Your Team Currently Works As A Research Wing For A Standard

Question

Your team currently works as a research wing for a standard SOC Your team currently works as a research wing for a standard SOC (Security Operations Center). The SOC keeps analytics on the current trends within the network. Your team will be assigned a current issue that has been seen at the border of the network, trying to infiltrate the organizations network/systems. Upon being assigned your item, it will be your job to go out and search OSINT (Open Source Intelligence) for more information on the attack being observed. This could be a single port number, a series of attacks that has been identified, or an IP address to research and identify; your professor will assign this. Your deliverable will be a 5 page APA style research report with your findings. Discover current attacks being performed through this port, or current state of a known scanning suite. Find sources, if possible, source code of attacks that are known to exploit this weakness and break down the code. List known services on the affected ports that are associated and current attacks being performed on these services (list any CVE findings and briefly list and explain). Look at SNORT rules that watch for these attacks and list that SID. Finally, to wrap-up your research, present the current risk level associated with this threat. Use the FAIR methodology to derive your threat assessment. The attached FAIR PDF will walk you through your analysis. To complete the FAIR document: Step 1: Asset at Risk will be the organization's primary e-commerce web server. Step 2: You will provide this answer based on your research. Step 3: You will provide this answer based on your research; however, keep in mind how many times per day this is scanning the network, which will be given to your when you receive your topic. Step 4: You will provide this answer based on your research. Step 5: Assume the e-Commerce server is fully up-to-date and running the following base software: Red Hat Linux, Apache, MariaDB, Drupal,

Dr. Jack HW Helper · Accepted Answer

In recent years, the increasing sophistication of cyber threats has made it imperative for organizations to adopt proactive measures to safeguard their networks. The Security Operations Center (SOC) plays a vital role in this endeavor, continuously monitoring, analyzing, and responding to security threats. In this research report, we will analyze a specific current issue affecting our organization’s network, focusing on the exploitation of vulnerabilities arising from a particular port or an IP address that poses a risk to our primary e-commerce web server. Identifying Current Attacks Following the assignment of our focus item—Port 80, commonly used for HTTP traffic—we conducted extensive research to identify current attacks leveraging this port. The Open Web Application Security Project (OWASP) maintains an updated list of threats, indicating that cross-site scripting (XSS) and SQL injection (SQLi) are prevalent attacks associated with Port 80 (OWASP, 2023). For instance, several known exploits can lead to significant data breaches and unauthorized access. One notable CVE entry is CVE-2019-11043, which is associated with PHP applications running on NGINX when improperly configured (NVD, 2023). Source Code Analysis For a more thorough understanding, we examined several open-source attack scripts available on platforms like GitHub. Code related to CVE-2019-11043 exemplifies the vulnerability, showing how a crafted request could exploit configurations to inject arbitrary commands, leading to remote code execution (RE, 2022). Understanding this code provides insights into the methods attackers might employ to exploit vulnerabilities and emphasizes the need for robust code review practices during application development. Services Associated with Port 80 Port 80 primarily facilitates HTTP requests, serving as the backbone for web traffic. Among the services associated with this port are Apache HTTP Server and various web application frameworks such as Drupal and PHP, all

Your Team Currently Works As A Research Wing For A Standard ✓ Solved

Your team currently works as a research wing for a standard SOC

Paper For Above Instructions

Identifying Current Attacks

Source Code Analysis

Services Associated with Port 80

SNORT Rules and Signatures

Risk Assessment Using FAIR Methodology

Summary and Presentation Preparation

References