Project - Paradigm of Building Cyber-ops team from Square one

Problem Statement

Rivera organization aims to build an IT team with expertise in the following roles:

1. Creating and configuring servers.

2. Configuring Windows/Linux-based servers and establishing communication.

3. Network Analyst/Administrator.

4. Junior Security Analyst.

Case Study

Scenario 1: Disk Management

• To wipe the contents of a disk with 1 TB of data on a Windows XP system, Alex should use the diskpart utility or third-party disk-wiping software.

• To split the disk into two logical drives, Alex must first delete the existing partitions and create two new ones using the Disk Management utility.

• The presence of three logical drives indicates a file system like NTFS or FAT32.

• For the new Windows 10 systems, NTFS is the recommended file system for a single logical drive.

Scenario 2: Hardware and Networking

• To enable both wired and wireless connections, network interface cards (NIC) and Wi-Fi adapters are needed.

• For faster file transfer and improved booting performance, an SSD with a SATA interface is required.

• To implement a dedicated network storage system, Network Attached Storage (NAS) technology will be used.

• RAID (Redundant Array of Independent Disks) will be enabled to combine multiple small disks into a single storage unit.

• RAID 1 will provide data redundancy and failover with two disks.

Scenario 3: Server and Network Configuration

• A server that provides instructions to other computers is a Domain Controller.

• An Active Directory (AD) server authenticates users in a Windows environment.

• The DHCP (Dynamic Host Configuration Protocol) assigns IP addresses automatically.

• User Account Control (UAC) prevents unauthorized changes on Windows systems.

• Administrator credentials are required to gain access.

Scenario 4: Performance and Security

• To manage startup programs, use the Task Manager startup tab.

• BitLocker encrypts disk drives.

• A Trusted Platform Module (TPM) chip is required for BitLocker.

• BitLocker To Go secures portable drives.

• PowerShell allows automation of tasks.

• The chkdsk command fixes corrupted files.

• The ipconfig /all command fetches system details.

Scenario 5: Linux Server Management

• The EXT4 file format is compatible with Linux OS installation.

• To create a folder: mkdir /home/project/confidential.

• To move a file: mv abc.txt /home/project/org.

• To compress a file: gzip SOW.txt.

• Third-party apps install in /usr/local/bin.

• The /var/log directory stores logs.

Scenario 6: Network Infrastructure

• A firewall acts as the first line of defense.

• A packet-filtering firewall inspects data packets.

• A router manages traffic between networks and allows multiple devices to use the same internet connection.

• A switch optimizes bandwidth and connects similar devices.

• A Layer 2 switch uses MAC addresses for packet delivery.

• An unmanaged switch is plug-and-play.

• Wi-Fi technology enables wireless connections.

• The 5 GHz band allows speeds above 50 Mbps.

• An access point connects to a wired router for Wi-Fi projection.

• A Wi-Fi range extender amplifies the signal.

Scenario 7: IP Management and Security

• A MAC address is unique and unchangeable.

• The ipconfig /all command fetches MAC and IP details.

• Devices must be assigned IP configurations.

• IPv4 has five classes (A, B, C, D, E).

• For 50 devices, Class C (192.168.10.0/24) is suitable.

• The subnet mask for this range is 255.255.255.0.

• The ping command checks AD server connectivity.

• The ipconfig command shows IP details.

• The tracert command shows hops between devices.

• The ifconfig command shows Linux IP details.

• The dig rivera.com command queries DNS.

Scenario 8: Security Expansion

• Class A IP addresses are needed for 1 million employees.

• An Intrusion Prevention System (IPS) proactively stops attacks.

• Network and Host-based IDS monitor traffic.

• IPS offers better protection than IDS.

• ARP broadcast reveals MAC addresses.

• A broadcast address like 255.255.255.255 sends messages to all nodes.

• The ARP protocol fetches MAC details.

• SSH uses port 22, and RDP uses port 3389.

• A firewall blocks unwanted ports.

• Network Address Translation (NAT) allows internet access via a single public IP.

• VPN encrypts traffic for remote work.

Scenario 9: Cybersecurity and Incident Response

• Virtualization is enabled in BIOS.

• A sandbox allows malware analysis.

• A Chief Information Security Officer (CISO) defines security operations.

• A Security Operations Center (SOC) team handles incidents.

• A white-hat hacker reports vulnerabilities.

• A bug bounty program rewards vulnerability reporting.

• A black-hat hacker performs brute force attacks.

• Nation-state threats target other nations.

• Malware damages systems.

• A rootkit bypasses antivirus.

• A Trojan masquerades as legitimate software.

• A downloader Trojan fetches malware.

• Adware redirects traffic.

• Antivirus software detects and removes infections.

• The SOC team manages antivirus tools.

• Multiple login failures indicate brute force attacks.

• Command and Control (C2) servers control infected machines.

• A botnet is a network of infected computers.

• Keyloggers record keystrokes.

• HTTPS and SSL certificates ensure secure websites.

• Port 443 is used for secure communication.

• The GET, POST, PUT, and DELETE are HTTP methods.

• The GET method exposes data.

• The POST method prevents caching.

• HTTP 200 status code indicates success.

• HTTP 403 indicates forbidden access.

• A Web Application Firewall (WAF) prevents web attacks.

• The SOC team monitors WAF incidents.

• Cross-Site Scripting (XSS) injects malicious JavaScript.

• VirusTotal or AbuseIPDB checks IP severity.

• A zero-day vulnerability is undisclosed.

• A patch is required for CRM upgrades.

• Vulnerabilities are remediated by patch management teams.

• The Identity Access Management (IAM) team handles authentication.