security-operations-labs

Threat Modeling, IT-/OT-Segmentierung, Snort Detection und reproduzierbare Validierung eines Drupal-Detection-Profils.

Threat Modeling

The case study examines an anonymized production environment with connected IT and OT systems. Assets, communication paths, and trust boundaries are captured, analyzed with STRIDE, and mapped to relevant techniques from MITRE ATT&CK Enterprise and ICS. A qualitative risk model prioritizes in particular lateral movement and production outages.

IT/OT Network Segmentation

A gateway separates the office and simulated OT/SCADA segments. The forwarding policy follows the whitelist principle: established return traffic and explicitly allowed services pass through, while unauthorized traffic is logged before the DROP. Nmap, controlled test traffic, firewall counters, and logs verify rules and return paths.

Snort Detection

The Snort configuration defines a suitable HOME_NET and detects TCP/UDP reconnaissance, ICMP to the OT segment, and repeated SSH connection attempts in the lab. The rules demonstrate detection engineering; thresholds must be adjusted for production networks.

CVE-2026-9082 Detection Lab

The Nuclei template is tested against three local instances:

The MariaDB instance is an important negative control: it uses the same Drupal version as the positive control but is not affected by the PostgreSQL-specific query path. This verifies whether the profile does more than merely identify a version.

Technologies

iptables · Snort · Nuclei · Docker Compose · Drupal · PostgreSQL · MariaDB

My Contribution

My work included in particular:

• threat and risk analysis;
• an abstracted data flow diagram and anonymized risk register;
• development and testing of the iptables and Snort rules;
• test concept and anonymized evaluation;
• development of the Nuclei template;
• three-instance validation with one positive and two negative controls;
• false-positive/false-negative analysis; and
• documentation of lessons learned.

Reproducibility

The subprojects document prerequisites, configuration, and test steps. The Drupal lab uses Docker Compose and Nuclei; the segmentation lab requires isolated Linux systems or VMs with administrative rights. Long raw HTTP responses and desktop metadata are deliberately not part of the public evidence.

Security and Ethics

Active testing may only be performed against your own systems or those explicitly authorized. The Nuclei profile is detection-oriented, extracts no data, and does not modify application entries. Even non-destructive requests can generate logs. Firewall scripts may only be run in isolated labs, as they replace active rules.

Findings

• Risk values are only useful with documented assumptions and business context.
• Segmentation must include routing and return traffic and be tested in practice.
• Detection rules require positive and negative controls.
• Error-based detection can be precise but may produce false negatives when error messages are suppressed.

University Context

The work was created as part of a security operations module at THWS. Published are newly formulated own analyses and lab artifacts, not the assignment, lecture slides, provided network diagrams, or complete submissions.