Project - Paradigm of Building Cyber-ops team from Square one

Brian - Security Analyst

Michael - Network Specialist

Alex - Creating and configuring the server

Alex - Configure Windows/Linux based server and establish communication

Detailed Case Study

• Disk Clean-up - to wipe out the data on the disk
• Disk Partition using diskpart utility
• Need to create an extended partition first
• Then create 2 logical drives in the extended partition
• FAT32
• NTFS
• Wired Routers and Access Points
• SSD devices on SATA are more faster with boot performance
• NAS (Network Access Storage)
• RAID - Redundant Array of Independent Disks technique
• RAID 1 - Mirroring - has a minimum of two disks to work and provides data redundancy and failover.
• Server is used to give instructions to the other computers
• Multi-Factor authentication (MFA)
• DHCP - Dynamic Host Configuration Protocol will assign automatic Ips to the devices
• UAC - User Access Control
• Privileges are restricted for some local accounts, can only be done by administrator
• Prevents unauthorized malicious activity,
• Prompts for permission to give access

• Authorization is required to gain access
• MSconfig - Microsoft system configuration utility manages Start-up of a system
• BitLocker is used to Encrypts disk drives
• TPM (Trusted Platform Module) - microchip is required for Bit locker
• AES encryption - 128 bit/256 bit is used for USB/flash drives
• PowerShell will allow the scripts to automate tasks
• SFC- System File Check-up command will scan all protected system files, and replace corrupted files with a cached copy
• SYSTEMINFO - will fetch all the system related information such as hostname, os name, Bios version etc.
• Ext4 file system is will be compatible for installing the latest Linux OS
• Mkdir - to create a folder or directory in linux cli
• Create a root directory of new folder : mkdir NewFolder
• Change current working directory : cd NewFolder
• Create subdirectory : mkdir Confidential
• Create subdirectory: mkdir Org
• View the folders inside NewFolder : ls
• To move file to other folder we us : mv command
• Cd org
• mv abc.txt /home/project/org

• gzip - to compress/extract any file/zipping -> gzip SOW.txt

• /usr, /usr/bin are usually places for software installed by the system to be installed.

• End user tools is a linux structure which makes system unique with graphics, multimedia etc
• Event Viewer is used to check the logs
• C:\Windows\%SystemRoot%\System32\winevt\Logs folder.
• /var/log
• Firewall - monitors and filters the incoming and outgoing traffic which acts a first line of defense
• IDS or IPS devices can be used to check packets and inspect information of the IP addresses, port number etc.
• Router - forward data packets to their intended IP addresses, and allow multiple devices to use the same Internet connection
• Smart Managed Switches can be used to connect similar devices with optimal bandwidth
• Switch uses the MAC address to identify which attached device is sending outgoing packets, and where to deliver incoming packets
• Unmanaged switches - Basic, fixed , default settings used as a plug-and-play devices
• Wi-Fi - Wireless LAN technology , IEEE 802.11 - enables the user to connect wireless to the network

• 5GHz bandwidth network will be more suitable for network speed >50 mbps
• Access Points (Aps) - are connected to a wired router/switch via ethernet cable and project wifi signal to designated area
• A Range Extender is used to extend the wi-fi signal outside the router range
• Static IP Address - It is a unique IP and cannot be changed manually
• Ipconfig - used to fetch the MAC address and IP address details
• Network Interface Card(NIC) - device is required to be installed on the device to connect to a network
• Class C IP addresses range is suitable -> 192.0.0.0 to 223.255.255.255 , Number of hosts per network : 254
• Class C Private IP Range: 192.168.0.0 to 192.168.255.255 , Subnet Mask: 255.255.255.0 (24 bits)
• Ping command - It sends the latest packets to the server to test the connection of the device

• Ipconfig/all - list and show the IP address information
• Tracert - gives the details of the no. of hops, time taken, IP addresses passing through to reach the destination from source (router)
• Ifconfig - in linux to get IP address information
• Nslookup - It allows you to view all the DNS records for a website
• Class A - Number of Networks: 126, Number of Hosts per Network: 16,777,214
• IPS - Intrusion Prevention System - continuously monitors, detects malicious activity and prevent it by reporting/ blocking/dropping
• HIDS (Host based IDS) - is installed in the host Device to monitor traffic at host level
• IDS - Intrusion Detection System - is a reactive approach
• Comparatively IPS is more protective than IDS
• Broadcasting - transmits MAC information to all the devices connected in the network
• A broadcast IP - when all host bits are set to 1, last IP of the subnet
• 255.255. 255.255 represents the local broadcast address in a network
• The Address Resolution Protocol(ARP) - MAC address details can be fetched
• SSH port 22 , RDP port - 3389
• Firewall will block the unwanted ports
• NAT ( Network Address Translation) - It allow multiple devices to access internet through a single public IP address
• VPN (Virtual Private Networking) - Encrypts internet traffic , ensure it is private and secured
• To enable Hyper-V in a server:
• Open server manager
• Click on add roles and features
• Select installation type as role-based
• Then select the server on which hyper-v to be installed
• Checkbox the Hyper-V option

• To enable on client PC:
• Search apps and features
• Select programs and features
• Select Turn Windows Features on or off.
• Select Hyper-V and click OK.

• Honeypot - Behaviour analysis of a system from hacker perspective and Understand existing threats in an environment

• SOC Manager - Operations & Management
• Manages the escalation process and reviews incident reports
• Runs compliance reports and supports the audit process

• SOC Teams - Security Operation Centre
• Monitors, prevents, detects, investigates, and responds to cyber threats round the clock
• Aim is to identify, analyse and react to cyber threats
• Contains multiple security teams engaged in the team

• White hat hackers are the ethical hackers
• Disclose vulnerabilities in system security all transparently, seek permission before hacking
• Works in an organization generally

• Bug Bounty program - gives rewards to customers who identify security vulnerabilities , bug and exploits
• Black hat hacker - found by Brian
• National states cybersecurity threat
• Malware - It is a malicious software developed by cyber criminals that steal/damage data
• Rootkit virus - which can bypass the antivirus software
• It is a malicious software extremely difficult to detect and remove

• Trojan Horse virus - It’s a kind of malware which appears to be a legitimate software but carries malicious data, Trojans spy, steal sensitive data
• Downloader Trojan - when an Internet connection is available it connects a remote server, installs itself and download malware
• Adware : advertisements popup, malicious links, emails
• Anti-Virus software will detect and suppress the infection in the first place
• SOC team will take care of the security and ensures that AV signatures are updated
• Brute-Force Attack - it uses trial and error method to crack passwords, login credentials with multiple failed logins
• Command -and-Control Attack - the server is controlled by an attacker or bot that tries to reach malicious IP/compromised target
• Botnet - it is a network of infected devices which acts as zombies
• Keylogger attack - monitors keystrokes and record of everything for malicious purposes
• Keystroke logging - record of every key stroke used on device often without knowledge of user
• SSL Certificate - It is a digital certificate that authenticates a website's identity and enables an encrypted connection.
• TCP Port 443 - connections encrypted with SSL
• HTTPS protocol
• HTTP Request Methods
• GET
• POST
• HEAD
• PUT
• DELETE
• PATCH
• OPTIONS
• GET Method - the Information will be visible to the user
• POST Method - has No caching function
• 200 - Success Code - everything is working correctly as expected
• 403 - Client error - access to the resource is forbidden
• WAF ( Web Application Firewall) - will monitor all the web application-based attack and defend
• Security Analyst - Incident responder- will monitor and investigate the attacks
• Cross-Site Scripting (XSS) - Client-side web-based attack uses Java script to inject malicious code on a legitimate website
• OWASP - The Open Web Application Security Project - has standard awareness document for developers and web application security
• It is a kind of injection attack - Reflected XSS - non -persistent attack
• Cross-site scripting(XSS) or SQL injection attacks
• Before upgrade, it is highly recommend that the sandbox environment has the latest production data.
• Vulnerability Remediation Process
• Identifying vulnerabilities
• Evaluating/ Prioritize - assess the risk
• Treating - Remediation, mitigation and acceptance
• Reporting/ continuous monitoring and assessing
• IAM - Identity and Access Management will ensure authentication of every user