---
# System prepended metadata

title: Dator- och nätverksteknik Security scenarios
tags: [security, Dator- och nätverksteknik, webb1, daodac]

---

---
marp: true
class: invert
---

###### tags: `Dator- och nätverksteknik` `security`

# Dator- och nätverksteknik Security scenarios

* ## Scenario 1: ||Malware Infection||
* Your company has recently suffered a ||malware infection|| that appears to have originated from an employee user's computer
  * The user in question is a Windows user who frequently browses ||shady websites||
  * Your task is to investigate the source of the ||infection|| and implement measures to prevent similar incidents in the future
  * There has been an abnormal amount of suspicious connections to random servers
  * The computer is now extremely slow and slow when signing on Windows

---

* Questions
  * How would you go about investigating the source of the malware infection?
  * What steps would you take to remove the malware from the infected machine?
  * What measures would you implement to prevent similar incidents from occurring in the future?
  * How would you educate users on safe practices when using the terminal and accessing the system?

---

* ## Scenario 2: ||Password Cracking||
* Your organization's IT team has noticed multiple failed login attempts on a user's account in the system
* Upon investigation, it is discovered that an attacker has been attempting to ||crack the user's password using a brute force method||
* One could analyze the system logs and implement measures to prevent similar attacks

---

* Questions:
  * What steps would you take to analyze the system logs and identify the attacker?
  * What measures would you implement to prevent further ||password cracking attempts||?
  * How would you educate users on creating ||strong passwords|| and ||secure login practices||?
  * How would you monitor the system to detect and respond to similar attacks in the future?

---
* ## Scenario 3: ||Privilege Escalation||
* One of your company's servers has been compromised
* and an attacker has gained root access to the system
* It appears that the attacker was able to escalate their privileges through a vulnerability in the operating system
* Your task is to identify the vulnerability
* patch the system and implement measures to prevent similar attacks

---

* ## Scenario 3: ||Privilege Escalation||
* Questions:
  * How would you go about identifying the vulnerability that was exploited?
  * What steps would you take to patch the system and prevent further privilege escalation?
  * How would you monitor the system for similar attacks in the future?
  * What measures would you implement to prevent privilege escalation in the first place?


---
* ## Scenario 4: ||Insider Threat||
* A trusted employee has recently left your organization
* and you suspect that they may have left a backdoor in the system that could be used to compromise the organization's security
* Your task is to identify any backdoors that may exist and implement measures to prevent insider threats in the future
* Questions:
  * How would you go about identifying any backdoors that the former employee may have left behind
  * What steps would you take to remove any backdoors and secure the system
---
* ## Scenario 4: Insider Threat
* How would you monitor the system to detect and respond to insider threats in the future
* What measures would you implement to prevent insider threats in the first place

---

* ## Scenario 5: ||Ransomware Attack||
* Your organization has been hit by a ||ransomware attack||
* and several critical systems have been encrypted
* The attackers are demanding a large sum of money in exchange for the decryption key

---
* ## Scenario 5: Ransomware Attack
* Your task is to respond to the attack and implement measures to prevent similar incidents in the future
* Questions:
  * How would you go about responding to the ransomware attack and recovering the encrypted data?
  * What steps would you take to prevent further spread of the ransomware?
  * How would you educate users on safe practices to prevent ransomware attacks?
  * What measures would you implement to prevent ransomware attacks in the first place?

---

* ## Scenario 6: ||DDoS Attack||
Your organization's website has recently experienced a ||Distributed Denial of Service (DDoS) attack,|| causing the website to become unresponsive and unavailable for several hours.


---

Questions:
* How would you investigate the DDoS attack and identify the source of the attack?
* What steps would you take to mitigate the impact of the attack and restore website functionality?
* What measures would you implement to prevent future DDoS attacks?
* How would you educate users on identifying and responding to DDoS attacks?

---


* ## Scenario 7: ||Router Hack, ARP Spoofing, and MITM Attack||

```
In this scenario there are three different techniques used by the adversaries.
```


Your organization's network infrastructure has recently been compromised, resulting in unauthorized access to sensitive data

Upon investigation, it is discovered that the attacker gained access to the network by ||hacking|| into the router and ||setting up an attack using ARP spoofing ||, which allowed them to intercept and manipulate network traffic using a || Man-in-the-Middle (MITM) attack.||


---

Questions:
* How would you investigate the router hack, ARP spoofing, and MITM attack, and determine the extent of the data breach?
* What steps would you take to mitigate the damage and prevent further data loss?
* What measures would you implement to prevent future router hacks, ARP spoofing attacks, and MITM attacks?
* How would you educate users on securing their routers and identifying and responding to ARP spoofing and MITM attacks?
* During the investigation, it is discovered that the attacker gained access to a password-protected database containing hashed passwords. How would you use hashcat to crack the passwords and prevent further data loss?

