SecureOps Lab - Live Cybersecurity Assessment

Overview

Performed a live cybersecurity assessment on a university Linux server. During analysis, active attack activity was identified, including brute-force authentication attempts and exploitation attempts targeting Log4Shell (CVE-2021-44228).

“Coordinated IPs” refers to multiple malicious IP addresses originating from the same subnet, indicating the use of shared attack infrastructure or automated attack tooling targeting the system simultaneously.

---

Threat Analysis & Findings

Brute Force Attack

• Detected 144 failed SSH login attempts from a single external IP
• Pattern analysis showed rapid authentication attempts consistent with automated credential stuffing

Log4Shell Exploitation Attempts

• Identified malicious payloads in logs consistent with CVE-2021-44228 exploitation attempts
• Source IP differed from brute-force attacker but originated from the same subnet, suggesting coordinated activity

---

Tools & Technical Application

Nmap

Used for active reconnaissance and attack surface enumeration:

• Identified open ports and exposed services
• Detected SSH service configuration and potential entry points
• Assessed externally reachable services for risk exposure

Lynis

Performed host-based security auditing:

• Generated system hardening score (initial: 62)
• Identified misconfigurations in authentication, logging, and service permissions
• Highlighted compliance gaps and privilege risks

Custom Bash Scripts

Developed scripts to automate security monitoring:

• Parsed journald logs for failed authentication attempts
• Detected attack patterns and suspicious IP activity
• Generated SOC-style alert reports for incident visibility

---

Risk Assessment (GRC Approach)

A total of 12 security findings were documented and categorized:

• High Risk:
  • SSH root login enabled
  • Unlimited authentication attempts
• Medium Risk:
  • Weak account permission structures
  • Insufficient logging and monitoring visibility
• Low Risk:
  • Minor configuration inefficiencies

Risk Methodology

• Severity assessed using:
  • CVE references (e.g., CVE-2021-44228)
  • CVSS scoring standards
  • Likelihood vs impact analysis

---

Remediation & Hardening Actions

SSH Hardening

• Disabled root login (PermitRootLogin no)
• Limited authentication attempts (MaxAuthTries 3)
• Reduced brute-force attack surface

Identity & Access Management (IAM)

• Audited all user accounts
• Removed unnecessary or inactive accounts
• Enforced least-privilege access controls

System Monitoring Improvements

• Enhanced log visibility using journald analysis
• Implemented automated alerting via Bash scripts

---

Results

• Identified and documented 12 security risks
• Improved system hardening score from 62 → 64
• Reduced attack surface and mitigated active threats
• Established repeatable security monitoring workflows

---

Repository Contents

• threat_detection.sh → Detects brute-force and suspicious login attempts
• iam_audit.sh → Audits user permissions and access controls
• secureops_master_audit.sh → Full system audit automation
• Full audit report (.txt) → Detailed findings and remediation steps

---

Author

Jordan Dormann
CompTIA Security+