Security Operations Capstone Lab: Hardening, Scanning, and Reporting

Security Operations Capstone Lab: Hardening, Scanning, and Reporting

This capstone lab is your opportunity to work as a practicing security analyst. You will receive a lab environment with deliberate weaknesses, fix those weaknesses, scan what remains, review logs, and deliver a professional report. Every step mirrors what employers expect on the job and what certifications such as CompTIA Security+, CompTIA CySA+, and ISC2 CC test you on.

Understanding the Workflow

Professional security operations follow a repeatable cycle: assess, harden, verify, report. Skipping any step leaves gaps that attackers exploit. In this lab you run the full cycle from start to finish without instructor prompting. Treat the lab environment as a real production network — document every action before you take it, not after.

Step 1: Assess the Environment and Build a Change Log

Before touching any setting, read the documented deficiencies provided with the lab. Map each deficiency to a control category: authentication, network perimeter, endpoint configuration, or logging. Open the change log template and create an entry for each planned change. Each entry should record the date and time, the system affected, the current (before) state, the intended (after) state, and the reason for the change. This discipline protects you legally, helps teammates understand what happened, and is required for most compliance frameworks.

Authentication hardening comes first because stolen credentials are the leading initial-access vector. Configure multi-factor authentication (MFA) on all accounts in scope. Verify that each account actually requires the second factor before moving on — a misconfigured MFA policy that looks enabled but does not enforce is a common audit finding.

Next, review firewall rules in pfSense. Remove any "allow all" rules. Apply the principle of least privilege: permit only the traffic the environment legitimately needs and deny everything else, logging denied traffic for later review. Document each rule added or removed in the change log.

Endpoint hardening follows the operating system's security baseline. Disable unneeded services, enforce strong password policies, remove default credentials, and ensure the system firewall is active. Record every setting changed.

Step 2: Vulnerability Scanning with OpenVAS

With hardening complete, run a credentialed vulnerability scan using OpenVAS against all in-scope hosts. A credentialed scan authenticates to each host and inspects installed software, registry settings, and patch levels — it finds far more than an unauthenticated scan. Let the scan complete fully before reviewing results; interrupting a scan produces incomplete data.

When the scan finishes, export the results and sort findings by CVSS score (Common Vulnerability Scoring System). CVSS v3.1 scores range from 0.0 to 10.0. Scores of 9.0–10.0 are Critical, 7.0–8.9 are High, 4.0–6.9 are Medium, and 0.1–3.9 are Low. Prioritize Critical and High findings for immediate remediation. For each finding, record: the CVE identifier if present, the CVSS score, the affected host and service, and a specific remediation action such as applying a patch, disabling a service, or changing a configuration value.

Use Nmap to verify open ports before and after hardening. Compare the pre-hardening and post-hardening port lists. Any port still open that should be closed is an incomplete remediation — fix it and re-scan.

Step 3: Log Review

Open the log collector and search for anomalies across the timeframe of the lab. Key indicators to look for include: repeated failed authentication attempts (possible brute force), successful logins at unusual hours, firewall deny events for internal hosts contacting external IPs, and unexpected process launches on endpoints. For each anomaly, record the timestamp, source, event type, and your interpretation. Not every anomaly is malicious, but each one needs a documented explanation.

Wireshark can supplement log review if you captured traffic. Filter for cleartext credential protocols such as Telnet or FTP — if found, these are findings for your report because they indicate unencrypted authentication still in use.

Step 4: Write the Security Posture Report

The report template has required sections: executive summary, controls implemented, vulnerability findings, log anomalies, overall risk posture, and recommended next steps. Write the executive summary last — it is a one-paragraph plain-language description of the environment's overall risk level intended for a non-technical manager.

The controls section summarizes what you configured and references the change log. The vulnerability findings section presents your prioritized list with CVSS scores. The log anomalies section explains each anomaly and its significance. The risk posture section assigns an overall rating (Critical, High, Medium, or Low) with justification. Recommended next steps are specific, actionable, and time-bound — avoid vague advice like "improve security."

Proofread for technical accuracy before submitting. A report with incorrect CVSS scores or wrong host information undermines professional credibility.

Step 5: Verbal Summary

Present a five-minute verbal summary to your instructor. Open with the overall risk posture, describe the top two or three findings, explain what you fixed and what remains, and close with your highest-priority recommendation. Speak to the report, not from memorized notes — the goal is to demonstrate that you understand the content, not that you can recite it.

Safety and Professional Conduct in the Lab

All scanning and testing must stay within the assigned lab environment. Scanning hosts outside your authorized scope — even accidentally — can disrupt services and may violate computer fraud statutes. Verify IP ranges before every scan. If you discover a configuration that could cause data loss (such as a misconfigured backup deletion script), stop and notify the instructor before proceeding. Treat credentials found in the lab environment as sensitive — do not share them or use them outside the lab.