NovaTech Cybersecurity Assessment

Introduction

30 Second Summary

When a company suspects a breach, someone has to investigate. They look at network traffic, check security alerts, and trace how an attacker could have moved through the system.

In this project, you will step into the role of a junior cybersecurity consultant investigating NovaTech Solutions. You'll analyze their network, triage a security alert, identify vulnerabilities, and compile everything into a professional assessment report.

What You'll Build

A professional 3-5 page cybersecurity assessment report covering network analysis, SOC alert investigation, vulnerability findings, risk assessment, and security recommendations for NovaTech Solutions.

By the end of this project, you'll have:

• A network topology analysis identifying attack entry points and lateral movement paths across the NovaTech internal network.
• A SOC alert investigation documenting brute-force indicators of compromise and recommended response actions.
• A risk assessment table mapping all company assets to threats with severity ratings, plus five detailed security recommendations.
• Secret Mission: Map your findings to the MITRE ATT&CK framework and write an attack chain narrative showing how a threat actor could move from initial access to data exfiltration.

Are there any prerequisites?

This project assumes a basic understanding of networking concepts like IP addresses, ports, and protocols. You should also have some familiarity with the Wireshark and Nmap interfaces.

Set Up Your Report Skeleton

Every cybersecurity engagement produces a structured report. Before you investigate NovaTech's suspicious network activity, you need a professional document skeleton that organizes your findings as you uncover them.

In this step, you will create your assessment report in Microsoft Word (or Google Docs), set up the six required section headings, and populate the network reference table that guides the rest of your investigation.

In this step, get ready to:

• Create a report document with a professional cover page.
• Add the six required section headings for the assessment.
• Populate the NovaTech network reference table with all five devices.

Create your report document

Professional security reports follow a consistent structure so that clients can quickly find critical information. Your report needs a cover page that identifies the engagement, plus six distinct sections that mirror the investigation workflow.

• Press the Windows key to open your search bar.
• Type Word and press Enter to open Microsoft Word.
• Select Blank document to create a new file.

Prefer Google Docs?

If you do not have Microsoft Word, open Google Docs in your browser and create a new blank document. All instructions below apply to both tools.

• On the first page, type the report title centered on the page:

NovaTech Solutions - Cybersecurity Assessment Report

• Below the title, type your full name.
• Below your name, type today's date.

Next, add a CONFIDENTIAL header that appears on every page of the report.

• Click the Insert tab in the ribbon at the top.
• Click Header and choose any simple style (such as Blank).
• Type CONFIDENTIAL in the header area.
• Click Close Header and Footer or press Esc to return to the document body.

Why mark it CONFIDENTIAL?

Real security assessment reports contain sensitive information about a client's vulnerabilities. Marking the document CONFIDENTIAL signals that it should only be shared with authorized personnel. This is standard practice in professional cybersecurity consulting.

Now add the six section headings that structure the rest of your report. Start on a new page after the cover page.

• Press Ctrl+Enter to insert a page break after your cover page content.
• Type each of the following headings on its own line, using Heading 1 style for each:

1. Executive Summary
2. Network Overview and Findings
3. SOC Alert Investigation
4. Vulnerability Findings
5. Risk Assessment
6. Security Recommendations

What do these sections cover?

Each section maps to a phase of your investigation. The Executive Summary is written last (after all findings are complete). Network Overview documents the topology. SOC Alert Investigation covers your SIEM triage. Vulnerability Findings lists what the scan revealed. Risk Assessment scores each threat. Security Recommendations proposes fixes.

You will fill each section in the steps that follow. For now, leave them empty below the headings.

• Save your document with the filename CybersecurityAssessmentReport (Word will add the .docx extension automatically).

You should see a document with a cover page (title, your name, date) plus six numbered section headings on the next page. The CONFIDENTIAL header appears at the top of every page.

Don't see the header on every page?

Make sure the Different First Page checkbox is unchecked in the Header and Footer tools. If it is checked, Word hides the header on the first page. Double-click the header area to re-enter editing mode and uncheck it.

Help me get the CONFIDENTIAL header to show on all pages.

Prepare the network reference table

NovaTech's internal network has five devices. You will reference their IP addresses throughout the investigation, so having this table in your report saves you from flipping between documents.

• Scroll to Section 2: Network Overview and Findings in your report.
• Click below the heading and insert a table with 3 columns and 6 rows (1 header row + 5 data rows).
• In Word, click Insert in the ribbon, then click Table and drag to select a 3x6 grid.
• Fill in the table using the reference data below:

| Device               | Purpose                               | IP Address     |
|----------------------|---------------------------------------|----------------|
| Router               | Connects internal network to internet | 192.168.10.1   |
| Employee Workstation | Used by employees                     | 192.168.10.15  |
| Web Server           | Hosts company website                 | 192.168.10.20  |
| File Server          | Stores company documents              | 192.168.10.25  |
| Database Server      | Stores internal application data      | 192.168.10.30  |

What does this network look like?

All five devices sit on the same 192.168.10.0/24 subnet. The Router (192.168.10.1) connects this internal network to the internet through a firewall. The Web Server faces the public internet, while the File Server and Database Server should only be accessible internally.

Keep this table handy. You will trace attack paths through these IP addresses in the next step.

• Save your document (Ctrl+S).
• Verify the table has all 5 devices with their correct IP addresses populated.

Table not formatting correctly?

If the columns are too narrow, hover over a column border until you see a resize cursor, then drag to widen it. In Google Docs, right-click the table and select Table properties to adjust column widths.

Help me format my network table in Word.

✔️ Awesome, I've got everything!

Great. Double check that you have saved your document and that all six section headings and the network table are in place.

ⓧ I'd like to double check the full document structure

Your document should have the following structure:

[CONFIDENTIAL header on every page]

--- Page 1 (Cover Page) ---
NovaTech Solutions - Cybersecurity Assessment Report
[Your Name]
[Today's Date]

--- Page 2+ (Report Body) ---
1. Executive Summary
   [empty - filled last]

2. Network Overview and Findings
   [Network table with 5 devices:
    Router - 192.168.10.1
    Employee Workstation - 192.168.10.15
    Web Server - 192.168.10.20
    File Server - 192.168.10.25
    Database Server - 192.168.10.30]

3. SOC Alert Investigation
   [empty]

4. Vulnerability Findings
   [empty]

5. Risk Assessment
   [empty]

6. Security Recommendations
   [empty]

If anything is missing, scroll back through the instructions above to add it.

Your report skeleton is ready. Next up, you will analyze NovaTech's network topology to identify attack entry points and trace how an attacker could move between systems.

Analyze the Network Topology

Your report skeleton is ready. Now it is time to fill Section 2 with real findings.

Every security investigation starts with understanding the terrain. Before you can identify threats, you need to know what exists on the network, what faces the internet, and where an attacker could move once inside. In this step, you will analyze NovaTech's network architecture, review their traffic logs for suspicious activity, and map a potential attack path through their systems.

In this step, get ready to:

• Document the network architecture including host count, server types, and boundaries.
• Identify suspicious outbound traffic from the network traffic log.
• Map an attack path showing how an attacker could move laterally through the network.

Analyze the network architecture

The first job in any assessment is to inventory what is on the network. A clear picture of the environment tells you what an attacker could target and where defenses might be thin.

• Switch back to your report document and scroll to Section 2 (Network Overview and Findings).
• Below the network reference table you added in Step 1, write a heading: Network Architecture Summary.
• Document the total number of hosts: 5 devices on the 192.168.10.0/24 subnet.
• List the server types present: Web Server (Ubuntu), File Server (Windows), and Database Server.
• Document the network boundary: the router at 192.168.10.1 connects the internal network to the internet through a firewall.

What is a /24 subnet?

The /24 means the first 24 bits of the IP address define the network. In practice, this means all devices share the 192.168.10.x prefix and only the last number changes.

A /24 subnet supports up to 254 usable host addresses. NovaTech uses only 5 of those, which makes the network small and easier to audit.

• Now identify the attack entry point. Write in your report that the Web Server at 192.168.10.20 is the most likely entry point because it hosts a public-facing website and must accept inbound connections from the internet.

Why is the web server the primary entry point?

Any system that accepts connections from the internet is part of the attack surface. The web server must be reachable by anyone browsing to NovaTech's website. That public exposure makes it the first target an attacker would probe.

Internal-only systems like the File Server and Database Server should never be directly reachable from outside. If they are, that is a misconfiguration worth flagging.

Analyze the network traffic log

A network topology tells you what could be attacked. Traffic logs tell you what is actually happening. Your instructor provided a network traffic log in the artifacts folder that captures recent activity on NovaTech's network.

• Open the network traffic log file from your artifacts folder.
• Look for connections where the source IP is internal (192.168.10.x) but the destination is an external address.
• Check the protocol column for each connection. Note any unusual protocols or unexpected ports being used for outbound communication.
• Identify which internal host is communicating with an external IP. This is the suspicious outbound traffic.

What makes outbound traffic suspicious?

Normal outbound traffic includes web browsing (HTTP/HTTPS), DNS lookups, and email. Suspicious outbound traffic has one or more red flags: an internal server initiating connections to unknown external IPs, unusual protocols, non-standard ports, or communication at odd hours.

When a server that should only serve inbound requests starts reaching out to the internet, it could indicate a compromised host phoning home to an attacker's command and control server.

• In your report under Section 2, document which internal IP address is generating suspicious outbound traffic, what protocol it uses, and which external destination it is communicating with.

Filter by direction

If you have the traffic log open in Wireshark, you can use the display filter ip.src == 192.168.10.0/24 and not ip.dst == 192.168.10.0/24 to show only traffic originating from the internal subnet going to external destinations. This eliminates internal-to-internal noise instantly.

Document the attack path analysis

Now that you know which system faces the internet and which host is behaving suspiciously, you can map how an attacker would move through the network after gaining initial access. This is called lateral movement.

• In your report, answer the following investigation questions and write the answers into Section 2.

Work through each question below and add your answers to the report:

• How many devices are on the NovaTech internal network? Answer: 5 devices.
• Which system is likely exposed to the internet? Answer: the Web Server at 192.168.10.20.
• Which server stores company documents? Answer: the File Server at 192.168.10.25.
• If an attacker compromises the web server, which internal system could they target next? Answer: the Database Server at 192.168.10.30, because web applications typically connect to databases for application data.

• Write the full attack path into your report: Web Server (192.168.10.20) is compromised first, then the attacker pivots to the Database Server (192.168.10.30) for application data, then moves to the File Server (192.168.10.25) for document exfiltration.

Why would the attacker target the database before the file server?

Web applications almost always have a direct connection to their database. That existing trust relationship means the attacker can reuse the web application's own database credentials to connect.

The File Server typically does not have a direct connection from the Web Server. An attacker would need to discover it separately after gaining a foothold, making it the second pivot rather than the first.

• Save your report document.

Your Section 2 should now contain the network architecture summary, identified suspicious traffic, and the full attack path showing lateral movement potential.

Not sure what to write for the suspicious traffic?

Focus on any row in the traffic log where the source IP starts with 192.168.10 and the destination IP does not. If the protocol or port looks unusual for that type of server, that is your finding.

If you are unsure whether a protocol is suspicious, ask yourself: would this server normally need to initiate this type of connection? A web server making DNS queries is normal. A web server opening raw TCP connections to an unknown external IP is not.

Help me identify the suspicious traffic in my NovaTech traffic log.

You now have a clear picture of NovaTech's network and how an attacker could move through it. Next up, you will investigate a real SIEM alert to determine exactly what type of attack is already happening.

Investigate the SOC Alert

Your network analysis revealed the attack surface and lateral movement paths. Now it is time to shift from topology to real-time defense.

A SIEM alert has fired for NovaTech. Your job as a SOC analyst is to triage that alert, identify what kind of attack is underway, and document the response. This is the step where you move from "something looks wrong" to "here is exactly what happened and what to do about it."

In this step, get ready to:

• Apply the 5-minute triage framework to a SIEM alert.
• Identify the attack type and document Indicators of Compromise (IOCs).
• Write immediate and long-term response recommendations into your report.

Triage the SIEM alert

Before diving into details, SOC analysts use a structured triage framework to quickly decide if an alert is worth escalating. You will apply a 5-minute triage to the alert artifact your instructor provided.

• Open the SIEM alert artifact provided by your instructor.
• In your report, scroll to Section 3: SOC Alert Investigation.
• Apply each of the five triage questions below by writing your answers into Section 3.

Work through each question in order:

• What triggered? Look at the alert type. For example, "Multiple Failed Authentication Attempts."
• Who is involved? Identify the target account and the source IP address generating the activity.
• When did it happen? Note the timestamp pattern. Rapid succession suggests automation rather than a human typing passwords.
• How unusual is it? Compare the volume and timing to normal login behavior for that account.
• Can you rule it out quickly? If the attempts come from an unknown external IP at odd hours, this is not normal user behavior.

What is the 5-minute triage framework?

SOC analysts receive hundreds of alerts daily. The 5-minute triage is a quick decision structure that helps you separate real threats from noise without spending hours on every alert.

If the answers to these five questions all point toward suspicious activity (unknown source, abnormal hours, high volume), the alert gets escalated for full investigation.

After completing the triage questions, write a summary sentence in your report. It should state: multiple failed login attempts against the same account in a short time window from the same source IP.

Identify the attack type and IOCs

Now that you have triaged the alert, you need to name the attack pattern and pull out the specific indicators that prove it. These indicators are called Indicators of Compromise (IOCs). They are the forensic fingerprints a SOC team uses to track, block, and hunt for the attacker across other systems.

• Under your triage summary in Section 3, add a subheading called Attack Type.
• Write that this pattern indicates a brute-force attack (or credential stuffing). Repeated failed logins from the same source targeting the same account is the signature of automated password guessing.
• Below the attack type, add a subheading called Indicators of Compromise.

Document the following IOCs as a bulleted list in your report:

• The source IP address generating the failed attempts.
• High volume of authentication failures in a short timeframe.
• Attempts occurring outside of normal business hours.
• Sequential or pattern-based usernames if multiple accounts were targeted.

Why do IOCs matter beyond this one alert?

Once you extract IOCs, the SOC team can feed them into firewalls, intrusion detection systems, and threat intelligence platforms. This means the same attacker gets blocked across the entire organization, not just on the one system that triggered the alert.

Document recommended actions

Identifying the attack is only half the job. A professional SOC report must include what to do about it. You will document two categories of response: immediate actions (stop the bleeding now) and long-term recommendations (prevent this from happening again).

• In Section 3 of your report, add a subheading called Immediate Response Actions.
• Write the following five actions as a numbered list:

• Block the source IP at the firewall immediately.
• Lock the targeted account(s) temporarily to prevent compromise.
• Check if any login attempt was successful (indicating the password was guessed).
• Review logs from adjacent systems to check for lateral movement.
• Alert the account owner and enforce a password reset.

• Below those, add a subheading called Long-Term Recommendations.
• Write the following four recommendations:

• Implement account lockout after 5 failed attempts.
• Deploy multi-factor authentication (MFA) on all accounts.
• Set up automated alerting for brute-force patterns.
• Review and harden password policies (minimum 12 characters, complexity requirements).

Why both immediate and long-term?

Immediate actions stop the current attack. Long-term recommendations prevent the same class of attack from succeeding in the future. Clients expect both in a professional report because fixing today's incident without addressing the root cause guarantees it will happen again.

Make your recommendations specific

Instead of writing "improve passwords," specify the exact threshold (12+ characters, complexity). Instead of "add monitoring," name the trigger condition (5 failures in 5 minutes). Specific recommendations are actionable. Vague ones get ignored.

Save your report document after completing Section 3.

✔️ Awesome, I've got everything!

Great. Double check you have saved your report with all the Section 3 content.

ⓧ I'd like to double check my Section 3

Your Section 3 (SOC Alert Investigation) should contain all of the following:

• 5-minute triage results: what triggered, who is involved, when it happened, how unusual it is, and whether it can be ruled out.
• Summary statement: multiple failed login attempts against the same account in a short time window from the same source IP.
• Attack type: brute-force attack (or credential stuffing).
• IOCs: source IP, high-volume authentication failures, after-hours attempts, pattern-based usernames.
• Immediate actions (5 items): block IP, lock accounts, check for successful logins, review adjacent logs, alert account owner.
• Long-term recommendations (4 items): account lockout after 5 attempts, MFA, automated alerting, password policy hardening (12+ characters).

Your SOC investigation is documented. Next, you will review Nmap scan results to uncover the specific vulnerabilities that make attacks like this one possible.

Identify Vulnerabilities and Security Weaknesses

Your SOC investigation in Step 3 confirmed an active brute-force attack against NovaTech's systems. Now you need to understand what those attackers could exploit if they get in.

In this step, you will review Nmap scan results to identify exposed services, then document five security weaknesses and explain how attackers would exploit them. This is the offensive-minded analysis that transforms raw scan data into actionable findings.

In this step, get ready to:

• Interpret Nmap scan results and identify dangerously exposed services.
• Document five security weaknesses with risk explanations.
• Describe realistic attacker actions for at least three findings.

Review the Nmap scan results

Nmap scans reveal which ports are open and what services are running behind them. Each open port is a potential door for an attacker.

• Open the Nmap scan results from your artifacts folder.
• Look at the SERVICE and VERSION columns for each open port.
• Identify any database service (such as MySQL on port 3306 or PostgreSQL on port 5432) in the scan output.
• Note which other services appear: SSH on port 22, SMB/file sharing on ports 445 and 139, and HTTP/HTTPS on ports 80/443.

Which services should be publicly accessible?

On a web server, the only services that should accept connections from the internet are HTTP (port 80) and HTTPS (port 443). Everything else should be restricted to internal traffic only.

A database service visible on the network is especially dangerous. It allows attackers to attempt SQL injection, brute-force database credentials, or exploit known database vulnerabilities to extract all stored data.

• In Section 4 of your report, document which port exposes the database service.
• Write a sentence explaining why an exposed database is dangerous: it allows attackers to directly connect, attempt default credentials, or exploit database-specific vulnerabilities to dump tables, modify records, or encrypt data for ransom.
• List the services that should be restricted to internal access only: SSH (port 22, admin access only), database services (port 3306/5432, internal only), and SMB/file sharing (ports 445/139, internal only).

What does nmap -sV do?

The nmap -sV command enables version detection. It probes open ports to identify which software and version is running behind each one. This is how you determine whether a service is outdated and potentially vulnerable.

Identify five security weaknesses

Your Nmap results reveal exposed services, but the full picture of NovaTech's weaknesses comes from combining scan data with what you know about the scenario. A vulnerability assessment considers both technical misconfigurations and human/process failures.

• In Section 4 of your report, document the following five security weaknesses. For each one, include the weakness name and a short explanation of the risk.

Weakness 1: Outdated Apache web server.

• Write that known vulnerabilities in older Apache versions allow remote code execution, directory traversal, or denial of service.
• Note that attackers can use public exploit databases to find working exploits for the specific version detected in the scan.

Weakness 2: Weak employee passwords.

• Write that simple passwords can be cracked quickly with dictionary attacks or brute-force.
• Note that attackers who compromise one account can access email, file shares, and internal systems.

Weakness 3: Database server accessible from all internal systems.

• Write that this violates the principle of least privilege.
• Note that if any workstation is compromised, the attacker has a direct path to the database containing sensitive data.

Weakness 4: No multi-factor authentication (MFA).

• Write that a single compromised password grants full access without any second verification layer.
• Note that MFA adds a second verification step that stops password-only attacks.

Weakness 5: Unnecessary services exposed on the web server.

• Write that services like SSH or database ports visible externally expand the attack surface.
• Note that each exposed service is an additional target for exploitation.

What is the principle of least privilege?

Every system should only have access to the resources it absolutely needs to function. A workstation used for email and documents has no reason to connect directly to the database server.

In NovaTech's case, only the web server needs database access (to serve application data). All other systems connecting to the database is an unnecessary risk that enables lateral movement.

Explain attacker actions for your findings

A professional vulnerability report does not just name the weakness. It describes what an attacker would actually do to exploit it. This demonstrates you understand the real-world threat, not just the theoretical risk.

• For at least three of your five findings, add a paragraph describing the specific attacker actions. Use the following as your guide for findings 1, 2, and 3.

For finding 1 (Outdated Apache):

• Write that attackers search CVE databases for published vulnerabilities matching the exact version.
• Note they can use automated tools like Metasploit to exploit known flaws, potentially gaining remote shell access to the web server.

For finding 2 (Weak passwords):

• Write that attackers use tools like Hydra or Hashcat to run dictionary and brute-force attacks.
• Note that once inside, they can install backdoors, exfiltrate data, or pivot to other systems.

For finding 3 (Exposed database):

• Write that attackers can directly connect to the database port, attempt default credentials, or exploit database-specific vulnerabilities.
• Note that successful access means they can dump all tables, modify records, or encrypt data for ransom.

What is Metasploit?

Metasploit is a penetration testing framework that contains thousands of pre-built exploits. Attackers (and ethical hackers) use it to test whether a known vulnerability can actually be exploited on a target system.

When a web server runs an outdated version of Apache with a published CVE, an attacker can select the matching exploit module in Metasploit and run it against the target with minimal effort.

Make your findings specific

When writing attacker actions, name specific tools (Metasploit, Hydra, Hashcat) and specific outcomes (remote shell, credential dump, data exfiltration). Generic statements like "an attacker could do bad things" do not demonstrate your understanding to a client.

• Save your report document.
• Review Section 4. You should see: the Nmap port analysis with the dangerous database port called out, all five weaknesses with risk explanations, and attacker action paragraphs for at least findings 1, 2, and 3.

Not sure what to write for attacker actions?

Think about the chain: how does the attacker discover the weakness, what tool do they use to exploit it, and what do they gain once inside? Each answer is one sentence in your paragraph.

Help me write attacker action descriptions for my vulnerability findings.

Your vulnerability findings are now documented with real attacker context. Next up, you will build a risk assessment table that maps every NovaTech asset to its threats and severity, then write the security recommendations that tie the entire report together.

Build the Risk Assessment and Finalize the Report

You've investigated NovaTech's network, triaged a SIEM alert, and documented five security weaknesses with attacker actions. Now it's time to pull everything together into actionable guidance for the client.

In this step, you'll assess the risk level for every NovaTech asset, propose five detailed security improvements, and write the Executive Summary that ties your entire report together.

In this step, get ready to:

• Build a risk assessment table covering all NovaTech assets and threats.
• Write five detailed security recommendations with implementation guidance.
• Write the Executive Summary and finalize the complete report.

Build the risk assessment table

A risk assessment table maps every asset to the threats it faces, assigns a severity rating, and proposes a fix. This is how consultants communicate priority to clients who need to know where to spend their budget first.

• Navigate to Section 5 (Risk Assessment) in your report document.
• Create a table with four columns: Asset, Threat, Risk, and Recommendation.
• Add the following 8 rows to your table, covering every asset and threat combination identified in your investigation:

| Asset | Threat | Risk | Recommendation |
|-------|--------|------|----------------|
| Web Server (192.168.10.20) | Exploitation of outdated Apache | High | Update Apache to latest stable version, enable automatic security patches |
| Web Server (192.168.10.20) | Brute-force login attempts | High | Enable MFA, implement account lockout, restrict SSH access by IP |
| File Server (192.168.10.25) | Unauthorized access to documents | Medium | Implement role-based access control, enable audit logging |
| Database Server (192.168.10.30) | Unauthorized data access | High | Restrict database port access to web server only via firewall rules |
| Employee Workstations (192.168.10.15) | Malware infection | Medium | Deploy endpoint detection and response (EDR), restrict admin privileges |
| Employee Workstations (192.168.10.15) | Credential theft via phishing | Medium | Security awareness training, deploy email filtering |
| Router (192.168.10.1) | Misconfiguration allowing unauthorized access | Medium | Regular configuration audits, change default credentials, enable logging |
| All Systems | Lateral movement after initial compromise | High | Network segmentation, implement zero-trust architecture |

How is risk scored here?

This table uses the simplified Likelihood x Impact method your instructor prescribed. High means the threat is likely (a recurring weakness or active exploitation was observed) AND the impact is major (data breach or service disruption).

Medium means the threat is possible with moderate impact (limited disruption, manageable). Notice that the Web Server has two High entries because you observed active brute-force attempts AND confirmed outdated software with known exploits.

• After the table, add a brief rationale paragraph explaining your scoring approach:

Write something like: "Risk scoring rationale: High = Likely (recurring weakness or active exploitation) with Major impact (data breach, service disruption). Medium = Possible with Moderate impact (limited disruption, manageable)."

• Verify that your table has exactly 8 rows of data (not counting the header row).
• Confirm you have 4 High-risk entries and 4 Medium-risk entries.

Not sure which entries are High vs Medium?

Ask yourself: did you observe evidence of this threat actively happening in your investigation? The brute-force attempts and outdated Apache both had active indicators. The lateral movement risk is High because the database is unrestricted from all internal hosts, making it a guaranteed next step after any compromise.

Help me understand why the Web Server has two separate High-risk entries.

Write five security recommendations

Recommendations turn your findings into a concrete action plan. Each recommendation should include what to do, how to implement it, and why it matters.

• Navigate to Section 6 (Security Recommendations) in your report.
• Write the following five recommendations, each as a numbered paragraph with a bold title followed by implementation details:

Recommendation 1:

## 1. Enable Multi-Factor Authentication (MFA)

Deploy MFA on all user accounts and administrative access. Implement using
an authenticator app or hardware tokens. This blocks 99% of credential-based
attacks even if passwords are compromised.

Recommendation 2:

## 2. Close Unnecessary Ports and Restrict Network Access

Configure the firewall to block all inbound connections except HTTP/HTTPS to
the web server. Restrict database access (port 3306) to only the web server's
IP. Block SMB ports from external access. Use nmap to verify changes.

Recommendation 3:

## 3. Update All Software to Current Versions

Patch the Apache web server immediately. Establish a monthly patch management
cycle. Subscribe to security advisories for all deployed software. Test patches
in staging before production deployment.

Recommendation 4:

## 4. Implement Network Segmentation

Separate the network into zones: DMZ (web server), internal servers (database,
file server), and user workstations. Use firewall rules between zones so
compromising one zone does not grant access to others.

Recommendation 5:

## 5. Deploy Security Monitoring and Logging

Implement centralized log collection from all servers. Configure alerts for
failed login attempts (threshold: 5 in 5 minutes), new outbound connections
to unknown IPs, and after-hours administrative access. Retain logs for
minimum 90 days.

Why are these five recommendations the priority?

Each recommendation directly addresses a High-risk finding from your risk assessment table. MFA stops the brute-force attacks you identified in Section 3. Port restriction and network segmentation block the lateral movement path from the web server to the database.

Software patching eliminates the outdated Apache vulnerability. Monitoring ensures you detect future attacks before they succeed. Together, these five actions address every High-risk row in your table.

• Verify that each recommendation includes three components: what to do, how to implement it, and why it matters.
• Confirm you have exactly five numbered recommendations in Section 6.

Write the Executive Summary and finalize the report

The Executive Summary is written last because it condenses everything you found into a single paragraph. This is the section a CTO or CISO reads first to decide how urgently to act.

• Navigate to Section 1 (Executive Summary) at the top of your report.
• Write one paragraph (half a page maximum) covering the four required elements below:

• Scope: "NovaTech Solutions engaged a cybersecurity assessment of their internal network comprising 5 systems on the 192.168.10.0/24 subnet."
• Key findings: Summarize the top 3 risks in plain language. The web server runs outdated software with known vulnerabilities. Authentication systems lack multi-factor protection. The database server is accessible from all internal hosts.
• Overall risk posture: State clearly that the current security posture is HIGH RISK. Active brute-force attempts were detected, and multiple critical misconfigurations could allow an attacker to move from the web server to sensitive data stores.
• Priority action: "Immediate actions recommended: patch the web server, restrict database access, and enable MFA across all accounts."

Why write the Executive Summary last?

Professional security consultants always write the summary after completing all findings. You cannot accurately summarize top risks or state the overall posture until every section is done. Writing it first leads to inaccurate summaries that contradict the detailed findings below.

Now review the full report for completeness and consistency.

• Scroll through the entire document and confirm all six sections are present and filled in.
• Verify the report is between 3-5 pages in length.
• Check that your cover page shows "NovaTech Solutions - Cybersecurity Assessment Report", your name, the date, and "CONFIDENTIAL" as a header.
• Read through the Executive Summary one more time and confirm it references findings that match what you wrote in Sections 2 through 5.
• Save your document.

Consistency check

The Executive Summary says "outdated software with known vulnerabilities." Section 4 should name the specific software (Apache). If your summary mentions something not covered in the detailed sections, add it. If a section covers a finding the summary omits, decide whether it belongs in the top 3.

Report is shorter than 3 pages?

Check that each recommendation has implementation details, not just a one-line title. Verify the risk assessment table includes the Recommendation column with full sentences. Make sure Section 3 (SOC Alert Investigation) has both immediate and long-term response actions documented.

Help me figure out which sections of my report are too thin to reach 3 pages.

✔️ My report has all six sections complete

Excellent. Your report should now read as a cohesive document. The Executive Summary frames the problem, Sections 2-4 provide evidence, Section 5 quantifies the risk, and Section 6 gives the client a clear path forward.

ⓧ I'd like to double check the full report structure

Here is the complete structure your final report should have. Compare your document against this reference:

# Cover Page
- Title: NovaTech Solutions - Cybersecurity Assessment Report
- Your name
- Date
- CONFIDENTIAL header

# Section 1: Executive Summary
- Scope: 5 systems on 192.168.10.0/24 subnet
- Top 3 risks: outdated Apache, no MFA, database broadly accessible
- Overall posture: HIGH RISK
- Priority actions: patch web server, restrict database access, enable MFA

# Section 2: Network Overview and Findings
- Network table (5 devices with IPs)
- Suspicious outbound traffic identified
- Attack path: Web Server > Database Server > File Server (exfiltration)

# Section 3: SOC Alert Investigation
- Alert triage (5-minute framework)
- Attack type: brute-force
- IOCs: source IP, high failure volume, off-hours timing
- Immediate actions: block IP, lock account, check for success, review logs
- Long-term: account lockout, MFA, alerting, password policy

# Section 4: Vulnerability Findings
- Nmap analysis: database port exposed, only HTTP/HTTPS should be public
- 5 weaknesses: outdated Apache, weak passwords, database unrestricted,
  no MFA, unnecessary services exposed
- Attacker actions documented for findings 1, 2, and 3

# Section 5: Risk Assessment
- 8-row table (Asset | Threat | Risk | Recommendation)
- 4 High: Web Server/Apache, Web Server/brute-force, Database/access,
  All Systems/lateral movement
- 4 Medium: File Server/unauthorized, Workstations/malware,
  Workstations/phishing, Router/misconfiguration
- Scoring rationale paragraph

# Section 6: Security Recommendations
1. Enable MFA
2. Close unnecessary ports and restrict network access
3. Update all software to current versions
4. Implement network segmentation
5. Deploy security monitoring and logging

Secret mission

MITRE ATT&CK Mapping and Attack Chain Narrative

Your report covers the basics, but professional security assessments go further. Map your findings to the industry-standard MITRE ATT&CK framework and write an attack chain narrative showing exactly how a threat actor could move from initial access to data exfiltration. This transforms your report from assignment-level to consultant-grade.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally, so there are no ongoing costs. Decide whether to keep your resources for reference, pause them to free up memory, or delete them entirely.

Resources you used:

• CybersecurityAssessmentReport.docx (or Google Docs equivalent) containing your completed report.
• VirtualBox VMs (Ubuntu and Windows VMs configured for the NovaTech lab).

Keep everything running

No action needed. Choose this if you plan to revisit your report, refine your findings, or use the VMs for additional practice.

• Your report document stays where you saved it.
• Your VirtualBox VMs remain available for future labs and exercises.

Pause - I'll come back to this later

Shut down running VMs to free up system memory while keeping everything on disk for later.

• In VirtualBox, right-click each running VM and select **Close**, then **Power Off**.
• Your report document requires no action. It stays saved on your local drive or Google Docs.

Delete - I don't want to use this again

Remove all project resources and start fresh.

• Delete your report document. If you saved it locally, move it to the Recycle Bin and empty it. If you used Google Docs, open the file, click **File**, then **Move to trash**.
• To remove the VirtualBox VMs, open VirtualBox Manager, right-click the NovaTech lab VM, select **Remove**, then choose **Delete all files** to reclaim disk space. Repeat for each VM used in the lab.

Nice Work!

Nice Work!

You just completed a professional cybersecurity assessment for NovaTech Solutions. From network analysis to risk scoring to actionable recommendations, you delivered exactly what a junior security consultant hands to a client.

You've learned how to:

• Investigate a network topology for attack entry points, triage a SIEM alert to identify brute-force indicators and IOCs, and document recommended response actions.
• Review Nmap scan results to identify exposed services and security weaknesses, then explain how an attacker could exploit each one.
• Build a risk assessment table covering all company assets with severity ratings and compile a structured 3-5 page cybersecurity assessment report with five detailed security recommendations.
• Secret Mission: Mapped findings to the MITRE ATT&CK framework and wrote an attack chain narrative showing how a threat actor could move from initial access to data exfiltration.

Ready to quiz yourself?