Introduction to my project at ALX: The Maze project involves creating a game using the SDL2 library in the C language. Essentially, it’s a labyrinth game where the goal is to find the exit.

Why did I choose such a project? It’s just a maze, not even made with the best free game engines like Unity or Unreal. Well, I wanted to explore how to make a game without a game engine and delve into the mathematics and physics behind it, including challenges like raycasting. Additionally, as I’ll be moving into AR/VR programming in video games next year, I wanted to conclude this year with a game project. For users, it’s a nostalgic trip to the old days of games like Wolfenstein 3D, showcasing that you don’t necessarily need sophisticated game engines like Unity or Unreal to create a game.

Why choose the SDL2 library and the C language? It’s straightforward — I wanted to make a game without a game engine using the backend language I’ve used the most this year, which is C. The immediate choice for coding without a game engine in C was the SDL2 library.

If I have the time to complete this project, I’d like to add a gun feature for the player and monsters, possibly spawning randomly around the player in the labyrinth until they find the exit. Or even a 1v1 scenario with guns in the labyrinth, without a way out.

While the project isn’t finished yet, the most challenging aspect so far is the Raycasting, which involves detecting forms through rays from the “camera” in the player and rendering it in a window.

In essence, raycasting is all about mathematics, and since I have minimal knowledge in this domain, it’s proven to be quite challenging for me.

I am Abel Sekibaala, exploring general programming and learning various facets of coding. I’ve chosen to specialize in video games in AR/VR (Augmented Reality/Virtual Reality) next year because of my passion for video games and the belief that these technologies represent the future of gaming.

It was a pleasure sharing this preview of my future completed project, and I hope you enjoyed it.

Links
Github:https://github.com/asekibaala/alx-maze_project

**Issue Summary:**

- **Duration:** May 15, 2023, 08:00 AM (UTC) to May 17, 2023, 10:00 AM (UTC)

- **Impact:** Degraded service resulting in a 30-minute downtime for affected users, impacting approximately 15% of our user base.

- **Root Cause:** Outdated NGINX server version, leading to an uncontrolled generation of logs, filling up server storage.

**Timeline:**

- **Detection:** May 15, 2023, 08:15 AM (UTC)

- **Detected by:** Automated monitoring alert for abnormal server storage usage.

- **Actions Taken:** Investigated NGINX server logs, checked server health, and reviewed recent changes.

- **Misleading Paths:** Initially assumed a sudden influx of traffic; however, traffic logs disproved this theory.

- **Escalation:** Incident escalated to the DevOps team for further analysis.

- **Resolution:** NGINX server patched to the latest version, log rotation implemented to prevent overflow.

**Root Cause and Resolution:**

- **Root Cause:** The NGINX server was running an outdated version, lacking crucial log rotation features. As a result, logs were continuously generated and not properly managed.

- **Resolution:** Updated NGINX to the latest stable version, and implemented log rotation to prevent excessive log accumulation. This ensured that logs were systematically managed, avoiding a storage overflow.

**Corrective and Preventative Measures:**

- **Improvements/Fixes:**

1. **Regular Update Protocol:** Establish a routine for regular updates of server software to prevent running on outdated versions.

2. **Enhanced Monitoring:** Improve monitoring systems to detect anomalies in real-time, allowing for quicker response to potential issues.

- **Tasks to Address the Issue:**

1. **Patch NGINX Server:** Ensure that all servers are running the latest version of NGINX.

2. **Implement Regular Log Rotation:** Set up log rotation schedules to prevent log files from consuming excessive disk space.

3. **Enhance Monitoring Alerts:** Fine-tune monitoring alerts to detect storage anomalies promptly.

4. **Conduct Regular Audits:** Regularly audit server configurations and software versions to identify potential vulnerabilities.

**Conclusion:**

This incident underscores the critical importance of keeping server software up to date. The outdated NGINX server led to an unexpected log overflow, impacting a significant portion of our user base. Moving forward, we commit to a more vigilant approach, ensuring regular updates, enhanced monitoring, and proactive measures to prevent similar incidents. The outlined corrective actions will be swiftly implemented to fortify our infrastructure against such issues, guaranteeing a more resilient and reliable service for our users.

Have you ever wondered what happens when you type a URL into your browser’s address bar and hit Enter? This seemingly simple action actually initiates a complex process involving multiple layers of technology and infrastructure.

In this article, we’ll delve into each step of this journey, exploring the intricate mechanisms that power the internet’s most popular search engine: Google. 🤓🔍

It all starts with a DNS request, which translates the human-readable domain name into an IP address that is required for communication on the internet.

Once the IP address is obtained, the browser initiates a TCP/IP connection, which is the foundation of internet communication. Before reaching Google’s servers, the request may pass through a firewall, acting as a gatekeeper 🚪, monitoring and filtering traffic based on predefined security rules. Once the request passes the firewall’s scrutiny, it proceeds to the next step.

Google enforces a secure connection using HTTPS 🔒, which encrypts data to prevent eavesdropping and tampering.

Load balancers are used to ensure efficient traffic distribution and prevent server overload. Upon receiving your request, a Google web server processes it, fetching web pages and generating responses.

Meanwhile, behind the scenes, Google’s application server manages the dynamic aspects of the web page, interacting with databases, processing search queries, and customizing content for your specific request. Google’s databases are distributed and highly optimized for rapid data retrieval. 💻📊

Each component plays a crucial role in delivering the Google search experience. Understanding this intricate process sheds light on the marvels of modern internet architecture. From DNS resolution to secure HTTPS connections, load balancing, web and application servers, and sprawling databases, there’s a complex symphony of technologies and infrastructure powering the seemingly simple act of typing a URL into your browser’s address bar. 🎶🌐

To effectively detect and respond to serious security incidents, it’s essential to have a comprehensive understanding of what constitutes normal network functioning. Networks, servers, and hosts exhibit predictable behaviours at any given point in time. ⌚️

Profiling the behaviour of these network components establishes a statistical baseline that serves as a reference point. When deviations from this baseline occur without a reasonable explanation, it could indicate a security breach.❌

Collecting baseline data requires meticulous attention to detail. All routine network operations should be included in the baseline, and it must remain current. Outdated network performance data no longer aligning with normal operations should be excluded. ⛔️

For instance, an increase in network utilization during periodic server backup operations is part of normal functioning and should be reflected in the baseline data. ✅

However, measuring traffic corresponding to external access to an internal server that has been migrated to the cloud should not be included. 🚫

The process of capturing an accurate baseline over the right period is known as sliding window anomaly detection. It defines a window that best represents network operations and purges outdated data. 💹

This process is periodically repeated to ensure that baseline statistics accurately depict network behaviour.📶

Anomalies that should raise security concerns include unusual spikes in WAN link utilization, which may indicate a network breach and data exfiltration. ❌

Additionally, hosts beginning to access obscure internet servers, resolving domains through dynamic DNS, or employing unnecessary protocols or services can signify compromise. ❌

Detecting deviations in network behaviour is challenging without a clear understanding of what constitutes normalcy.〽️

Key elements of network profiling include:

1. Session Duration: This refers to the time between establishing a data flow and its termination.🕒

2. Total Throughput: It quantifies the volume of data transferred from a specific source to a specific destination within a defined timeframe.🔁

3. Ports Used: This provides a list of TCP or UDP processes available for data reception.🔢

4. Critical Asset Address Space: This encompasses the IP addresses or logical locations of essential systems or data.🔢

Additionally, profiling the types of traffic typically entering and leaving the network is crucial for understanding network behaviour. 🛂

Malware often employs unusual ports not commonly seen during regular network operations. Examining host-to-host traffic is another vital metric, as most network clients communicate directly with servers. ☠️

An unexpected surge in traffic between clients may indicate lateral malware propagation within the network.💀

Understanding how individual users typically utilize the network is also pivotal in detecting potential compromises of user accounts. ☠️

Almost every computer system generates log files to keep a record of what it’s doing. Think of log files as journals where computers jot down their activities.

For security analysts, these logs are like treasure troves of information. By carefully watching these logs, security experts can uncover crucial insights.

Then there’s SNMP, which is a bit like having a direct line to network devices. It lets analysts ask questions and get real-time answers about how these devices are performing.

It’s another handy tool in the security toolkit, helping experts keep an eye on the network’s behaviour.

Security analysts need to be well-versed in all these tools. It’s part of their job description.

Now, let’s talk about network protocol analyzers, or what we can call “digital traffic inspectors.” These programs are like traffic cops for computer networks.

They can stop and look at every bit of information travelling through the network, kind of like how a detective examines clues at a crime scene.

For instance, if a computer has gone rogue and is attacking others in the network, these analyzers can catch it in the act by monitoring and scrutinizing every piece of data.

But here’s the cool part: these analyzers aren’t just for catching bad guys. They’re also like Swiss Army knives for network experts.

They help fix network glitches, create new software, and even teach us how networks communicate.

In the world of security forensics, these tools are crucial. They can help a security analyst reconstruct what happened during a security incident by looking at these captured packets of data.

Wireshark is the superhero of network protocol analyzers. It’s like a powerful microscope for your network, revealing all the tiny details of how devices talk to each other.

What’s even better? It’s free and can be used by anyone on Windows, Linux, or Mac. Learning how to use Wireshark is a must for cybersecurity experts.

Wireshark saves all the data it captures in something called a PCAP file. These files are like treasure chests, holding information about each piece of data, where it came from, and when it arrived.

But beware, capturing data over a long time can fill your PCAP files with a lot of information.

And guess what? Wireshark can also read files from other similar tools like tcpdump, which is a favourite among computer systems that resemble UNIX.

For the Windows crowd, there’s windump, and for those who prefer command lines, there’s tshark, which is like a cousin of tcpdump.

So, these tools aren’t just for security; they’re like Swiss Army knives for anyone working with computer networks, making them essential for cybersecurity analysts.

Effective access control is a fundamental requirement for safeguarding an organization’s network resources, information systems, and sensitive data.

Security analysts play a critical role in understanding various basic access control models, which helps them comprehend potential vulnerabilities that attackers might exploit.

Access Control Models

1. Discretionary Access Control (DAC)

DAC is the least restrictive access control model, granting users control over their data as its owners. Access can be managed through Access Control Lists (ACLs) or similar mechanisms, specifying which users or groups have permission to access the information.

2. Mandatory Access Control (MAC)

MAC is the most stringent model, commonly used in military or critical applications. It assigns security labels to information and permits access based on users’ security clearance levels. Only those with the appropriate clearance can access data.

3. Role-Based Access Control (RBAC)

RBAC makes access decisions based on an individual’s roles and responsibilities within the organization.

Security privileges are assigned to different roles, and individuals are associated with an RBAC profile based on their role, job classification, or group.

4. Attribute-Based Access Control (ABAC)

ABAC allows access based on attributes of both the resource (object), the user (subject), and environmental factors like the time of access. This model offers fine-grained control by considering multiple attributes.

5. Rule-Based Access Control (RBAC)

Network security staff define rules or conditions for data or system access. These rules may specify permitted or denied IP addresses, protocols, or other conditions, providing a more customized control mechanism.

6. Time-Based Access Control (TAC)

TAC grants access to network resources based on specific time and day parameters, allowing organizations to enforce time-specific access policies.

Bonus

Principle of Least Privilege (PoLP)

Another crucial concept is the Principle of Least Privilege, which advocates granting users and processes only the minimal access necessary for their specific job roles.

This principle minimizes the potential attack surface by restricting unnecessary access.

Privilege Escalation: Privilege escalation is a common exploit where vulnerabilities in servers or access control systems are manipulated to grant unauthorized users or processes elevated privileges.

Once elevated access is obtained, threat actors can potentially access sensitive information or take control of a system, highlighting the critical importance of robust access control mechanisms.

Understanding these access control models and adhering to the Principle of Least Privilege is vital for effective security management and protecting an organization’s assets from unauthorized access and potential breaches.

Zero trust is a comprehensive strategy for securing access across networks, applications, and various environments.

This approach is designed to protect against unauthorized access from a wide range of sources, including users, end-user devices, APIs, IoT devices, microservices, containers, and more.

The core principle of zero trust is to “never trust, always verify.” This means that every access request, regardless of its source, should be thoroughly authenticated and validated.

By implementing a zero trust security framework, organizations can prevent unauthorized access, contain breaches, and reduce the risk of lateral movement by attackers within their networks.

In the traditional security model, the network perimeter, or edge, served as the boundary between trusted and untrusted domains.

However, in the zero trust paradigm, any point where an access control decision is required is treated as a potential perimeter.

This implies that even if a user or entity has passed access control at one point, they are not automatically trusted to access another area or resource without further authentication.

In some cases, users may need to authenticate multiple times and through different methods to access different network layers.

The zero-trust approach is built on three fundamental pillars:

1. Zero Trust Workforce: This pillar focuses on individuals, such as employees, contractors, partners, and vendors, who access work-related applications using either personal or corporate-managed devices.

Its primary goal is to ensure that only authorized users with secure devices can access applications, regardless of their location.

2. Zero Trust Workloads: This pillar addresses applications running in diverse environments, including the cloud, data centers, and virtualized settings, which often interact with each other.

It emphasizes secure access control when APIs, microservices, or containers within an application need to access a database or other resources.

3. Zero Trust Workplace: The workplace pillar extends zero trust principles to all devices, including those within the Internet of Things (IoT), that connect to enterprise networks.

This encompasses a wide array of devices, such as user endpoints, physical and virtual servers, printers, cameras, HVAC systems, kiosks, infusion pumps, industrial control systems, and more, all requiring secure access controls.

By applying a zero-trust framework across these three pillars, organizations can create a more robust and adaptive security posture that addresses the evolving challenges of modern network security.

The overarching goal is to ensure that trust is never assumed, and verification is a continuous and mandatory process for any entity seeking access to network resources.

The process of collecting digital evidence is a crucial aspect of investigations, and RFC 3227, often referred to as ETF (Evidence Transfer Protocol) RFC 3227, offers valuable guidelines for this purpose.

It recommends an order for collecting digital evidence based on the data’s volatility, prioritizing the most volatile information that could be lost or altered easily.

Here’s the suggested order for collecting digital evidence, from most volatile to least volatile:

1. Memory Registers and Caches: These contain extremely volatile data, which can be lost when the device is powered off. Additionally, routine machine processes can overwrite this information.

2. Routing Table, ARP Cache, Process Table, Kernel Statistics, and RAM**: These elements in a system hold critical data that resides in volatile memory.

3. Temporary File Systems: While relatively more stable than RAM, temporary file systems can still change or be modified during system operations.

4. Non-Volatile Media (Fixed and Removable): This category encompasses data stored on non-volatile devices like hard drives or USB drives. It’s less susceptible to immediate loss compared to volatile memory.

5. Remote Logging and Monitoring Data: Information collected from remote sources, such as logs or monitoring tools, is relatively stable but should still be acquired early in the process.

6. Physical Interconnections and Topologies: This data relates to the network’s structure and physical components, providing context for the digital evidence.

7. Archival Media (Tape or Other Backups): Archival media contains the most stable data, often serving as a historical record. It should be collected last.

In addition to following this ordered approach, it’s essential to maintain meticulous records of the systems from which evidence is gathered. These records should include comprehensive information about who has access to these systems and at what permission levels.

Details about the hardware and software configurations of the source systems should also be documented. This level of detail ensures transparency and helps establish the authenticity and integrity of the collected digital evidence.

In summary, RFC 3227 provides a structured framework for collecting digital evidence, prioritizing volatile data to prevent its loss or alteration.

This process, combined with thorough documentation of system details and access permissions, contributes to the credibility and effectiveness of digital investigations.

Developing well-documented processes and procedures for digital forensic analysis is of utmost importance for organizations, for several critical reasons.

Firstly, regulatory compliance often mandates the creation of such documentation.

These regulations may require organizations to have established procedures for handling digital evidence, especially in cases related to data breaches or cybercrimes.

Moreover, authorities conducting public investigations can scrutinize these documents to ensure that an organization follows proper forensic practices.

NIST Special Publication 800–86,”Guide to Integrating Forensic Techniques into Incident Response,” serves as a valuable resource for organizations seeking guidance on developing digital forensics plans. This publication recommends a structured four-phase process for conducting forensics:

1. Collection: This phase involves identifying potential sources of forensic data and the subsequent acquisition, handling, and secure storage of this data. It’s a critical stage where extreme caution is necessary to avoid damaging, losing, or omitting crucial data.

2. Examination: In this phase, forensic experts assess and extract pertinent information from the collected data. This may entail processes like decompression or decryption of data. Irrelevant data may also need to be filtered out. Identifying relevant evidence within extensive datasets can be a laborious and challenging task.

3. Analysis: During this stage, conclusions are drawn from the data. Notable features, such as individuals, locations, timestamps, events, and more, are meticulously documented. Additionally, data from various sources may be correlated to gain a comprehensive understanding of the situation.

4. Reporting: The final phase involves preparing and presenting the findings resulting from the analysis. It’s imperative that reporting remains impartial, presenting facts without bias.

If appropriate, alternative explanations should be explored. Limitations encountered during the analysis, as well as any challenges faced, should be transparently included in the report. Moreover, the report should offer suggestions for further investigation and outline the next steps to be taken.

After identifying and validating alerts in a cybersecurity investigation, the handling of evidence becomes a critical aspect. Cybersecurity analysts frequently come across evidence of criminal activities during their investigations.

To safeguard the organization and combat cybercrime effectively, it’s imperative to not only identify threat actors but also to report them to the appropriate authorities, substantiate the findings with concrete evidence, and support potential prosecution.

Often, Tier 1 cybersecurity analysts are the first to uncover these illicit activities, so it’s essential that they are well-versed in the proper procedures for handling evidence and attributing it to the responsible threat actors.

Digital forensics plays a crucial role in this process. It involves the retrieval and examination of digital information from various digital devices in connection with criminal activities.

Indicators of compromise serve as the evidence that a cybersecurity incident has indeed occurred.

These indicators can manifest as data stored on devices, information in volatile computer memory, or traces of cybercrime preserved within network data, such as pcaps and logs.

Preserving all indicators of compromise is paramount for future analysis and determining the source of the attack.

Cybercriminal activities can broadly be categorized as originating either from within or outside the organization.

Private investigations are typically focused on individuals within the organization, who may be engaging in activities that breach user agreements or involve non-criminal misconduct.

However, when suspicions arise that individuals are involved in criminal activities like theft or destruction of intellectual property, the organization may choose to involve law enforcement authorities, making the investigation a public matter.

Internal users might also misuse the organization’s network for unrelated criminal activities, necessitating involvement by public officials to conduct the investigation.

In cases where external attackers have exploited the network, possibly stealing or altering data, gathering evidence becomes critical to document the extent of the breach.

Various regulatory bodies stipulate specific actions that organizations must take when different types of data have been compromised.

Forensic investigation results can help identify the necessary steps that need to be taken to address the situation adequately.