CASE STUDY / Defensive laboratory

Cybersecurity Network Lab

A segmented environment for practicing defensive network engineering.

A concise technical study of how a virtual enterprise-style lab supports repeatable firewall, IDS and traffic-analysis exercises.

Tools

GNS3 · VMware · pfSense · Snort · Wireshark · Nmap · Linux

Frameworks

NIST CSF 2.0 · Defense in depth

01 / Overview

From context to a defensible security objective.

Context

Personal and academic laboratory work performed on isolated virtual systems.

Objective

Build a safe environment for observing traffic, validating segmentation decisions and documenting defensive controls.

Scope
  • DMZ and internal zones
  • Firewall policy validation
  • IDS alert review
  • Controlled discovery
Results
  • Laboratory environmentCreated a reusable environment for controlled network-security validation.
  • Validation workflowSeparated observation, testing and remediation into repeatable steps.
02 / Methodology

A repeatable path from discovery to validation.

  1. 01Design
  2. 02Build
  3. 03Baseline
  4. 04Test
  5. 05Observe
  6. 06Harden
  7. 07Retest
03 / Architecture

Security boundaries made understandable.

A fictitious topology designed for repeatable exercises rather than production use.

Laboratory path

  1. Internet simulation
  2. pfSense
  3. DMZ
  4. Internal network
  5. Monitoring

Illustrative architecture only — no real organization, internal address, hostname or confidential topology is represented.

Tools
  • GNS3
  • VMware
  • pfSense
  • Snort
  • Wireshark
  • Nmap
  • Linux
Security frameworks
  • NIST CSF 2.0
  • Defense in depth
06 / Lessons learned

What the work changed in the way security is approached.

01

A firewall rule is not validated until both allowed and denied paths are tested.

02

Baselines make IDS alerts easier to interpret and tune.