Project - Paradigm of Building Cyber-ops team from Square one
Rivera Company hired a desktop engineer to configure windows and other setup to start the production. As said in question, the desktop is already having Windows XP. The desktop engineer needs to delete 3 partitions and configure for 2 paritions only. The desktop engineer needs to use disk partition from run command (To open the Run command window, you need to press Windows Key + R. Now, type diskmgmt. msc, and hit the Enter key to launch Disk Management.) Then delete the secondary partition (assuming d: drive and e: drive as secondary, and c: drive as primary). Then create a new ntfs partition naming d: drive.
Upgrading new system to Windows 10:
Windows 10 CD is to be inserted and run. We need to follow up the running of the configuration as per CD. All Disk partition should be deleted and a new NTFS drives (lets assume C: drive 1TB) to be created. Format the drives. And continue install the windows 10 in C: drive (assuming as primary drive).
If you are installing a single SATA hard drive, it is best to use the lowest numbered port on the motherboard (SATA0 or SATA1). Then use the other ports for optical drives.
It should have the latest security software, web browser, and operating system are the best defenses against viruses, malware, and other online threats. Set antivirus software to run a scan after each update. Install other key software updates as soon as they are available.
A firewall is a set of related programs that prevent outsiders from accessing data on a private network. Make sure the operating system's firewall is enabled or install free firewall software available online. If employees work from home, ensure that their home system(s) are protected by a firewall.
Server systems and client sytems should be configured according to the requirement by giving specific permissions.
Regularly backup the data on all computers. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files, and accounts receivable/payable files. Backup data automatically if possible, or at least weekly and store the copies either offsite or in the cloud.
Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. Make sure a separate user account is created for each employee and require strong passwords. Administrative privileges should only be given to trusted IT staff and key personnel.
make sure the Wifi network is secure, encrypted, and hidden. To hide your Wi-Fi network, set up your wireless access point or router, so it does not broadcast the network name, known as the Service Set Identifier (SSID). Password protect access to the router.
Work with banks or processors to ensure the most trusted and validated tools and anti-fraud services are being used. You may also have additional security obligations pursuant to agreements with your bank or processor. Isolate payment systems from other, less secure programs and don't use the same computer to process payments and surf the Internet
Do not provide any one employee with access to all data systems. Employees should only be given access to the specific data systems that they need for their jobs, and should not be able to install any software without permission.
NAS server to be installed which has OS configured to act as a web server (usually Linux, windows) as central storage access for all the systems.
Steps for NAS configuration:
Step 1: Prepare the hardware
This includes mounting the appliance in the rack, installing the hard disks and attaching the power and network cables.
Step 2: Configure administrative accounts
It would be a huge security risk to leave the default username and password enabled. At the very least, you must change the default password. The best practice is to create a separate account for each member of the administrative staff. Some appliances include built-in support for Active Directory authentication.
To configure the administrative accounts, you must log into the appliance. Each vendor has its own way of providing access to the administrative interface. Some vendors provide access through a web browser, while others provide customers with a dedicated client application.
Step 3: Perform a diagnostic check
At a minimum, this means verifying that the appliance has correctly detected all of its hard disks. Many vendors include a built-in diagnostic function that users can run to assess the overall health of the appliance.
Step 4: Configure the storage architecture
In most cases, this means configuring the disks to be part of a RAID array. However, organizations commonly configure NAS appliances as JBOD storage. Also, it isn't always appropriate to include every hard disk in a RAID configuration. Sometimes hard disks are used for caching or as a hot spare, as noted in Step 9.
Step 5: Create volumes
The number of volumes that should be created depends on how the organization will use the appliance. If the appliance will be used as a file server, for example, it might be appropriate to create a single, large volume. If the firm will use the NAS appliance for departmental file sharing, the departments could be isolated from one another by creating a separate volume for each department.
Step 6: Configure access permissions for the volumes
This can mean a few different things, depending on the appliance's purpose. If the appliance will be used as a file server, you must establish share-level permissions. Depending on the file system the appliance uses, you might also need to establish some file-level permissions.
Step 7: Configure network access
You must assign an IP address to the appliance -- unless you plan to use dynamically assigned IP addresses -- and create the corresponding DNS host record. Typically, you also have to enable the appropriate access protocol. Most higher-end NAS appliances support multiple access protocols -- such as SMB, AppleTalk, NFS, FTP or iSCSI -- and it's up to administrators to enable the protocols they want to use.
Step 8: Configure notifications
The rackmount NAS appliance should now be accessible, but there are a few more tasks that should be performed, such as configuring notifications. NAS appliances usually have a built-in alerting mechanism that can let the administrator know if the appliance is having a problem. Such a mechanism might, for example, provide notifications of events such as fan failures, low disk space or disk failures. Enabling the notification option usually involves configuring the appliance to communicate with your mail server and then providing the email address or distribution list address to which you want the notifications sent.
Step 9: Configure advanced options
The advanced options tend to vary significantly from one vendor to the next, but they could include automatic RAID rebuilding, write caching, designating a network interface or a hard disk as a hot spare or enabling the appliance to shut down in response to a power failure.
Step 10: Configure the backup
Although not technically a NAS configuration step, the last thing you should do is to create a backup job to protect the NAS appliance. Usually you can't install backup agents onto a NAS appliance, so backups are commonly based on the Network Data Management Protocol (NDMP). NDMP was designed to transport data between backup servers and NAS appliances.
Additional best practices for NAS software and backup management
Organizations that make use of NAS servers must make sure to keep those servers up to date. NAS vendors periodically release firmware updates that improve security and correct known problems. Some hard disk manufacturers even release firmware updates for individual disks. In any case, it's important to keep your appliances up to date. The same can also be said for any external clients used to manage NAS appliances.
Another best practice is to avoid backing up a NAS volume to another volume on the same NAS. Although such backups do technically store backups in a location that is separate from the original data, this approach does nothing to protect the data against a NAS level failure. Additionally, the backup process can adversely affect data volume's performance due to the load that is placed on the device's CPU and memory.
Alex need to configure a Server computer which serves instructions to the other computers as client computers.
The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.
Access control feature is to be used from server side to configure restrictions for client systems.
You can use two methods for controlling access:
User-Group. This method requires users to enter a username and password before accessing the server. The server compares the information in a client certificate or the client certificate itself with a directory server entry. This methods requires the use of a directory server. If you choose to use client certificates, you should increase the value of the AcceptTimeout directive in magnus.conf.
Host-IP. This method requires the user to access the web server from a specific computer, where the web server recognizes the computer by either its hostname or its IP address. This methods does not require a directory server.
We need to disable startup programs in order to increase the booting process.
Steps for disabling unnecessary startup programs on booting are as follows.
In either Windows 10 or 11, click the Start menu and select the ⚙ Settings icon.
Head to Apps > Startup.
Uncheck any apps you don’t immediately need when your computer boots.
BitLocker is Microsoft’s full disk encryption feature that is commonly included in Windows versions that are oriented towards professional, business, or organizational use. With the BitLocker drive encryption, you can encrypt the entire operating system drive and/or other drives mounted to your Windows PCs.
For file level encryption. Following steps need to follow up:
-
Right-click (or press and hold) a file or folder and select Properties.
-
Select the Advanced button and select the Encrypt contents to secure data check box.
-
Select OK to close the Advanced Attributes window, select Apply, and then select OK.
For USB encryption, following steps are to be taken:
Plug your USB drive into your PC's USB port. Locate and select your USB drive in Windows Explorer. Right click the drive and choose "Turn On BitLocker" from the menu.
Steps to assign tasks using CLI:
1. enable view
2. configure terminal
3. parser view view-name
4. secret 5 encrypted-password
5. commands parser-mode {include | include-exclusive | exclude} [all] [interface interface-name | command]
6. exit
7. enable [privilege-level] [view view-name]
8. show parser view [all]
To check corrupted files in disk drive use the command CHKDSK/SFC in command line prompt.
The /usr/bin/hostname command displays the name of the current host system. Only users with root user authority can set the host name
To install Linux Os, following file system needs for the OS to get installed.
The . deb files are meant for Debian distributions of Linux (like Ubuntu, Linux Mint, etc.), while the . rpm files are used primarily by the Redhat-based distros (like CentOS, Fedora, RHEL) and the OpenSUSE
Creating a directory named "Org"
The basic syntax for using this command is mkdir Org.
To move a file in a terminal, you use the mv command to move a file from one location to another.
$ mv abc.txt~/home/project/org
To compress a file, at a shell prompt, type the following command:
gzip SOW.txt
/usr, /usr/bin is used to install third party apps.
To search and aaccess third party app :
$ sudo deb-get search "app name"
Linux has a special directory for storing logs called /var/log . This directory contains logs from the OS itself, services, and various applications running on the system.
Michael will use "Wireshark" device is used to monitor network traffic.
IP port scanner is used for inspecting information such as the destination and origination IP address, packet type, port number.
A Router is a device that connects two or more packet-switched networks or subnetworks. It serves two primary functions: managing traffic between these networks by forwarding data packets to their intended IP addresses, and allowing multiple devices to use the same Internet connection.
A Switch uses the MAC address to identify which attached device outgoing packets are being sent from and where to deliver incoming packets.
Wifi: Wireless fidelity is a wireless communication technology which enables computers and other devices to communicate through a wireless signal.
The 2.4 GHz frequency of the wifi router offers the wifi user a wide coverage area and is better at penetrating solid objects with a usable speed of 50 -70 Mbps.
A modem typically connects to a router, which receives internet access from the modem and sends it to other devices on the network. Modems can use Ethernet cable, DSL, fiber or wireless mediums for connectivity.
Dynamic IP addresses are easier to manage and cheaper to deploy than static IP addresses. Easy, automatic configuration: With a dynamic IP address, the DHCP server automatically assigns the device the next available IP address. You don't need to do a thing.
Ipconfig command used for displaying ip address and router details.
(Type cmd into the Search bar, then press enter. Enter ipconfig /all into the Command Prompt window and press enter. The wireless MAC address will be listed under Wireless LAN adapter Wi-Fi next to Physical Address. The wired MAC address will be listed under Ethernet adapter Ethernet next to Physical Address.)
Basic Network Configuration:
1)The full name of the machine.
2)The IP address of the machine
3)The subnet mask if the network uses subnets.
4)The broadcast address.
5)The default router for the machine.
6)The loopback port address.
7)The IP address of at least one name server if BIND is used.
Class Range for IpV4 are as follows:
Lowest to Highest
Class A from 0.0.0.0 to 127.255.255.255
Class B from 128.0.0.0 to 191.255.255.255
Class C from 192.0.0.0 223.255.255.255
Class D from 224.0.0.0 to239.255.255.255
If Michael, need to configure maximum of 50 devices since this is a small organization, he needs to opt for Class C ip range which can accommodate upto 256 connections of devices.
192.168.10.0/24 uses first 24 bits of the IP address represent the network address, while the remaining 8 bits represents the host address.
The subnet mask for the above ip is 255.255.255.0.
Using the Ping command, we can verify the network level connectivity between the client and server.
"Ipconfig" command in windows will list show the IP address information.
"Tracert" command in windows will provide the number of hops information between the client and the AD server.
"Ifconfig" command in Linux server which command will provide the IP address information.
The dig command in Linux is used to gather DNS information. It stands for Domain Information Groper, and it collects data about Domain Name Servers. The dig command is helpful for troubleshooting DNS problems, but is also used to display DNS information.
Class A ip address class is used to expand the device connections to 1 million.
Putting your network behind a "firewall" is one of the most effective ways to defend yourself from any cyber attack. A firewall system will block any brute force attacks made on your network and/or systems before it can do any damage, something we can help you with.
Most network devices come equipped with support for the Simple Network Management Protocol (SNMP) standard. Via SNMP, you can monitor inbound and outbound network traffic and other important network telemetry critical for ensuring the health and performance of on-premise equipment.
An intrusion detection system (IDS) is a system that monitors network traffic for suspicious activity and alerts when such activity is discovered.
An IDS is designed to only provide an alert about a potential incident, which enables a security operations center (SOC) analyst to investigate the event and determine whether it requires further action. An IPS, on the other hand, takes action itself to block the attempted intrusion or otherwise remediate the incident. Now a days new generation firewall come with inbuild ids and ips system.
A unicast frame is transmitted to all nodes within the collision domain. In a modern wired setting the collision domain usually is the length of the Ethernet cable between two network cards.
How to Block or Open a Port in Windows 10/8/7 Firewall
Open Windows Firewall and find the Advanced Settings :
Open the List of Inbound Rules, Set up a New Rule, Open the New Inbound Rule Wizard, Block the Connection, Apply Your New Rule to Each Profile Type, Name Your Rule and Configure the Settings.
NAT stands for network address translation. It's a way to map multiple private addresses inside a local network to a public IP address before transferring the information onto the internet. Organizations that want multiple devices to employ a single IP address use NAT, as do most home routers
VPN technology ensures all the network traffic to be encrypted when the employees are working from home too.
How to Enable Virtualization in Windows 10 are as follows:
Run command prompt.
Enter the command systeminfo.exe.
The command will gather system information and display the result.
Check Hyper -V Requirements.
If Virtualization Enabled in Firmware shows Yes, Windows Sandbox can be used.
Responsibilities of the Cyber Security Professional : Set and implement user access controls and identity and access management systems. Monitor network and application performance to identify and irregular activity. Perform regular audits to ensure security practices are compliant.
SOC teams are responsible for identifying, deploying, configuring, and managing their security infrastructure.
Email Hijacking, or email hacking, is a widespread menace nowadays. It works by using the following three techniques which are email spoofing, social engineering tools, or inserting viruses in a user computer.
A bug bounty program, also known as a vulnerability rewards program (VRP), offers rewards to individuals for uncovering and reporting software bugs.
Grey Hat Hackers report the security vulnerabilities , bug and exploits where they will be recognized and compensated.
Cyber warfare involves the actions by a nation-state or international organization to attack and attempt to damage another nation's computers or information networks through, for example, computer viruses or denial-of-service attacks. Eg: Afghanistan and israel as mentioned.
Trojans - These are programs that are disguised as legitimate software, but once installed on a computer, can perform malicious activities such as stealing and damaging computers.
Fileless Malware is a virus is designed to bypass the antivirus software.
Backdoor malware is generally classified as a Trojan.
Rootkit trojan usually downloads additional malware files on the system.
URL Redirection is a vulnerability which allows an attacker to force users of your application to an untrusted external site.
If Virus was detected in the production environment, Antivirus tool will detect and suppress the infection in the first place.
Security Specialist in the organization will take care of this tool and ensure that AV signatures are updated.
A botnet (short for “robot network”) is a network of computers infected by malware that are under the control of a single attacking party, known as the “bot-herder.” Each individual machine under the control of the bot-herder is known as a bot.
Keyloggers malware will monitor and record of everything you type on a computer or mobile keyboard and use it for malicious activity.
SSL certificate should be looked for where the customers and clients can purchase and do the transactions digitally.
Port 443 is the SSL function for HTTPS, used to transmit web pages securely through encryption techniques. Information that travels through port 443 is encrypted using SSL/TLS technology. This means that the connection is secure, and information is kept safe while in transit.
HTTP methods are POST, GET, PUT, PATCH, and DELETE.
GET method is used in Which HTTP Method the Information will be visible when the user is trying to access the website.
Methods like PUT or DELETE are not cacheable, and their result cannot be cached.
All validation errors correspond with a 403 HTTP status code.
The HTTP 403 Forbidden response status code indicates that the server understands the request but refuses to authorize it.
A web application firewall (WAF) protects web applications from a variety of application layer attacks such as cross-site scripting (XSS), SQL injection, and cookie poisoning, among others.
Incident responder in SOC will monitor and take care of all the security incidents on the Web application-based tool.
Cross-site scripting attacks is a specific type of web-based attack uses Java script to inject malicious code.