DoD Blue Team Network Security & Hardening Lab

Executive Summary

High fidelity defensive security lab simulating a DoD aligned enterprise network.
This project demonstrates structured network segmentation, system hardening, centralized telemetry ingestion, detection engineering, adversary emulation, and measurable validation aligned with RMF and STIG style control frameworks.

The lab models real world blue team workflows including detection validation, incident response documentation, and compliance artifact generation suitable for defense contractor environments.

Current Status

This lab is actively under development. Core architecture, segmentation, telemetry ingestion, and baseline hardening components are implemented. Ongoing work includes expanded detection coverage, additional adversary scenarios, and deeper RMF artifact mapping.

Objectives

Design, implement, and defend a simulated enterprise network that reflects DoD style security expectations and compliance driven system engineering practices.

Core focus areas:

• Defense in depth architecture
• Identity and access management enforcement
• VLAN based network segmentation and firewall rule design
• Host level hardening aligned with STIG and CIS guidance
• Detection engineering with validated alert coverage
• Documentation structured for RMF style assessment

Architecture Overview

Identity & Access Management

• Windows Server with Active Directory domain services
• Organizational Units and Group Policy enforcement
• Role based privilege separation

Network Segmentation & Perimeter Control

• pfSense firewall with VLAN segmentation
• Inter VLAN rule enforcement
• IDS/IPS integration using Suricata or Snort

Telemetry & Detection Engineering

• Sysmon deployment for endpoint telemetry
• Centralized log ingestion via Splunk or ELK
• Custom detection queries and dashboard validation

System Hardening

• PowerShell based baseline scripts
• GPO driven configuration enforcement
• STIG and CIS control alignment mapping

Adversary Emulation & Validation

• Kali Linux attack simulation environment
• Controlled adversary scenarios
• Detection validation with documented evidence

Repository Structure

Evidence & Validation Approach

Each implemented control and detection includes:

• Configuration artifacts
• Dashboard screenshots
• Log validation samples
• Mapped documentation references

This lab emphasizes measurable defensive effectiveness rather than configuration alone.

Getting Started

git clone https://gitlab.com/arisharazakhan-cpu/dod-blue-team-network-lab.git
cd dod-blue-team-network-lab