Network Defense

Network defense is keeping attackers out and detecting them when they get in. It is the blue team side of security — monitoring, hardening, and response.

This is the primary focus of competitions like CCDC.

Core Concepts

Hardening: Reducing the attack surface. Disable services you don’t need, apply patches, enforce strong authentication, restrict permissions to the minimum required.

Monitoring: Knowing what is normal so you can detect what is not. Logs, alerts, dashboards, traffic baselines.

Detection: Identifying attacker behavior in logs and network traffic. SIEM tools aggregate and correlate events.

Response: When something is detected, contain it. Isolate the affected system, revoke credentials, block IPs, assess the damage.

Key Technologies

Technology What it does
Firewall Controls which traffic is allowed in and out based on rules
IDS/IPS Intrusion Detection/Prevention System — inspects traffic for attack signatures
SIEM Security Information and Event Management — aggregates logs and alerts
VPN Encrypts network traffic between endpoints or sites
Network segmentation Isolates systems into zones so a breach doesn’t spread freely
EDR Endpoint Detection and Response — monitors endpoints for malicious behavior

Tools

Tool Type
pfSense Open-source firewall/router
OPNsense Alternative to pfSense, active development
Snort Open-source IDS/IPS
Suricata Modern IDS/IPS, multi-threaded
Zeek Network security monitoring framework
Splunk SIEM — free tier available
Elastic Stack (ELK) Open-source log aggregation and SIEM
Wazuh Open-source EDR and SIEM

Hardening Basics

These apply to any Linux server:

# Disable unnecessary services
systemctl disable service_name

# Check what is listening
ss -tulnp

# Review sudo configuration
cat /etc/sudoers

# Check for SUID binaries
find / -perm -4000 2>/dev/null

# Review open ports and firewall rules
iptables -L -n -v

The First Ten Minutes on a Box

You inherit a machine in a competition or an incident. Before you change anything, find out who is on it and what is listening.

w                              # who is logged in right now, and from where
last -a | head                 # recent logins
ss -tulnp                      # every listening port and the process behind it
ps -ef --forest                # the process tree. A shell under a service is wrong.
find / -mmin -30 -type f 2>/dev/null | grep -v '^/proc'   # files changed in the last 30 minutes
crontab -l; ls /etc/cron*      # scheduled persistence

Take a baseline so you can prove what changed later:

sha256sum /etc/passwd /etc/shadow /etc/sudoers > baseline.txt

Read the SSH log before you touch the firewall. Who is failing to log in tells you who is trying.

journalctl -u ssh --since "1 hour ago" | grep -i fail

Block an address at the host firewall when you must, with the tool the system already has:

sudo nft add rule inet filter input ip saddr 203.0.113.9 drop    # nftables
sudo iptables -A INPUT -s 203.0.113.9 -j DROP                    # older systems

Reference: the nftables wiki.

CCDC Context

CCDC (Collegiate Cyber Defense Competition) is an attack/defend competition. Blue teams defend infrastructure against red teams of professional penetration testers.

The skills tested: hardening systems quickly, monitoring for attackers, responding to incidents, and keeping services running while under active attack.

How the Club Uses This

TODO: Add how the club prepares for CCDC — systems practiced on, hardening scripts, incident response playbooks, roles on the team, past results.

References

Next CompeteWhat competing at the club means, and the difference between defense competitions and CTFs.