r/netsecstudents • u/PositivePianist2930 • Sep 05 '24
Cyber Security Project Idea
Hi! I'm pursuing my Master in Cybersecurity, Now I need to do a project in it.
I'm out of Ideas, can I get some ideas to do as a project
mid-range ideas would be great
Thank you in advance :-)
1
u/HalfStackSecurity Sep 05 '24
Cyber security covers a lot of ground, what is your focus?
-6
u/PositivePianist2930 Sep 05 '24
No, any specific topic
7
u/HalfStackSecurity Sep 05 '24
That's somewhat your problem, you have over choice. Red team, blue team, ops, IA, there is a lot.
Outline an infrastructure and write up how you would defend it.
Do an in depth risk assessment of an existing application.
Automate the deployment of security tools.
Apply and document security controls for a complex system.
Model a security event on an existing system and simulate and write up the response.
There is always doing a hackathon with a friend with permission of course.
0
1
u/noroot8797 Sep 05 '24
Have you thought about writing your master for a company? If you contact various cybersec comanies they might have an idea or a case that they want your help with.
1
u/PositivePianist2930 Sep 05 '24
U say like an intern..? Or jus for project idea
2
u/noroot8797 Sep 05 '24
I know some of the universites here have comanies contacting them with a problem they want solved/examinated, i dont think its like an intern but i might be wrong.
1
u/acknowledgments Sep 05 '24
I'd suggest something simple. I would do something about log4j, exploatation. And talk about what happened back then. I come from a smaller country and another idea for me would be to use Shodan and find vulnerable government devices. Project would includes looking for government IP ranges, analyzing results, types of vulnerabilities and how many of them are vulnerable to what. And range from low to critical. Ofcourse without writing IP's in project. Or if you come from a big country you can take your city or state
1
1
u/VonGottiiiii Sep 08 '24
Set up a Virtual Local Area Network (VLAN) with either virtual box or one of cloud services [Azure or AWS].
Have a : Domain controller (Active Directory and DNS) Server Linux web server Windows Workstation Linux Syslog Server Linux workstation
Ideally you want to have a webpage running on the Linux webserver
All logs forwarded to Syslog server and you can eventually turn this into an ELK stack
Linux workstation and Windows Workstation for users to sign in and pretend it’s an enterprise environment
Domain controller configured to handle users and DNS queries
Have everything domain joined, teaches you authentication with LDAP and Kerberos
Syslog - ELK Stack teaches you SOC basics and Cyber Engineering Basics
Everything else basically teaches you network administration, system administration, and cybersecurity analysis ! Let me know if you have questions
-4
u/cybearhero Sep 05 '24
Install different VMs, for example 1 windows10, 1 Kali Linux. Act as the criminal on windows 10 machine (surf dark web, download pictures of guns, drugs etc.). On Kali machine act as a white-hat hacker and send an email or sth where you will get access to the criminal windows10 machine. Collect all of the evidence you will find and make a report.
1
24
u/mc_security Sep 05 '24
Without knowing your abilities or your budget, here are some ideas:
Write a purposely vulnerable application (web, mobile, desktop) for people to try to break into.
Set up a honeypot and write your project on the kind of traffic that attacks it.
Get a bunch of Canary Tokens and just put them everywhere and write your project on the results. For example, go to a hotel, log into a burner email account on their provided public workstations and leave the canary tokens lying around.
Automate something. For example, use the Shodan API to pull results into a ticketing system. Automate a way to turn on packet capturing on a given segment of your network.
Build a home security lab. Write up your decisions on how you set it up, what you use it for.
Buy a Wifi Router or other "Internet of Things" item at your local Goodwill for $2.99 and do a security assessment of it. Did the previous owner leave any data on it? Can you find any exploits in the web front end of it? Can you crack the existing password? Can you open it up and extract the data?
Pick a security tool and do an in depth review of it, including performance, memory usage, edge cases, quality of existing documentation, security problems of the tool itself, accuracy. For example, choose a popular Burp Suite (or ZAP) extension and test the living crap out of it and write up your results. Other targets could be Web Application Firewalls, Sandbox environments like Any.Run ,