Project - Paradigm of Building Cyber-ops team from Square one

1A) Creating and configuring the server

* reating and configuring a server can vary depending on the specific requirements of your project. However, here are some general steps you can follow to create and configure a server:

1. Choose a hosting provider: You can choose a hosting provider like Amazon Web Services, Google Cloud Platform, or Microsoft Azure. These hosting providers offer a range of services to choose from based on your requirements.

2. Select a server: Depending on your requirements, choose a server instance that best fits your needs. You can choose a pre-configured server or a customizable server instance.

3. Choose an operating system: Choose an operating system that you want to use for your server. You can choose from different options like Linux, Windows, or macOS.

4. Configure security settings: Set up security settings to ensure that your server is secure. This can include setting up firewalls, user permissions, and encryption.

5. Install required software: Install the required software and dependencies to run your application on the server.

6. Configure server settings: Configure server settings like memory, storage, and CPU usage to optimize the performance of your server.

7. Test the server: After configuring the server, test it to ensure that it is functioning properly.

These are some general steps to create and configure a server. The specific steps may vary depending on the hosting provider, operating system, and requirements of your project.

2A) Configure Windows/Linux based server and establish communication

* To configure a Windows/Linux-based server and establish communication, follow these steps:

1. Install the operating system: Choose your preferred operating system and install it on your server. You can use a Windows Server or a Linux distribution like Ubuntu, Debian, or CentOS.

2. Connect to the server: Once the operating system is installed, connect to the server using Remote Desktop Protocol (RDP) for Windows or Secure Shell (SSH) for Linux.

3. Configure network settings: Set up the network settings, including the IP address, subnet mask, and default gateway, to allow communication with other devices on the network.

4. Install software: Install any necessary software, such as web servers, database servers, or other applications that will run on the server.

3A) Network Analyst/Administrator

* A Network Analyst/Administrator is a professional who is responsible for managing and maintaining computer networks within an organization. Here are some of the main responsibilities of a Network Analyst/Administrator:

1. Designing and implementing network infrastructure: This includes designing and implementing network architecture, selecting appropriate hardware and software components, and configuring network protocols and services.

2. Installing and configuring network equipment: Network Analyst/Administrators install, configure, and maintain network devices such as routers, switches, firewalls, and load balancers.

3. Monitoring network performance: Network Analyst/Administrators monitor network performance, identify and troubleshoot network problems, and optimize network performance.

4. Maintaining network security: This includes configuring firewalls, implementing access controls, monitoring network traffic for security breaches, and responding to security incidents.

5. Managing network upgrades and migrations: Network Analyst/Administrators manage upgrades and migrations of network infrastructure, ensuring that they are implemented without disrupting network operations.

6. Providing technical support: Network Analyst/Administrators provide technical support to users and other IT staff, helping to troubleshoot and resolve network-related issues.

7. Documenting network architecture and operations: Network Analyst/Administrators create and maintain documentation of network architecture, policies, and procedures to ensure that they are up to date and available to other members of the IT team.

These are some of the main responsibilities of a Network Analyst/Administrator. The specific responsibilities may vary depending on the organization's size, complexity of the network, and other factors

4A) Junior Security Analyst.

* A Junior Security Analyst is an entry-level position in the field of cybersecurity. Here are some of the main responsibilities of a Junior Security Analyst:

1. Monitoring security systems: Junior Security Analysts monitor security systems, such as intrusion detection systems and security information and event management (SIEM) systems, to detect potential security threats.

2. Investigating security incidents: Junior Security Analysts investigate security incidents, such as malware infections or unauthorized access, to determine the extent of the damage and recommend remediation actions.

3. Maintaining security policies and procedures: Junior Security Analysts assist in the development and maintenance of security policies and procedures to ensure that they are up to date and effective.

4. Conducting vulnerability assessments: Junior Security Analysts perform vulnerability assessments on systems and networks to identify potential vulnerabilities and recommend mitigating actions.

5. Participating in incident response activities: Junior Security Analysts assist in incident response activities, including containment, investigation, and recovery.

6. Providing user education and awareness: Junior Security Analysts provide user education and awareness on security best practices, such as safe browsing habits and password management.

7. Staying up to date on security threats: Junior Security Analysts stay up to date on the latest security threats and trends, and recommend actions to mitigate these threats.

These are some of the main responsibilities of a Junior Security Analyst. The specific responsibilities may vary depending on the organization's size, complexity of the network, and other factors. A Junior Security Analyst may work under the supervision of a Senior Security Analyst or a Security Manager.

* Detailed Case Study

* To wipe the contents of the disk in the first place, Alex should use a disk wiping software or utility that overwrites the entire disk with zeros or random data to securely erase all data from the disk.

* A single logical drive is a way of combining multiple physical hard drives into one virtual unit that appears as a single drive to the user. It's like a big shelf made up of several smaller shelves - from the outside, it looks like one big shelf, but on the inside, it's still made up of multiple shelves (or physical hard drives). This can be useful for increasing storage capacity, improving performance, or providing redundancy and fault tolerance.

*To split the disk into two logical drives, Alex can use a partitioning tool like Disk Management in Windows or a third-party partitioning software. He can create a new partition from the unallocated space on the disk and format it with a file system of his choice.

* The file system that may have been used to execute the previous split up into 3 logical drives depends on the version of Windows that was installed and the choices made during installation. However, some common file systems used in Windows are NTFS, FAT32, and exFAT.

* To configure and install Windows 10 and have them configured as a single logical drive, Alex should select a file system that is compatible with Windows 10, such as NTFS (recommended for internal hard drives) or exFAT (recommended for external drives that need to be accessed by both Windows and Mac systems).

* To enable both wired and wireless connections on workstations, Alex will need to install a network interface card (NIC) that supports both Ethernet and Wi-Fi connectivity.

* To improve file transfer speed and booting performance on servers utilizing the SATA port, Alex will need to install solid-state drives (SSDs) rather than traditional hard disk drives (HDDs).

* To provide a single access point for storage and enable collaboration across the network, the team will implement network-attached storage (NAS) technology.

* To combine several independent and relatively small disks into a single large storage with data redundancy and failover, Alex will need to implement RAID (Redundant Array of Independent Disks) technology. Specifically, RAID 1 (mirroring) will be implemented to provide data redundancy and failover.

* To configure a computer that serves instructions to other computers, Alex will need to set up a server, which is a type of computer designed to provide services or resources to other computers on a network.

* To authenticate all users on the organization where Windows-based systems will be connected, Alex needs to configure a domain controller. This is a server that manages user authentication and security policies across all the computers on the network.

*To assign IP addresses automatically when client devices are connected, Alex needs to enable the Dynamic Host Configuration Protocol (DHCP) on the device he is configuring.

*To restrict users from accessing certain features on Windows-based systems, Alex needs to enable User Account Control (UAC). This feature prompts users for approval when an action requires administrative privileges, such as changing IP configurations or installing applications.

* To gain access, users will need to provide their login credentials to authenticate themselves with the domain controller.

* To fix the issue of slow booting on workstations with many startup applications, Alex can use the System Configuration utility (msconfig) to disable unnecessary applications from starting up with the system.

* To encrypt all disk drives and their contents in the organization, Alex needs to enable BitLocker Drive Encryption, a feature in Windows that provides full-disk encryption.

* No specific microcontroller is required to enable BitLocker Drive Encryption. This feature can be enabled on any Windows-based system that meets the minimum system requirements.

1. To enable encryption on USB drives in Windows, Alex needs to use the BitLocker feature.
2. To automate tasks on Windows via CLI mode, Alex can use the Windows PowerShell feature.
3. To fix corrupted files in Windows, Alex can use the "sfc /scannow" command.
4. To fetch system information in Windows, Alex can use the "systeminfo" command.
5. To install a Linux OS, Alex needs a file format that is compatible with the Linux file system. One such format is the ISO file format.
6. To create a new folder via Linux CLI, Alex can use the "mkdir" command followed by the name of the new folder.
7. To move the organization file "abc.txt" to the folder path "/home/project/org", Alex can use the "mv" command followed by the source file path and the destination folder path.
8. To compress the file "SOW.txt" in Linux, Alex can use the "gzip" command followed by the name of the file.
9. The default path for third-party application installation in Linux is the "/usr/bin" directory.
10. The package management system in Linux, such as "apt" or "yum", enables the installation of third-party applications.
11. The logs generated by the servers in Linux are stored in the "/var/log" directory.

*

1. To compress the file named SOW.txt, Alex can use the command "gzip SOW.txt" or "zip SOW.txt". The specific command will depend on the type of compression tool installed on the Linux server.

2. Third-party applications on Linux servers are typically installed in the "/usr/local" directory or in the "/opt" directory.

3. Linux package management systems such as "dpkg" and "rpm" enable the installation of third-party applications such as office suites, multimedia players, and designing tools.

4. Logs generated by Linux servers are typically stored in the "/var/log" directory.

5. For directing incoming traffic and acting as the first line of defense, Michael will suggest using a firewall device.

6. Based on the size of the organization, a specific type of firewall device such as a Next-Generation Firewall (NGFW) may need to be purchased.

7. A router serves the primary functions of managing traffic between networks and allowing multiple devices to share an Internet connection.

8. A switch is a network device that is designed to optimize bandwidth and connect similar devices.

9. A switch uses the MAC address to identify which attached device outgoing packets are being sent from and where to deliver incoming packets.

10. A hub is a basic fixed configuration device that is generally used as a plug and play device, but is less commonly used today as switches and routers are more advanced and efficient.

11. Wireless technology enables users to connect wirelessly to a network using protocols such as Wi-Fi.

*

Based on the above the topic, I can provide the following information:

1. To utilize a network speed of more than 50 Mbps, the applicable band would typically be 5 GHz on a Wi-Fi network. The 5 GHz band offers higher throughput compared to the 2.4 GHz band.

2. The device recommended by Michael to project a Wi-Fi signal to a designated area by connecting to a wired router/switch via an Ethernet cable is called a wireless access point (WAP) or Wi-Fi access point.

3. If they need to extend the Wi-Fi signal on the same floor without connecting to an Ethernet cable, they can use a wireless range extender or a wireless repeater.

4. The type of address in the workstation that can't be changed manually and is unique for each workstation is the MAC address (Media Access Control address).

5. The Windows command used to fetch MAC address and IP address details is "ipconfig /all".

6. To connect devices to the network, initially, the network settings such as IP address, subnet mask, default gateway, and DNS server need to be configured on all the devices.

7. In IPv4, there are classes

8. For a small organization with a maximum of 50 devices, the IP address range that can be used could be 192.168.10.0/26. This provides a range of IP addresses from 192.168.10.1 to 192.168.10.62.

9. The subnet mask for the IP range 192.168.10.0/26 would be 255.255.255.192.

*

1. To check if the connection is established from client servers to the AD server with IP address 192.168.10.10, you can use the "ping" command in Windows. The command would be: ping 192.168.10.10.

2. The command in Windows to list the IP address information is "ipconfig". Running the command "ipconfig" in the Command Prompt will display the IP configuration details of the network interfaces.

3. To get the number of hops information between the client and the AD server in Windows, you can use the "tracert" command. The command would be: tracert 192.168.10.10.

4. In Linux server, the command to provide IP address information is "ifconfig" or "ip addr show". Running either of these commands in the terminal will display the IP configuration details of the network interfaces.

5. To view DNS-related queries for "rivera.com" in Linux, you can use the "dig" command. The command would be: dig rivera.com.

6. To fulfill the requirement of 1 million employees, the organization will require an IP address class that provides a large number of addresses. In this case, Class A IP addresses (from 1.0.0.0 to 126.255.255.255) would be suitable as they offer a large range of assignable addresses.

7. To eliminate attacks on the network in the first place, the organization should implement a firewall device. A firewall acts as a barrier between internal and external networks and helps protect against unauthorized access and malicious traffic.

8. To monitor network-related traffic on both the network device and host level, the organization can use Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS). IDS/IPS systems analyze network traffic and detect and prevent security breaches.

9. For detecting alerts and malicious traffic in a reactive approach, the organization can implement a Security Information and Event Management (SIEM) system. SIEM systems collect and analyze log data from various devices and systems to detect and respond to security events.

10. The protection level differs between IDS (Intrusion Detection System) and IPS (Intrusion Prevention System). IDS monitors and detects potential security breaches but does not take active measures to prevent them. IPS, on the other hand, not only detects but also actively blocks or mitigates potential threats by taking preventive actions.

11. When all the devices are connected to the network for the first time, the MAC information is revealed to the entire network hierarchy using broadcast transmission. Broadcast transmission is used to send information to all devices on a network, allowing the MAC information to be received by all devices on the network.

*

Based on the above the info:

1. To send messages to all nodes of the network, the IP address 255.255.255.255 can be used. This is the broadcast address, and sending a message to this address will be received by all devices on the network.

2. The Address Resolution Protocol (ARP) is used to fetch MAC address details on the network. ARP maps an IP address to its corresponding MAC address.

3. For SSH (Secure Shell) access, port 22 needs to be enabled. For RDP (Remote Desktop Protocol) access, port 3389 needs to be enabled.

4. The device on the network hierarchy that blocks unwanted ports is a firewall. Firewalls monitor and control incoming and outgoing network traffic based on predefined security rules.

5. Network Address Translation (NAT) allows multiple devices to access the Internet through a single public IP address. NAT translates private IP addresses of devices within a local network to a public IP address when communicating with the Internet.

6. Virtual Private Network (VPN) technology ensures that all network traffic, including when employees are working from home, is encrypted. VPNs provide a secure and encrypted connection between remote devices and the corporate network.

7. To enable virtualization on Windows servers, the feature can be enabled from the BIOS or UEFI settings of the server's hardware. The virtualization feature is typically found in the processor settings or advanced settings of the hardware configuration.

8. The cybersecurity team requests to enable a sandbox environment to execute and analyze malicious files. This is commonly referred to as a "sandbox" or "sandboxing" in the field of cybersecurity.

9. The person responsible for defining the security operations of the organization, communicating with management about security issues, and overseeing compliance tasks is typically referred to as a Chief Information Security Officer (CISO).

10. The aim of the SOC (Security Operations Center) team is to monitor, detect, investigate, and respond to security incidents and threats in real-time. The SOC team is responsible for maintaining the security posture of the organization and ensuring timely incident response and security monitoring.

*

1. The customer who seeks permission to identify vulnerabilities and report them to the organization is an ethical hacker or a white hat hacker. They are authorized individuals who use their hacking skills for beneficial purposes, such as identifying security weaknesses and helping organizations improve their security.

2. The program on the Rivera website that allows customers to report security vulnerabilities, bugs, and exploits and receive recognition and compensation is called a Bug Bounty Program or Vulnerability Reward Program. It encourages responsible disclosure of security issues by offering rewards to individuals who report them.

3. The hacker attempting a brute force attack to infiltrate the network is a malicious hacker or a black hat hacker. They use unauthorized methods to gain unauthorized access to systems, networks, or data with malicious intent.

4. The cyber threat originating from Israel targeting Afghanistan's government agencies and causing major damage and disruption is an example of a state-sponsored cyber threat. State-sponsored cyber threats involve nation-states or government entities conducting cyber operations for political, military, or intelligence purposes.

5. The malicious software found on the workstation that is used for stealing and damaging the computer is typically referred to as malware. Malware is a broad term that encompasses various types of malicious software, including viruses, worms, Trojans, ransomware, etc.

6. The kind of virus designed to bypass antivirus software is known as a polymorphic virus. Polymorphic viruses can change their code or signature with each infection, making it difficult for antivirus programs to detect and block them.

7. The application that enables cyber-criminals to spy on the user, steal sensitive data, and gain backdoor access to the system is typically referred to as a spyware virus. Spyware is a type of malware that secretly gathers information about a user's activities and transmits it to a third party.

8. The Trojan that attempts to download additional malware files on the system is commonly known as a Trojan Downloader or a Downloader Trojan. It is a type of Trojan horse that downloads and installs other malicious software onto the infected system.

9. The infection where accessing the Rivera website redirects to untrusted search engines and displays unwanted ads is a type of browser hijacking or adware infection. Adware is a form of malware that displays unwanted advertisements and may redirect browser activity to untrusted or malicious websites.

10. If a virus is detected in the production environment, an antivirus software or an endpoint protection tool will be used to detect and suppress the infection. These tools are designed to scan and identify known viruses or malware signatures and take necessary actions to remove or quarantine the infected files.

* The team in the organization that will take care of the antivirus tool and ensure that antivirus signatures are updated is the IT Security Team or the Security Operations Team.

* The multiple login failures on a server indicate a brute force attack. In a brute force attack, an attacker tries multiple combinations of usernames and passwords to gain unauthorized access to a system or application.

* The application trying to reach a malicious IP in the sandbox environment is attempting to establish a command and control (C&C) communication. Command and control servers are used by malware to receive instructions and send stolen data or receive updates from the attacker.

* When more than 100 servers are infected with malware and do not take any instructions until the system is infected, they are referred to as part of a botnet. Botnets are networks of infected computers that are controlled by a central command and can be used for various malicious activities.

*The specific kind of malware that monitors and records everything typed on a computer or mobile keyboard is called a keylogger.

* The key concept that keeps recording every keystroke pressed on the keyboard is called keylogging or keystroke logging.

* Customers can identify if a website is secure by looking for the presence of an HTTPS connection. In a secure website, the URL will start with "https://" instead of "http://", and there will be a padlock icon displayed in the browser's address bar indicating a secure connection.

* The port number used to establish a secure communication to the website is port 443.

* The protocol used for secure communication over the web is HTTPS (Hypertext Transfer Protocol Secure).

* The list of HTTP Request methods includes:

1. GET
2. POST
3. PUT
4. DELETE
5. PATCH
6. HEAD
7. OPTIONS

* The HTTP method in which the information is visible when the user is trying to access the website is the GET method.

* The HTTP method in which the data cannot be cached is the POST method.

* If the credentials are valid and the customer is accessing the contents of the page as expected, the HTTP status code displayed will be 200 OK.

* When a customer is trying to access the Rivera website with admin-based login but the credentials are invalid, and the access is available only for particular users, the HTTP status code displayed will be 403 Forbidden.

* The security device that will monitor all web application-based attacks and defend in the first place is a Web Application Firewall (WAF).

* The team in the SOC that will monitor and take care of all security incidents on the web application-based tool is the Web Application Security Team or the Application Security Team.

* The specific type of web-based attack that uses JavaScript to inject malicious code is Cross-Site Scripting (XSS) attack.

* Brian can validate the suspicious IP addresses and validate the severity from reliable threat intelligence sources or databases such as threat intelligence feeds, threat intelligence platforms, or security information and event management (SIEM) systems.

* The CRM vulnerability that is not disclosed on any public website is known as a zero-day vulnerability. A zero-day vulnerability refers to a security flaw or weakness in a software application that is unknown to the vendor or the public, leaving it vulnerable to exploitation by hackers.

* The attack that can breach the organization through the undisclosed CRM vulnerability is known as a zero-day exploit.

* To have the latest version 6.1.0 of the CRM application, the organization needs to perform an upgrade or update process. This may involve downloading the latest version from the vendor's website, following the upgrade instructions, and deploying the new version on the organization's infrastructure.

* The Vulnerability Management Team is responsible for identifying vulnerabilities in systems and applications.

* If the Vulnerability Management Team identifies a vulnerability, it will be remediated in the organization by applying security patches or updates provided by the vendor, implementing configuration changes, or taking other mitigation measures to eliminate or reduce the risk

THANK YOU