Fundamentals Lab: Defense-in-Depth & Security Controls

cat > asset_inventory.csv << 'EOF'
Asset ID,Name,Type,Owner,Location,Classification,Data Type,Criticality
A001,Web Server 1,Cloud Server,SRE Team,us-east-1 (AWS EC2),Confidential,Customer data,Critical
A002,Web Server 2,Cloud Server,SRE Team,eu-west-2 (AWS EC2),Confidential,Customer data,Critical
A003,Database Primary,Database,DBA Team,us-east-1 (AWS RDS),Restricted,PII,Critical
A004,Database Read Replica,Database,DBA Team,eu-west-2 (AWS RDS),Restricted,PII,Critical
A005,Code Repository,Application,Engineering,github.com,Restricted,Source code,Critical
A006,SIEM Platform,Monitoring,Security Team,us-east-1 (AWS EC2),Internal,Security logs,High
A007,Crm System,SaaS Application,Sales Team,salesforce.com,Confidential,Customer data,High
A008,DNS Primary,Network Service,Infra Team,colocation facility,Internal,DNS records,High
A009,DNS Secondary,Network Service,Infra Team,us-east-1 (AWS EC2),Internal,DNS records,High
A010,Email System,SaaS Application,All Employees,office365.com,Confidential,Emails & attachments,High
A011,Employee Laptops,Endpoint,Individual Employees,various locations,Confidential,Work data,Medium
A012,Physical Server 1,Physical Server,Infra Team,colocation facility,Confidential,Backup data,Medium
A013,Physical Server 2,Physical Server,Infra Team,colocation facility,Confidential,Backup data,Medium
EOF

# Example: R-001 (S3 misconfiguration)
cat > fair_analysis_r001.json << 'EOF'
{
  "risk_id": "R-001",
  "risk_name": "Unauthorised access to customer files via S3 misconfiguration",

  "threat_event_frequency": {
    "estimated_annual": 2.0,
    "confidence": "Medium",
    "rationale": "S3 misconfigurations are common, automated scanners detect them"
  },

  "vulnerability": {
    "probability_of_loss_event": 0.3,
    "confidence": "Low",
    "rationale": "Depends on how quickly misconfiguration is detected"
  },

  "loss_event_frequency": {
    "calculated": 0.6,
    "calculation": "TEF × ProbLossEvent = 2.0 × 0.3"
  },

  "primary_loss": {
    "magnitude_per_event": {
      "min": 50000,
      "most_likely": 200000,
      "max": 1000000
    },
    "description": "Customer notification, breach response, legal fees"
  },

  "secondary_loss": {
    "magnitude_per_event": {
      "min": 100000,
      "most_likely": 500000,
      "max": 2000000
    },
    "description": "Reputation damage, customer churn, regulatory fines"
  },

  "annualised_loss_expectancy": {
    "calculation": "LEF × (PrimaryLoss + SecondaryLoss)",
    "most_likely": 0.6 × (200000 + 500000) = 420000
  }
}
EOF

# A simple password
echo -n "Password123!" | md5sum
echo -n "Password123!" | sha1sum
echo -n "Password123!" | sha256sum

# Observe the differences in output length
echo -n "Password123!" | md5sum | wc -c
echo -n "Password123!" | sha256sum | wc -c

# Small change → completely different hash
echo -n "Password123!" | sha256sum
echo -n "Password123?" | sha256sum
echo -n "password123!" | sha256sum

# Are any characters the same? (They should not be — avalanche effect)

# Install bcrypt if needed
# macOS: brew install bcrypt
# Ubuntu/Debian: sudo apt install -y bcrypt

# Generate a bcrypt hash (cost factor 10)
python3 -c "
import bcrypt
password = b'Password123!'
salt = bcrypt.gensalt(rounds=10)
hashed = bcrypt.hashpw(password, salt)
print('Password: Password123!')
print('Hash:', hashed.decode())
print('Salt:', salt.decode())
print('Cost factor: 10')
"

# Try different cost factors
python3 -c "
import bcrypt
import time

for cost in [4, 8, 10, 12, 14]:
    start = time.time()
    salt = bcrypt.gensalt(rounds=cost)
    hashed = bcrypt.hashpw(b'Password123!', salt)
    elapsed = time.time() - start
    print(f'Cost {cost}: {elapsed:.3f}s to compute hash')
"

# Create a list of common passwords (DO NOT use these)
cat > test_passwords.txt << 'EOF'
password
123456
admin
letmein
Password123!
welcome
P@ssw0rd
sunshine
qwerty123
abc123
EOF

# Test each against a simple policy
python3 << 'PYEOF'
import re

passwords = open('test_passwords.txt').read().strip().split('\n')
policy = {
    'min_length': 12,
    'require_upper': True,
    'require_lower': True,
    'require_digit': True,
    'require_special': True,
    'common_words': ['password', 'admin', 'letmein', 'welcome', 'sunshine']
}

def check_policy(pwd):
    issues = []
    if len(pwd) < policy['min_length']:
        issues.append(f'Too short ({len(pwd)} < {policy["min_length"]})')
    if policy['require_upper'] and not re.search(r'[A-Z]', pwd):
        issues.append('Missing uppercase')
    if policy['require_lower'] and not re.search(r'[a-z]', pwd):
        issues.append('Missing lowercase')
    if policy['require_digit'] and not re.search(r'[0-9]', pwd):
        issues.append('Missing digit')
    if policy['require_special'] and not re.search(r'[^a-zA-Z0-9]', pwd):
        issues.append('Missing special character')
    if any(word in pwd.lower() for word in policy['common_words']):
        issues.append('Contains common word')
    return issues

print(f'{"Password":20s} {"Length":6s} {"Result":30s}')
print('-' * 56)
for pwd in passwords:
    issues = check_policy(pwd)
    result = 'PASS' if not issues else f'FAIL: {", ".join(issues)}'
    print(f'{pwd:20s} {len(pwd):6d} {result:30s}')
PYEOF

# Hash a password and check against Have I Been Pwned API (v3)
# k-anonymity: only send first 5 hex characters of SHA-1 hash

python3 << 'PYEOF'
import hashlib
import requests

def check_breached(password):
    sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
    prefix = sha1[:5]
    suffix = sha1[5:]

    resp = requests.get(f'https://api.pwnedpasswords.com/range/{prefix}')
    if resp.status_code == 200:
        for line in resp.text.split('\n'):
            if line.startswith(suffix):
                count = int(line.split(':')[1].strip())
                return count
    return 0

# Test some passwords
test_pwds = ['Password123!', 'correct-horse-battery-staple', 'hunter2']
for pwd in test_pwds:
    count = check_breached(pwd)
    status = '⚠ Breached!' if count > 0 else '✓ Not found'
    print(f'{pwd:35s} → Found in {count:,} breaches' if count > 0
          else f'{pwd:35s} → Not found in known breaches')
PYEOF

# Generate a private key
openssl genrsa -out server.key 2048
echo "✓ Generated RSA 2048-bit private key"

# Generate a certificate signing request (CSR)
openssl req -new -key server.key -out server.csr -subj "/C=US/ST=California/L=San Francisco/O=TechFlow Inc./CN=techflow.example.com"
echo "✓ Generated CSR"

# Self-sign the certificate (valid for 365 days)
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
echo "✓ Self-signed certificate created"

# View the certificate
openssl x509 -in server.crt -text -noout | head -20

# Connect to a real HTTPS server and examine the certificate chain
echo "=== Google TLS Certificate ==="
openssl s_client -connect google.com:443 -showcerts 2>/dev/null < /dev/null | head -30

echo ""
echo "=== GitHub TLS Certificate ==="
openssl s_client -connect github.com:443 -showcerts 2>/dev/null < /dev/null | head -30

# Check certificate dates
echo "=== Google Certificate Dates ==="
openssl s_client -connect google.com:443 2>/dev/null < /dev/null | openssl x509 -noout -dates

echo ""
echo "=== GitHub Certificate Dates ==="
openssl s_client -connect github.com:443 2>/dev/null < /dev/null | openssl x509 -noout -dates

# Check supported TLS protocols
echo "=== TLS 1.2 ==="
openssl s_client -connect google.com:443 -tls1_2 2>/dev/null < /dev/null | grep -i "cipher\|handshake failure"

echo ""
echo "=== TLS 1.3 ==="
openssl s_client -connect google.com:443 -tls1_3 2>/dev/null < /dev/null | grep -i "cipher\|handshake failure"

# Check which cipher suite is negotiated
echo ""
echo "=== Current Cipher Suite ==="
openssl s_client -connect google.com:443 2>/dev/null < /dev/null | grep -i "cipher"

# Check for weak protocols (TLS 1.0, TLS 1.1 — should be disabled)
echo "=== TLS 1.0 (Deprecated — Should Fail) ==="
openssl s_client -connect google.com:443 -tls1 2>/dev/null < /dev/null | grep -i "cipher\|handshake failure"

echo ""
echo "=== TLS 1.1 (Deprecated — Should Fail) ==="
openssl s_client -connect google.com:443 -tls1_1 2>/dev/null < /dev/null | grep -i "cipher\|handshake failure"

# Check your own test server's TLS score
# Run a basic TLS check
python3 << 'PYEOF'
sites = ['google.com', 'github.com', 'example.com', 'badssl.com']

for site in sites:
    print(f"\n{'='*50}")
    print(f"Checking: {site}")
    print('='*50)

    import subprocess
    import socket

    # Check if site supports TLS 1.2
    result = subprocess.run(
        ['openssl', 's_client', '-connect', f'{site}:443', '-tls1_2'],
        input='', capture_output=True, text=True, timeout=10
    )
    supports_tls12 = 'handshake failure' not in result.stderr.lower()

    # Check if site supports TLS 1.3
    result = subprocess.run(
        ['openssl', 's_client', '-connect', f'{site}:443', '-tls1_3'],
        input='', capture_output=True, text=True, timeout=10
    )
    supports_tls13 = 'handshake failure' not in result.stderr.lower()

    # Get certificate expiry
    result = subprocess.run(
        ['openssl', 's_client', '-connect', f'{site}:443'],
        input='', capture_output=True, text=True, timeout=10
    )

    # Extract certificate dates
    date_result = subprocess.run(
        ['openssl', 'x509', '-noout', '-dates'],
        input=result.stdout, capture_output=True, text=True, timeout=5
    )

    dates = date_result.stdout.strip().split('\n')
    not_before = dates[0].replace('notBefore=', '') if len(dates) > 0 else 'Unknown'
    not_after = dates[1].replace('notAfter=', '') if len(dates) > 1 else 'Unknown'

    print(f"  TLS 1.2: {'✓' if supports_tls12 else '✗'}")
    print(f"  TLS 1.3: {'✓' if supports_tls13 else '✗'}")
    print(f"  Valid from: {not_before}")
    print(f"  Valid until: {not_after}")
PYEOF