Access over 20 million homework & study documents

Defensive Template

Content type
User Generated
Subject
Computer Science
School
Lewis University
Type
Homework
Rating
Showing Page:
1/3
Defensive Template
Blue Team: Summary of Operations
Table of Contents
Network Topology
Description of Targets
Monitoring the Targets
Patterns of Traffic & Behavior
Suggestions for Going Further
Network Topology
The following machines were identified on the network:
ML-RefVm-684427
o Operating System: Windows
o Purpose: Virtual machine
o IP Address: 192.168.1.1
Target 1
o Operating System: Linux
o Purpose: Apache Web Server
o IP Address: 192.168.1.110
Etc.
Description of Targets
The target of this attack was: Target 1: 192.168.1.110
Target 1 is an Apache web server and has SSH enabled, so ports 80 and 22 are possible ports of
entry for attackers. As such, the following alerts have been implemented:
Monitoring the Targets
Traffic to these services should be carefully monitored. To this end, we have implemented the
alerts below:
SSH Login Attempts
SSH Login Attempts is implemented as follows:
Metric: count

Sign up to view the full document!

lock_open Sign Up
Showing Page:
2/3
Threshold: more than 1
Vulnerability Mitigated: multiple login attempts
Reliability: High reliability
SSH Failed Login Attempts
SSH Failed Login Attempts is implemented as follows:
Metric: count
Threshold: more than 5
Vulnerability Mitigated:
Reliability: High reliability
Sudo Commands Errors
Sudo Commands Errors is implemented as follows:
Metric: count
Threshold: more than 6
Vulnerability Mitigated: prevents a normal user from becoming an administrative user
Reliability: High reliability
Suggestions for Going Further (Optional)
TODO:
Each alert above pertains to a specific vulnerability/exploit. Recall that alerts only detect
malicious behavior, but do not stop it. For each vulnerability/exploit identified by the
alerts above, suggest a patch. E.g., implementing a blocklist is an effective tactic against
brute-force attacks. It is not necessary to explain how to implement each patch.
The logs and alerts generated during the assessment suggest that this network is susceptible to
several active threats, identified by the alerts above. In addition to watching for occurrences of
such threats, the network should be hardened against them. The Blue Team suggests that IT
implement the fixes below to protect the network:
Steven is able to run a Python script via his login.
o Patch: chmod 700
o Why It Works: Access to root would be limited to read/write.
Login to ssh
o Patch: ssh will be disabled.
o Why It Works: Users who are not root users will be disabled from using ssh
login.
Hashed passwords can be seen as a plain text in the wordpress site
o Patch: Developers are alerted of this error.

Sign up to view the full document!

lock_open Sign Up
Showing Page:
3/3

Sign up to view the full document!

lock_open Sign Up
Unformatted Attachment Preview
Defensive Template Blue Team: Summary of Operations Table of Contents • • • • • Network Topology Description of Targets Monitoring the Targets Patterns of Traffic & Behavior Suggestions for Going Further Network Topology The following machines were identified on the network: • • • ML-RefVm-684427 o Operating System: Windows o Purpose: Virtual machine o IP Address: 192.168.1.1 Target 1 o Operating System: Linux o Purpose: Apache Web Server o IP Address: 192.168.1.110 Etc. Description of Targets The target of this attack was: Target 1: 192.168.1.110 Target 1 is an Apache web server and has SSH enabled, so ports 80 and 22 are possible ports of entry for attackers. As such, the following alerts have been implemented: Monitoring the Targets Traffic to these services should be carefully monitored. To this end, we have implemented the alerts below: SSH Login Attempts SSH ...
Purchase document to see full attachment
User generated content is uploaded by users for the purposes of learning and should be used following Studypool's honor code & terms of service.

Anonymous
Really helpful material, saved me a great deal of time.

Studypool
4.7
Trustpilot
4.5
Sitejabber
4.4

Similar Documents