🛡️ Securing the Perimeter

A cybersecurity project focused on redesigning network architecture, implementing SIEM solutions, and adopting a Zero Trust model to enhance the security posture of a cryptocurrency exchange following a critical breach.

📘 Project Scenario

Client: XYZ - A global cryptocurrency exchange

Incident: A major breach led to the theft of over 500 BTC due to:

• Insecure network design
• No firewalls or access restrictions
• Flat, unsegmented networks
• Improper server placements

Objective: As a consultant from SecureCorp, your task is to:

1. Redesign the network architecture securely
2. Implement a SIEM for monitoring
3. Adopt a Zero Trust approach

---

🧩 Sections

🔒 1. Designing a Secure Network Architecture

❌ Identified Vulnerabilities

• Direct Internet Access to All Servers: No NAT/firewall, all ports open
• Flat Network Design: No segmentation allows lateral movement
• Misplaced File Server: Sensitive data exposed in public subnet

✅ Solutions

• Network segmentation via subnets (DMZ, internal, private)
• Proper firewall configurations
• VPN access to internal/file servers

---

🏗️ 2. Building the Network in VirtualBox

🕸️ Virtual Networks Setup

• VNet-DMZ (Host-Only Adapter 1 & 2): Public & Private DMZ
• VNet-Internal (Host-Only Adapter 3): Internal Segment

🔌 Subnets

• Public-DMZ: For exposed services like web servers
• Private-DMZ: For secure services like ELK server
• Internal: For backend systems and sensitive data

---

📊 3. Continuous Monitoring with SIEM

🛠️ Tools Used

• Filebeat: Installed on Web Server to forward logs
• ELK Stack: Hosted in Private-DMZ to visualize and analyze logs via Kibana

📈 Key Benefits

• Real-time threat detection
• Enhanced visibility and alerting
• Integration with other security tools
• Centralized visibility across the stack

---

🔐 4. Zero Trust Architecture

Model Used: Device Agent & Gateway

🔍 Key Principles

• Trust nothing, verify everything (even internal devices)
• Least privilege access per session
• Continuous monitoring of all assets

🧠 Benefits

• Stops lateral movement
• Secure access for remote and BYOD environments
• Real-time visibility and response

---

📦 Components Overview

Component	Purpose	Network Location	IP Address
Web Server	Hosts public-facing services	Public-DMZ	192.168.10.9
ELK Server	Centralized log monitoring	Private-DMZ	192.168.20.7
Filebeat	Log shipping from Web Server	Installed on Web Server	N/A

---

🛡️ Security Highlights

• Firewalls: Protect entry/exit points of each subnet
• VPN: Secure access to file storage
• SIEM: Log correlation and real-time alerts
• Zero Trust: No implicit trust within the network

---

🏁 Getting Started

To run this project:

1. Install VirtualBox
2. Create three virtual networks using Host-Only Adapters
3. Configure the subnets as per the design
4. Deploy Web Server, ELK Stack, and Filebeat accordingly
5. Set up firewall rules and test connectivity
6. Monitor logs via Kibana (http://192.168.20.7:5601)

---

📚 Learn More

• Zero Trust Architecture
• ELK Stack Documentation
• Filebeat Setup Guide

---

✍️ Author

Deekshith A
Cybersecurity Consultant | Network Defender

---

🧾 License

This project is for educational and demonstration purposes only.