Data Analytics / Essays / Python / SQL

Data Analytics Project

Posted on:

Understanding how to collect, clean, normalize, analyze, visualize, and present data is an important skill for cybersecurity analysts.

I created this presentation as part of the capstone project for the IBM Data Analyst Professional Certificate on Coursera. The specialization included the following courses: Introduction to Data Analytics, Excel Basics for Data Analysis, Databases and SQL for Data Science with Python, Data Visualization and Dashboards with Excel and Cognos, Data Analysis with Python, Python for Data Science, AI & Development, Python Project for Data Science, Data Visualization with Python, IBM Data Analyst Capstone Project.

Essays / Governance / Incident Response / Risk Assessment / Threat Modeling

Incident Response with the Pyramid of Pain

Posted on:

While we might be tempted to address a cyber attack by going after low-hanging fruit such as blocking known, malicious hash values, IP addresses, or domain names, it can be far more effective to focus active defense efforts in ways that present a higher cost to the attacker. Instead of playing whack-a-mole with IoCs that the adversary can easily adapt, security teams should prioritize defenses that challenge the adversary’s tools and strategy. This post examines the Pyramid of Pain paradigm for mapping IoCs to levels based on adversarial cost to adapt and explains how it can be used to help prioritize incident response activity.

Audit / Controls Assessment / NIST CSF / Projects / Risk Management

Botium Toys IT Security Audit

Posted on:

This is a high-level IT security audit for a company that develops and sells toys. The manager of the IT department requested an internal IT audit due to concerns about security, business continuity, and compliance. Audit findings will be used to assist leadership in making risk-based decisions for allocating resources for improvements to the company’s IT security plan

Access Control / Configuration Review / Essays / Least Privilege / Linux

Overprivileged User Risk

Posted on:

When granting elevated privileges to users for specific applications, one should consider the full capability of the application to which privileges are being granted. Granting users sudo privileges to an application may also grant them elevated system privileges if the application is capable of such actions.
In this post, we specifically look at how the shell spawning capability of a popular Unix-based text editor tool can be exploited to gain elevated system access.

Essays / Incident Response / Indicators of Compromise / Linux / Malware Analysis / Risk Assessment / Risk Management / Threat Hunting

Analyze a Suspicious File

Posted on:

This activity demonstrates conducting malware research on a suspicious file using a publicly available, crowd sourced catalog of malware indicators of compromise (IoCs). It further demonstrates the use of the MITRE ATT&CK taxonomy to categorize IoCs and the prioritization of recommended eradication activities based on the Pyramid of Pain hierarchy.

Access Control / Asset Inventory / Configuration Review / Controls Assessment / Essays / Governance / Least Privilege / Log Managment / Projects / Risk Management / System Hardening

Vulnerable Server Assessment

Posted on:

A vulnerability assessment to produce an initial report on the company’s remote database server to inform and prioritize initial security efforts to provide for the confidentiality, integrity, and availability of this important asset. The assessment will inform company policymaking and provide a starting point for ongoing cybersecurity risk management and data governance for the company.