Comprehensive Cybersecurity Lab:
Building, Testing, and Securing a Network Environmentwith Microsoft Azure
Portfolio Project
Clicking on a link opens the video in YouTube at the related timestamp.
Lab Overview
- Intro
- Cybersecurity Lab Description
Building and Testing the Environment
- Create Insecure Inbound Rule in NSG
- Turn Off Windows Defender Firewall
- Install SQL Server Management Studio & Enable Logging
- Generate Failed Logins to SQL Server
- Create Vulnerable Inbound Rule in NSG
- Create Attacker VM in a Separate Virtual Network
- Generate Failed Login Attempts to Windows VM
- Simulate Brute Force Attack to SQL Server
- Simulate Brute Force SSH Attack to Linux VM
- Create Log Analytics Workspace
- Create Workspace & Watchlist in Azure Sentinel
- Enable Microsoft Defender for Cloud & Enable Logging
- Create Data Collection Rules
- Install Monitoring Agent on Windows VM
- Install Monitoring Agent on Linux VM
- Configure Log Export for Entra ID
- Simulate Successful Brute Force Log-In Attack to Azure
- Configure Log Export for Activity Log
- Create/Delete Resource Groups
- Configure Log Export for Storage Account
- Configure Logging for Key Vault
- Test Key Vault Logging & Log Export
- Test Storage Container Logging & Log Export
- Configure Scheduled Query Rule
- Simulate Brute Force Attack to Windows VM
- Query Logs in Log Analytics Workspace
- Import Analytics Rules into Sentinel
TRIGGER INCIDENTS:
- Brute Force to Entra ID [Success]
- Brute Force to MSSQL [Attempt]
- Possible Privilege Escalation
- Windows Host Firewall Tampering
VULNERABILITY SCANNER:
- Prepare Vulnerability Management Scanner
- Configure OpenVAS & Run Uncredentialed Scan
- Examine Report of Uncredentialed Scan
- Configure OpenVAS & Run Credentialed Scan
- Examine Report of Credentialed Scan
- Delete Vulnerable Software[Remediation]
- Run Credentialed Scan[After Remediation]
- Examine Report of Credentialed Scan[After Remediation]
- Assess a 24-Hour Unsecured Environment
- View Incident Maps - 4 Days Unsecured
- Adhere to NIST SP 800-61 for Incident Response
- Incident Investigation Playbook
INCIDENT INVESTIGATION: "Brute Force Success- Windows"
INCIDENT INVESTIGATION: "Brute Force Attempt - Windows"
- Sentinel Data & Visualization
- External Resources: IP Investigation Tools
- Log Analytics Workspace: Time Range Configuration
- Retrieve All Successful Logins
- Retrieve Account Names Associated w/ Successful Logins
- Retrieve Security Events From a Specific IP Address & w/ Successful or Failed Logins
- Retrieve Security Events w/ Successful Logins & From a Specific IP Address
- Count Events By User Account
- Find External IP Addresses w/ Most Logins Both Successful/Failed
- Events w/ Administrative Privileges
- Retrieve Account Names w/ Events & Administrative Privileges
- Time Trend Analysis for Patterns or Specific Time Frames
- Document & Close Out Incident
- Harden the Environment: Secure NSGs
INCIDENT INVESTIGATION: "Possible Privilege Escalation"
- Sentinel Data & Visualization
- LOG ANALYTICS WORKSPACE: Time Range Configuration
- Examine Audit Events for Azure Key Vault
- Sign-In Attempts Made by a Specific User
INCIDENT INVESTIGATION: "Malware Detected"
- Sentinel Data & Visualization
- Examine Sentinel Analytics Rule Query
- Microsoft Defender For Cloud Security Posture & Recommendations
- Track NIST SP 800-53 Security Control Framework in the Compliance Dashboard
- Review NIST SP 800-53 Regulatory Compliance Dashboard
REMEDIATION: NIST SP 800-53
- NIST SP 800-53: Access Control AC-2(12)
- NIST SP 800-53: Incident Response IR-6(2)
- NIST SP 800-53: System & Communications Protection SC-7
- Enable Key Vault Built-In Firewall
- Create Key Vault Private Endpoint Connection
- Enable Storage Account Built-In Firewall
- Create Storage Account Private Endpoint Connection
- View Topology in Network Watcher
- Confirm Private Endpoint & Firewall Are Working Using PowerShell
- View New Topology In Network Watcher
- Gather Baseline Metrics - 24-Hour Secured Environment
- Outro
In this Comprehensive Cybersecurity Lab, I demonstrate building, testing, investigating, and securing a network environment using Microsoft Azure. I cover various aspects of cybersecurity, including creating virtual resources, setting up virtual networks, configuring security controls, monitoring and analyzing logs, investigating security incidents, vulnerability scanners, and implementing security measures. The lab demonstrates insights and practical skills relevant to the field of cybersecurity.
Below is a summary of some of the general contents of the above video.
Establishing and Virtual Networks in Azure
I begin with a local computer and progress to building resources in Azure, including two virtual networks. The first network, designed for testing, comprises Linux and Windows virtual machines equipped with vulnerable software for realistic simulations. The second network serves as an attacker VM, testing the security of the first network.
It's important to note that, in addition to the simulated attacks, the target network experiences real-world attacks that I analyze and remediate.
In this initial phase, I employ various Azure tools, such as an analytics workspace for log data analysis, Azure Sentinel as the SIEM tool, Entra ID, Blob Storage, Key Vault, and Windows Defender for Cloud. Additionally, I create a VM hosting the Greenbone Vulnerability Assessment Scanner tool.
I want to emphasize that while my virtual environment is deliberately configured with minimal security controls to simulate vulnerability, it remains an experimental setup, isolated within Azure. I utilize unique and complex passwords for all accounts. The absence of external network connectivity to my local machines ensures that this cybersecurity demonstration is a safe, controlled experiment, solely for educational purposes.
Accordingly, the lab setup involves creating Azure resources and installing software with intentional vulnerabilities. These include disabling Windows Defender Firewall, setting insecure network rules, and using legacy software to create realistic testing scenarios. I also install Microsoft SQL Server and Microsoft SQL Server Management Software as additional potential targets for attackers.
Diagnostic Configuration and Security Testing
I then transition to setting up diagnostics for sign-in activities and Azure activity logs. This involves simulating brute force attacks and managing resource groups, including their creation and deletion.
Additionally, I configure diagnostics for Blob Storage and Key Vault to assess their log capture capabilities. Following this, I implement and verify various Azure Sentinel features. These include establishing analytics rules and developing incident investigation playbooks.
Conducting and Analyzing Vulnerability Scans with Greenbone Vulnerability Assessment Scanner
I utilize the Greenbone Vulnerability Assessment Scanner to perform comprehensive uncredentialed and credentialed scans. The process includes explaining the necessary steps for a successful credentialed scan, which encompasses configurations on a Windows VM. This also involves running specific queries to analyze logins and detect brute force attacks. Subsequently, I address and remediate the identified vulnerabilities.
Data Collection and Analysis in an Insecure Environment
I expose my deliberately insecure environment to the internet for a 24-hour period to capture baseline data. This data serves as a point of comparison for subsequent information gathered after securing the environment. A significant part of my analysis includes displaying a map that pinpoints the origins of the attacks. This is achieved by correlating attacker IP addresses with geolocation data. The results crucially aid in identifying real attacks, thereby distinguishing them from the simulated ones.
Incident Management and Response Using Azure Sentinel and NIST Framework
In this phase, I leverage Azure Sentinel for incident tracking and management, adhering to the NIST SP 800-61 guidelines for incident response. I provide a detailed explanation of the incident investigation process in cybersecurity, encompassing stages such as preparation, detection, analysis, containment, eradication, recovery, and post-incident activities. The use of Azure Sentinel SIEM is emphasized for monitoring alerts, analyzing incidents, and managing responses effectively.
Additionally, I integrate external resources like VirusTotal, Cisco Talos Reputation Center, and AbuseIPDB to conduct a comprehensive investigation.
Specific incidents investigated include Successful and Attempted Brute Force Attacks, Possible Privilege Escalation, and Malware Detection. To manage these incidents, I employ both an Incident Investigation Playbook and an Incident Response Playbook, demonstrating practical application and analysis.
Network Hardening and Remediation Post-Incident
After addressing the incident, I focus on hardening the network in line with the NIST SP 800-53 standards. To assist in this process, I utilize Microsoft Defender for Cloud, leveraging its capabilities to apply robust security controls.
My remediation efforts include the creation and testing of private endpoints for Key Vault and storage accounts. I enhance network security by adjusting Network Security Group (NSG) settings and adding an additional NSG to safeguard resources within a specific subnet. Throughout these changes, I employ Network Watcher to vigilantly monitor and verify the network alterations.
This approach not only strengthens the network's defenses but also ensures adherence to recognized cybersecurity frameworks.
Evaluating Network Security Post-Hardening: A 24-Hour Internet Exposure Test
After implementing the system hardening measures, I once again expose the network to the internet for a 24-hour period to assess the effectiveness of these changes. During this phase, I closely review the metrics and observe significant improvements in the network's security posture.
Notably, there is a drastic reduction in Windows security events and a complete elimination of security incidents and malicious flows. These observations conclusively demonstrate the effectiveness of the cybersecurity measures I have implemented. This test serves as a practical validation of the enhanced security and resilience of the network against malicious activities.