Vulnerability Management Specialist
🇬🇧 🇷🇺 🇸🇦

Security Lab

Demonstration of IDS systems, attack simulations, and infrastructure setups.

Suricata Network IDS

Tools: Suricata, tcpdump, Wireshark

Signature and anomaly-based detection lab monitoring simulated traffic in real time.

Snort Ruleset Evaluation

Tools: Snort, PCAP replay

Custom detection rules tested against known attack traffic samples.

Web Application Attack Simulation

Tools: Burp Suite, OWASP ZAP

Exploitation attempts covering OWASP Top 10 categories against an isolated test target.

Simulated Phishing & Social Engineering

Tools: GoPhish, custom templates

Controlled phishing campaign to assess user awareness and email filtering.

Monitoring & Alerting Architecture

Tools: Suricata, EveBox, Filebeat, Elasticsearch, Node Exporter, Prometheus, Promtail, Loki, Grafana, Caddy

Suricata inspects all inbound traffic and emits alerts only (eve.json) β€” forwarded to EveBox for analyst triage and to Elasticsearch via Filebeat. System metrics and logs flow through Prometheus/Promtail into Loki and Grafana for a live SOC dashboard, served over HTTPS via Caddy.

                    Internet
                        β”‚
                    Suricata
                        β”‚
              eve.json (alerts only)
                        β”‚
        β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
        β”‚                               β”‚
     EveBox                        Filebeat
(alert analyst UI)                      β”‚
                                         β–Ό
                                  Elasticsearch
                                  (alerts only)

Node Exporter ──▢ Prometheus ──┐
                                β”‚
System logs ─▢ Promtail ─▢ Loki ─
                                β–Ό
                            Grafana
                     (LIVE SOC Dashboard)
                                β”‚
                              Caddy
                         (HTTPS access)
βœ… VPS ~4 GB RAM βœ… Suricata as IDS βœ… Sleek cyberpunk dashboard βœ… LIVE attack map in Grafana βœ… No nginx β†’ Caddy βœ… Minimal overhead βœ… 100% free
Suricata
Network IDS/IPS engine that inspects traffic and generates alerts (eve.json).
EveBox
Web UI for analysts to triage and investigate Suricata alerts.
Filebeat
Lightweight log shipper that forwards eve.json alerts to Elasticsearch.
Elasticsearch
Indexes alerts only, keeping storage and resource usage minimal.
Node Exporter
Exposes host-level system metrics (CPU, RAM, disk) for Prometheus.
Prometheus
Time-series database that scrapes and stores system metrics.
Promtail
Agent that ships system logs to Loki.
Loki
Lightweight, label-indexed log aggregation system built for Grafana.
Grafana
Visualizes metrics, logs, and alerts as a live SOC dashboard.
Caddy
Reverse proxy providing automatic HTTPS for the dashboard β€” no nginx needed.

Segmented Lab Network

Tools: pfSense, VLANs, virtualization

VLAN-based network segmentation isolating attacker, target, and monitoring zones.

Virtualized SOC Stack

Tools: Proxmox/VirtualBox, ELK stack

Self-hosted monitoring and log aggregation stack for lab telemetry.

Layer 1 Β· Firewall

Perimeter Firewall

First line of defense β€” filters traffic at the network perimeter based on rules and zones.

Layer 2 Β· WAF

Web Application Firewall

Inspects HTTP/S traffic to block common web attacks (SQLi, XSS, and more) before they reach the application.

Layer 3 Β· IDS/IPS

Intrusion Detection / Prevention

Monitors and blocks malicious network activity that bypasses the perimeter.

Layer 4 Β· EDR

Endpoint Detection & Response

Provides host-level visibility and response for threats that reach endpoints.

Layer 5 Β· SIEM

SIEM & Log Correlation

Centralizes logs across all layers for correlation, alerting, and incident response.

OSI L1 Β· Physical

Physical Layer Security

Protects the physical medium and physical access to equipment.

  • Physical security of server/patch rooms (locks, access control systems, biometrics, cameras)
  • Rack access control (lockable cabinets, tamper sensors)
  • Cable protection (shielded twisted pair / fiber optics, concealed routing, anti-vandal conduits)
  • TEMPEST / electromagnetic emission shielding
  • Disabling unused switch ports
  • Physical destruction or secure disposal of storage media
OSI L2 Β· Data Link

Data Link Layer Security

Protects frames, MAC addresses, and switching.

  • Port Security (limiting the number of MAC addresses per port)
  • Dynamic ARP Inspection (DAI) + DHCP Snooping
  • 802.1X (device authentication at the port)
  • MAC Filtering / Sticky MAC
  • Private VLAN / Isolated VLAN
  • Protection against MAC flooding (storm control)
  • Data link layer encryption (MACsec)
OSI L3 Β· Network

Network Layer Security

Protects routing and IP traffic.

  • Firewalls with IP-based filtering
  • Access Control Lists (ACL) on routers
  • Network segmentation (VLANs + routing between them)
  • Anti-spoofing (uRPF β€” Unicast Reverse Path Forwarding)
  • Routing protocol protection (MD5/HMAC authentication for OSPF, BGP, EIGRP)
  • Rate-limiting / IP-level DDoS protection
  • IPSec (tunnel mode)
OSI L4 Β· Transport

Transport Layer Security

Protects TCP/UDP sessions and ports.

  • Stateful firewall (connection state tracking)
  • Port and protocol filtering
  • SYN Cookies / SYN flood protection
  • Rate limiting by connection count
  • TCP Wrappers
  • Blocking known malicious ports
  • TLS/SSL (partially overlaps with L4–L7)
OSI L5 Β· Session

Session Layer Security

Protects session establishment and management.

  • Session control and limits (timeout, max sessions)
  • Session hijacking protection (random session IDs, binding to IP/User-Agent)
  • RPC filtering and restriction of remote calls
  • NetBIOS / SMB session protection
  • VPN tunnels with session authentication
OSI L6 Β· Presentation

Presentation Layer Security

Protects data format, encryption, and encoding.

  • Data encryption (TLS, SSL, AES, etc.)
  • Format validation (JSON, XML, ASN.1)
  • Protection against encoding attacks (UTF-7, double encoding, etc.)
  • Certificates and PKI (certificate chain verification)
  • Compression and its safe handling (protection against compression bombs)
OSI L7 Β· Application

Application Layer Security

Protects the applications themselves and top-level protocols.

  • Web Application Firewall (WAF)
  • Input validation / sanitization
  • OWASP Top 10 protection (SQLi, XSS, CSRF, RCE, etc.)
  • Application-level antivirus / anti-malware
  • Application Control / URL Filtering
  • DNS Security (DNSSEC, DNS Filtering, Response Policy Zones)
  • API gateway with authentication and rate-limiting
  • EDR / XDR (host-level application behavior)
  • SIEM + application log correlation