies, plan and track mitigations and management reviews, run compliance audits against frameworks and controls, manage assets, and report on your whole organization's risk posture from one shared risk register.

The SecureAnyCloud image installs SimpleRisk from the official release bundle, fronted by nginx with PHP 8.3 and backed by a local MariaDB. Everything comes from the Ubuntu 24.04 noble archive, with no third-party APT repositories. The database schema is already loaded and the initial setup wizard is already completed and closed, so you land on the sign-in page rather than an exposed first-run wizard.

Because a GRC tool holds sensitive risk data, this image is hardened for that role. There is no default administrator login, a unique administrator password and a unique database password are generated on the first boot of every instance, and the MariaDB database is bound to the loopback interface only.

What you get:

  • SimpleRisk 20260519-001 from the official release, served from /var/www/simplerisk
  • nginx with the SimpleRisk vhost at /etc/nginx/sites-available/sac-simplerisk
  • PHP 8.3 with the pdo_mysql, xml, mbstring, ldap, curl, gd, zip, intl, bcmath, apcu and opcache extensions
  • MariaDB with the simplerisk database and simplerisk app user on loopback only
  • simplerisk-firstboot.service, which rotates the MariaDB password and the administrator password per instance before nginx serves
  • The includes/config.php database password, reset at capture and set per instance on first boot
  • nginx, php8.3-fpm and mariadb enabled and set to start automatically on boot
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, and a VNet with a subnet.

Standard_B2s (2 vCPU, 4 GB RAM) suits a small risk program. Move up to a larger burstable size or a D-series size for busier deployments.

On the network security group, open port 80 (and 443 once you add TLS) and port 22 for SSH. Restrict the source ranges to trusted addresses, because a risk register should never be exposed to the whole internet.

Step 1 to 3: Deploy and connect

Deploy the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>
4

Verify the services

SimpleRisk runs as three services: nginx on port 80, php8.3-fpm behind it, and MariaDB on loopback. Check that all three are running:

sudo systemctl is-active nginx php8.3-fpm mariadb nginx -v php -r 'echo PHP_VERSION, "\n";'
sudo ss -tlnp | grep ':80 '

All three services report active, and nginx is listening on port 80.

5

Retrieve your per-instance credentials

On the first boot of your instance, simplerisk-firstboot.service generated a unique administrator password and a unique MariaDB password and wrote them to a root-only file. Read the file:

sudo cat /root/simplerisk-credentials.txt

The file lists the sign-in URL, the administrator username (admin), the per-instance administrator password and the internal database credentials. Store the administrator password somewhere safe.

6

Sign in to SimpleRisk

Browse to http://<vm-ip>/ and sign in with the username admin and the password from the credentials file.

There is no default admin/admin login on this image. The shipped administrator credential is discarded at capture and replaced with your unique per-instance password on first boot. After your first sign-in, change the administrator password to one of your own choosing from the My Profile menu.

7

Capture and score a risk

The core of SimpleRisk is the risk register. From the Risk Management menu, choose Submit Risk, give the risk a subject, pick a scoring method, set the likelihood and impact, and submit the risk.

SimpleRisk scores each risk into an inherent and a residual risk level so that you can prioritize. Open any risk to see its full detail, scoring, mitigation plan and management review history.

8

Governance, compliance and assets

Beyond the risk register, SimpleRisk covers the wider GRC program. Define control frameworks and controls under Governance, run audits under Compliance, and track assets under Asset Management.

To unlock the framework catalog and the report catalog, register your instance for free from the Configure menu. SimpleRisk then downloads the Secure Controls Framework and the report templates from the SimpleRisk service.

Security posture

This image is built so that no shared or default secret ships. There is no default admin login: the shipped admin credential is rotated to a discarded random value at capture, and your unique password is set on first boot. You can confirm on your own instance that the default admin/admin login is refused:

CJ=$(mktemp)
TOKEN=$(curl -s -c "$CJ" http://127.0.0.1/index.php | grep -oE 'name="csrf_token" value="[^"]+"' | head -1 | sed 's/.*value="//;s/"//')
curl -s -o /dev/null -b "$CJ" -c "$CJ" \
  --data-urlencode "csrf_token=$TOKEN" \
  --data-urlencode "user=admin" --data-urlencode "pass=admin" \
  --data-urlencode "submit=submit" http://127.0.0.1/index.php
curl -s -b "$CJ" -o /dev/null -w 'admin/admin -> HTTP %{http_code} (302 = refused)\n' \
  http://127.0.0.1/management/index.php rm -f "$CJ"

A 302 means the default login was refused and redirected back to the sign-in page.

The MariaDB database, where your risk register lives, is bound to loopback only and is never exposed to the network. The includes/config.php file that holds the database password is not readable from the web:

sudo ss -tlnp | grep ':3306' curl -s -o /dev/null -w 'GET /includes/config.php -> HTTP %{http_code} (403 = not web readable)\n' http://127.0.0.1/includes/config.php

MariaDB shows only 127.0.0.1:3306, and the config file returns 403.

Enabling HTTPS

Serve a risk register over TLS. Point a DNS name at the instance, open port 443 on the network security group, and install a Let's Encrypt certificate with Certbot:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot obtains the certificate, updates the nginx vhost to serve HTTPS, and sets up automatic renewal. Keep the network security group source ranges restricted to trusted addresses even with TLS enabled.

On-box database maintenance

MariaDB keeps root@localhost on socket authentication, so on-box maintenance needs no password:

sudo mariadb simplerisk -e "SELECT username FROM user WHERE admin=1;"

Support

SecureAnyCloud supports this SimpleRisk image 24/7. Contact sales@secureanycloud.com for deployment guidance, TLS and reverse proxy setup, network access hardening, LDAP or SAML integration, version upgrades, and MariaDB database administration.

Deploy on Azure

Launch SimpleRisk on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure