Cyber Defense and Attack Training

The project establishes a specialized lab environment for training in cyber defense and attack techniques, featuring 20 detailed lab exercises designed to enhance security capabilities and response skills to real-world cyber threats. The training content covers a wide range of topics, including network attacks, web attacks, vulnerability exploitation, malware, email-based attacks, and system security. The system is designed to simulate realistic attack and defense scenarios, allowing participants to experience exercises in an environment closely resembling actual security incidents.

The deployment and management of the lab are automated through the Ansible tool, enabling seamless setup, configuration, and transition between different lab scenarios. Each lab exercise focuses on identifying, mitigating, and recovering from various types of attacks such as Denial of Service (DoS), Man-in-the-Middle attacks, malware infection, or Advanced Persistent Threat (APT) attacks.

The project not only provides foundational knowledge of cyber attack and defense techniques but also helps participants develop critical skills in investigation, analysis, and rapid response to complex security situations. This is an advanced and effective training model that builds a strong team of security experts, well-prepared to tackle the growing cyber threats in today's digital landscape.

Advanced Practical Exercises:

• Building a diagram of the existing IT system infrastructure.
• Detecting and preventing network scanning activities.
• Password brute-force and administrative privilege attacks on service devices.
• Detecting and preventing password guessing and brute-force attacks.
• Man-in-the-Middle (MitM) attacks.
• Detecting and preventing Man-in-the-Middle attacks within internal networks.
• Network switch device attacks in infrastructure.
• Detecting and preventing attacks on network devices.
• Web server attacks (OWASP Top 10).
• Detecting and preventing web service exploitation attacks.
• Phishing attacks via email services.
• Detecting and preventing phishing attacks via email.
• Denial of Service (DoS) attacks.
• Detecting and preventing Denial of Service attacks.
• Malware-based data encryption attacks.
• Detecting, preventing, and recovering data before and after malware encryption attacks.
• Establishing C&C (Command and Control) channels in the target system.
• Analyze and prevent C&C connections based on network data.
• Detect, prevent, and investigate attacks aimed at stealing user information.
• Detect, prevent, and investigate incidents of cryptocurrency mining malware infection within the network.