Anshul
Mehta

Worked through a simulated credential stuffing incident from initial SIEM alert to full containment. Identified attacker IPs as IOCs, disabled the compromised account, and isolated the affected server in under 20 minutes. Collected forensic evidence (memory dump, disk image, 72 hours of logs) and produced a 7-step remediation report.

Investigated a simulated ICMP flood DDoS attack that took all network services offline. Identified root cause and designed a response plan using all 5 NIST CSF functions — detection, firewall controls, staged isolation, and staged service recovery.

Four lab activities: ransomware IR kill-chain analysis, Wireshark PCAP inspection (protocol headers, display filters), live tcpdump capture from Linux CLI, and a VirusTotal SHA-256 investigation that confirmed a malicious attachment across 70+ AV engines.

Full internal controls and compliance audit for a simulated retail business. Risk Score 8/10 HIGH. Found 9 critical gaps including no IDS, unencrypted cardholder data, and no DRP. Mapped findings to PCI DSS, GDPR, SOC 1/2 with 8 prioritised recommendations.

Assessed a simulated Linux MySQL server under NIST SP 800-30. Scored 3 risk scenarios — hacker exfiltration at 9/9 CRITICAL. Recommended RBAC, MFA, TLS upgrade, and IP allow-listing, reducing projected risk from 9 to 3.

Audited a research team's directory using ls -la. Applied three targeted chmod fixes — removing world-write on a shared file, locking an archived file to read-only, and restricting directory access to the owner only.

Wrote 6 SQL security queries (AND/OR/NOT/LIKE) to filter login and employee data for active investigations. Built a Python script automating IP allow-list maintenance — reads, filters revoked entries, and rewrites the file cleanly.