Defensive Security Intro

What does a defender actually do?

Imagine, right now, somewhere, hackers are quietly testing a company's website. Secretly exploring ways to hack into their computers.

These hackers are sneaky and full of tricks. The people whose job it is to is to notice these hackers, protect the company and stop the hackers are called defenders. 

You will get to experience being a defender in this room. No experience needed. Just curiosity.

Something Looks Wrong...

Let's get right into the action and have you experience a real security dashboard, like a defender would use. Click the green "View Site" button below to launch the dashboard.

These security dashboards contain all sorts of information. Defenders call these alerts, and can tell the defender what is happening on the company computers. The skill of a good defender is being able to recognise the important alert out of the noisy ones.

 

 

 

 

You'll need to...

1. Look at the Security Dashboard on the right.

2. Review the recent alerts on the dashboard.

3. Find the alert that looks the most suspicious - a hacker has just triggered one. a

Here's where it gets even more interesting. In Cyber security, it's important to have an open mindset. Thinking about how a hacker works can help us in our defence.

Hackers can be aggressive, sneaky, or both. From quickly trying many ways to break into an organisation to confuse the defenders, to being careful, quiet, and waiting for the right time to strike.

Let's see what the hackers are trying to do by clicking "Investigate" in the Security Dashboard.

 

 

 

 

You'll need to...

1. Click the "Investigate" button on the Security Dashboard.

2. Look at the pages the Hacker has tried to visit.

3. Find the most recent page that the hacker has found.

Stop The Hack

Now comes the satisfying part. We now know who the hacker is and what they are trying to do. Defenders can use a range of techniques and tools to take steps to stop the hacker in their tracks. This is what you'll be doing now.

To stop the Hacker, we will be blocking their access, slowing down how quickly the important pages can be accessed, and turning on protection so that another hack like this cannot happen again.

 

 

 

 

You'll need to...

1. Block the hacker's connection and IP address (32.122.195.63).

2. Slow the activity.

3. Turn on protection.

When you've turned on all 3 protections, the security dashboard will show you a flag - proof that you have successfully stopped the hacker. Well done!