Davindernain Singh Sehgal

While creating this incident response playbook, I considered three scenarios: unauthorized access to data, a SQL injection attack, and a leaked meeting link (for example, a link to an important shareholder Zoom meeting).

I followed the NIST incident response framework and researched the MITRE ATT&CK framework in depth to complete the playbook.

achievement: mapped over 92% of attack techniques and reduced response time by 15 days per stage

open playbook.pdf

I carried out extensive passive reconnaissance of two online merchandise stores, TheSouledStore and Youthiyapa.com. The goal was to assess their cybersecurity posture and identify vulnerabilities and weaknesses that could put their operations and customers at risk.

I wrote a research paper outlining the methodology and findings. Using advanced open-source intelligence (OSINT) techniques and 8+ tools, including SpiderFoot, Maltego, Shodan and Dig, I documented open ports, DNS records, Common Vulnerabilities and Exposures (CVEs) and publicly available data about both sites. This gave a clear picture of each site's attack surface and the exposed areas an attacker could exploit.

The paper identifies specific weaknesses and exploitable vulnerabilities, and offers actionable recommendations to help the site owners strengthen their defenses and protect customer information.

open TheSouledStore reportopen Youthiyapa report

This project was a thorough risk assessment using both qualitative and quantitative analysis, focused on improving security measures and compliance with federal regulations. It was based on a detailed review of the HGA case study and the NIST framework.

I evaluated the organization's security controls across Management, Operations and Technical (M-O-T) aspects, identifying strengths and areas for improvement, and applied attack prevention and response techniques to develop a security strategy that mitigates potential threats.

Compliance with federal regulations was a primary consideration throughout. I made sure the security measures and risk management practices aligned with relevant regulatory requirements. The assessment gives a holistic view of the organization's security posture, with recommendations to strengthen its defenses, safeguard assets and improve resilience.

achievement: curated threat-vulnerability pairs to assess attack likelihood and documented the potential impact on assets valued at over $600,000

open assessment.pdf

I conducted forensic investigations on multiple Windows machines and mobile devices with FTK Imager and Autopsy. The goal was to examine files created, opened and stored across four systems and various external devices, and uncover evidence for four scenarios: an insider threat, employee harassment through email, a malware infection, and other potential security incidents.

I applied advanced forensic techniques to extract and preserve evidence, and followed chain of custody strictly so the evidence would be admissible in legal proceedings.

Insider threat: I examined user activity, file access patterns and system logs to find malicious or unauthorized actions. Email harassment: I analyzed emails, attachments and metadata to determine the source and nature of the harassment. Malware infection: I analyzed system artifacts and network logs to trace where the malware came from, how it spread and how far it reached. Other incidents: I looked across the four systems and external devices for suspicious or anomalous activity.

For each scenario I delivered a report with findings, analysis and recommendations, giving the organization what it needs for informed decisions, possible legal action and stronger security measures.

Because of policy restrictions, I can't share the full documents. This is the conclusion page from one of the case studies.

This technical paper investigates how to implement a strong governance, risk and compliance (GRC) response to malware, with an emphasis on ransomware. The goal was to develop effective strategies for both technical and non-technical incident scenarios.

I researched how ransomware attacks work in order to build efficient, tailored responses that reduce the impact of an incident. Through that research I refined five or more ransomware prevention methods and incident response strategies, designed to prevent attacks and to keep the business running if one happens.

The paper takes a holistic approach to ransomware by integrating GRC best practices, with insights and recommendations for organizations that want to strengthen their defenses, protect their assets and improve risk management and compliance.

open paper.pdf

In this project I set up and configured a pfSense firewall and the Snort intrusion detection system (IDS) to enforce zero-trust policies across two local networks. Under zero trust, no device or user gets implicit trust, and all traffic is checked before it can reach network resources.

I used pfSense and Snort to inspect and analyze network packets in real time, which made it possible to spot unusual activity and potential threats quickly. I also analyzed Nmap scans and reviewed network traffic signatures to find vulnerabilities and potential attack vectors and close them before they could be used against the network.

Because of my university's policies, I can't share the entire project or its rules, so I'm sharing the results at the end of each lab to show what I learned.

open IDS results.pdf

I wrote an extensive research paper on digital forensics, with an emphasis on network and mobile device forensics. It gives an overview of the methods, tools and techniques used in these branches and why they matter in fighting cyber threats.

The project covered three major branches of digital forensics, with strategic improvements aimed at making them more effective at responding to changing cyberspace challenges and supporting investigations.

I also developed and presented a strategic guide for cyber investigators, covering best practices and methods for carrying out digital forensics. After the guide was put in place, new investigators handled later forensics investigations 20% more effectively.

result: 20% improvement in new investigators' ability to handle forensics investigations

open paper.pdf

A self-study threat model of a typical multi-branch public library network. It covers the architecture and trust boundaries, a ranked register of fifteen threats mapped to ATT&CK techniques and NIST controls, extra factors from a large library system's wider footprint, and a 30, 90 and later action plan.

This is an illustrative reference model and a learning exercise. It does not describe any real organization's environment.

read the write-up