Technical Skills Demonstrated

This capstone project demonstrates hands-on competency across the complete security engineering lifecycle.

Core Security Competencies

Penetration Testing & Offensive Security

Web Application Exploitation

✅ SQL Injection (authentication bypass via tautology)
✅ Path Traversal (filter bypass via obfuscation)
✅ Broken Access Control / IDOR (object reference enumeration)
✅ Payload crafting and attack execution
✅ Response analysis and success validation

Attack Methodology

✅ Vulnerability research and analysis
✅ Exploit development and testing
✅ Traffic generation and evidence capture
✅ Proof-of-concept execution
✅ Impact assessment and documentation

Network Security Architecture

Network Design

✅ Three-tier network segmentation (WAN, Firewall, LAN)
✅ Defense-in-depth principle implementation
✅ Least-privilege access control design
✅ Zone-based architecture
✅ Zero-trust network principles

Firewall Configuration

✅ Access control list (ACL) design and implementation
✅ Stateful firewall rules
✅ Port-level filtering
✅ Traffic shaping and policy enforcement
✅ DMZ architecture planning

Detection Engineering & IDS/IPS

Custom Signature Development

✅ Suricata rule authoring
✅ Protocol-aware pattern matching
✅ HTTP/HTTPS inspection
✅ Payload analysis and fingerprinting
✅ CWE-mapped rule development

Detection Tuning

✅ False-positive minimization
✅ True-positive validation
✅ Confidence level assessment
✅ Threshold-based detection (behavioral)
✅ Alert correlation and validation

IDS/IPS Technologies

✅ Suricata deployment and configuration
✅ Rule loading and syntax validation
✅ Alert generation and analysis
✅ Performance optimization
✅ Inline blocking rules

Network Forensics & Traffic Analysis

Packet Analysis

✅ Wireshark packet inspection
✅ HTTP stream extraction
✅ TCP/IP protocol analysis
✅ Payload extraction from packets
✅ Timestamp correlation

Evidence Collection

✅ Packet capture (tcpdump, Wireshark)
✅ PCAP file analysis
✅ Network indicator extraction
✅ Chain-of-custody documentation
✅ Forensic evidence preservation

Threat Hunting

✅ Malicious traffic identification
✅ Command-and-control detection
✅ Data exfiltration recognition
✅ Lateral movement detection
✅ Post-exploitation activity analysis

Incident Response & SOC Operations

Incident Triage

✅ Alert validation
✅ False-positive assessment
✅ Severity determination
✅ Impact analysis
✅ Containment strategy

Investigation Methodology

✅ Timeline reconstruction
✅ Root cause analysis
✅ Attack chain documentation
✅ Evidence correlation
✅ Incident reporting

SOC Workflow

✅ Alert processing
✅ Log correlation
✅ Escalation procedures
✅ Documentation standards
✅ Communication with stakeholders

Technical Tool Proficiency

Network & Security Tools

Tool	Proficiency	Use Case
Wireshark	Expert	Packet capture, HTTP stream analysis, protocol inspection
Suricata	Intermediate	IDS/IPS deployment, custom rule development, alert management
Kali Linux	Intermediate	Attack execution, penetration testing, security tools platform
tcpdump	Intermediate	Command-line packet capture, traffic filtering
pfSense	Intermediate	Firewall configuration, network segmentation, IDS integration

Operating Systems

OS	Proficiency	Context
Linux (Ubuntu/Kali)	Intermediate	Server administration, attack platform, network tools
FreeBSD (pfSense)	Beginner	Firewall administration, IDS deployment
macOS	Intermediate	Lab hosting via UTM, development environment

Virtualization & Lab Tools

Platform	Experience
UTM	Lab environment for Mac Apple Silicon
VMware/VirtualBox	Multi-VM network design
Docker	Application containerization (Juice Shop)
Cisco Packet Tracer	Network simulation and design

Cybersecurity Frameworks & Methodologies

MITRE ATT&CK Framework

✅ Tactic identification (Initial Access, Execution, Persistence, etc.)
✅ Technique mapping (T-number classification)
✅ Attack chain documentation
✅ Defense mapping to ATT&CK techniques
✅ Threat actor profiling

Threat Modeling

✅ STRIDE methodology
✅ Attack surface analysis
✅ Threat identification
✅ Risk assessment
✅ Mitigation planning

Risk Management

✅ Vulnerability assessment
✅ Impact analysis
✅ Probability determination
✅ Risk matrix creation
✅ Control prioritization

Compliance & Standards

✅ ISO/IEC 27001 (Information Security Management)
✅ ISO 31000 (Risk Management)
✅ CWE (Common Weakness Enumeration) mapping
✅ Defense-in-depth principle
✅ Least-privilege access control

Domain Knowledge

Web Application Security

Common Web Vulnerabilities

✅ SQL Injection (CWE-89)
✅ Path Traversal (CWE-22)
✅ Broken Access Control (CWE-639)
✅ Cross-Site Scripting (XSS)
✅ Cross-Site Request Forgery (CSRF)
✅ Insecure Deserialization

OWASP Top 10

✅ Understanding of OWASP vulnerabilities
✅ Real-world exploitation examples
✅ Defensive countermeasures
✅ Detection strategies

Network Protocols

Protocols Analyzed

✅ HTTP/HTTPS (web traffic)
✅ TCP/IP (network layer)
✅ DNS (domain resolution)
✅ SMB (file sharing)
✅ SSH (remote access)
✅ TLS/SSL (encryption)

Protocol Abuse Techniques

✅ Man-in-the-Middle (MITM)
✅ ARP spoofing
✅ DNS tunneling
✅ Command-and-control beaconing
✅ Data exfiltration methods

Malware & Threat Intelligence

Malware Analysis Concepts

✅ Indicators of Compromise (IoCs)
✅ Malware behavior patterns
✅ Network signatures
✅ Threat actor tactics
✅ Command-and-control infrastructure

Threat Intelligence Practices

✅ Indicator extraction
✅ Threat actor profiling
✅ Campaign tracking
✅ Historical attack analysis
✅ Intelligence reporting

Soft Skills & Professional Competencies

Communication & Documentation

Technical Writing

✅ Attack documentation
✅ Detection rule explanation
✅ Architecture diagrams
✅ Incident case files
✅ Professional reports

Presentation Skills

✅ Live technical demonstrations
✅ Speaker notes and scripts
✅ Q&A preparation
✅ Complex concept explanation
✅ Non-technical stakeholder briefing

Problem-Solving & Analysis

✅ Systematic troubleshooting
✅ Root cause analysis
✅ Design problem-solving
✅ False-positive investigation
✅ Performance optimization

Security Mindset

✅ Attacker perspective (offensive thinking)
✅ Defender methodology (defensive architecture)
✅ Risk-based prioritization
✅ Compliance awareness
✅ Continuous improvement mindset

Certifications & Credentials

Current Certifications

✅ Google Cybersecurity Professional Certificate
✅ SOCOA Level 1
✅ Qualys Certified Associate (CA)
✅ Qualys CSAM (Security Asset Manager)

In Progress

🔄 CompTIA Security+ (SY0-701)

Recommended Next Steps

🎯 Certified Ethical Hacker (CEH)
🎯 Offensive Security Web Expert (OSWE)
🎯 GIAC Security Essentials (GSEC)

Project Application Examples

How Each Skill Was Applied

Penetration Testing → Executed three real attacks against OWASP Juice Shop
→ Demonstrated successful exploitation of common web vulnerabilities

Network Architecture → Designed three-tier network with firewall as chokepoint
→ Implemented least-privilege access controls

Detection Engineering → Engineered five custom Suricata signatures
→ Tuned rules to balance true positives vs. false positives

Forensics & Analysis → Captured evidence using Wireshark
→ Extracted payloads and indicators from network traffic

Incident Response → Documented complete attack chain and timeline
→ Created incident case file with recommendations
→ Provided tuning reflection for production deployment

Risk Management → Assessed vulnerabilities and their impact
→ Mapped to ISO 27001 and CWE standards
→ Prioritized controls based on risk assessment

Continuing Learning

This capstone represents foundational skills. Areas for continued development:

Advanced Threat Detection: Behavioral analytics, AI-based detection
Cloud Security: AWS/Azure/GCP network architecture
Advanced Exploitation: Kernel exploits, supply chain attacks
Malware Analysis: Reverse engineering, dynamic analysis
Threat Hunting: Proactive detection, pattern recognition
Security Architecture: Enterprise-scale design, compliance frameworks

Assessment Date: August 2, 2026
Skill Level: Intermediate (Fundamentals → Intermediate)
Next Assessment: After 6-12 months in SOC/Security Operations role

Faith Olajide

Cybersecurity & IT Support Specialist