Cybersecurity / Security Operations
Catnip Games International: SOC Automation and Incident Response Platform
This cybersecurity project presents the design and implementation of a prototype Security Operations Centre (SOC) automation and incident-response platform for Catnip Games International. The scenario addresses security challenges affecting a gaming organisation operating more than 300 Linux servers across two data centres, including credential-stuffing bot attacks, compromised player accounts, phishing campaigns and delayed coordination during security incidents. Catnip_Games_SOC_Complete Catnip_Games_SOC_Complete The proposed solution integrates TheHive 5, Cortex 3, Elasticsearch, Cassandra and Python-based automation, with MISP explored for threat-intelligence integration. TheHive functions as the central incident and case-management platform, Cortex provides automated observable analysis, Elasticsearch supports search and log storage, Cassandra provides persistent case and alert storage, and Python scripts automate alert ingestion and workflow activities through REST APIs. Catnip_Games_SOC_Complete Catnip_Games_SOC_Complete Implementation includes environment configuration, Docker deployment, API integration, automated alert generation, incident-response playbooks, KPI monitoring and backup procedures. Three attack scenarios are modelled: bot attacks, account takeover and phishing. Alerts are automatically ingested into TheHive, converted into cases and processed through analyst triage, investigation and resolution workflows. Catnip_Games_SOC_Complete Catnip_Games_SOC_Complete The project also develops structured response playbooks covering triage, containment, investigation, recovery and post-incident actions for each security scenario. Operational metrics are visualised through a KPI dashboard measuring alert volumes, response times, Mean Time to Detect (MTTD), Mean Time to Respond/Resolve (MTTR) and platform availability. Catnip_Games_SOC_Complete Catnip_Games_SOC_Complete Overall, the work demonstrates practical application of SOC architecture, security automation, incident management, threat analysis, containerised infrastructure, API-based integration, operational metrics and cyber-response procedures within a realistic gaming-industry security scenario. Catnip_Games_SOC_Complete Overview word count: approximately 330 words. Important before putting the presentation on a public Reference Library: redact any API keys/authentication tokens and other live credentials shown in the technical slides. The presentation includes API-key material in the Cortex and Python automation sections, so those credentials should also be revoked/rotated if they were ever active. Catnip_Games_SOC_Complete Catnip_Games_SOC_Complete
Read Model Answer →
Network Security and Incident Report
1,500 words
Network Security and Incident Report – Megadodo Publications
This 1,500-word individual coursework for the Network Security and Incident Report module examines the network infrastructure and security challenges of Megadodo Publications, a company located near Warwick that has expanded into two buildings, Ursa Major Alpha and Ursa Minor Beta. Despite investment in new networking equipment, the organisation is experiencing poor network performance and repeated security incidents involving the leakage of sensitive information into the public domain. The situation is particularly urgent because the company is negotiating an important government contract. The student is placed in the role of a network security professional asked to investigate the existing environment and provide recommendations for improving its infrastructure and security. The case study provides a network topology, addressing scheme, equipment information and an existing security policy. The network connects departments across the two buildings and includes servers, management systems, sales, marketing, legal, finance, software development, product testing, administration, IT support, Wi-Fi and a rented floor occupied by a separate start-up company. The addressing scheme identifies separate subnets for several organisational functions, while the topology includes multiple switches, routers, servers and wireless access points. The report requires students to make reasonable assumptions where information is incomplete and document those assumptions at the beginning of the report. The first substantive task evaluates how the organisation's network performance could be improved. Recommendations should address the existing infrastructure and, where the design is changed, include an appropriate network diagram using tools such as Packet Tracer or other suitable applications. The second major area addresses amendments to the existing security policy. Students should recommend improvements to the current policy rather than create a completely new policy. The report must also discuss how appropriate security measures could be implemented across the network and its devices. Detailed device configurations are not required, although relevant examples or configuration snippets are encouraged. The final section requires a summary of the key findings and recommendations, together with a proposal for how the organisation could use its remaining IT support budget of approximately £8,000 and identify areas for future investment. The assessment is divided into introduction, assumptions and requirements, improving performance, policy amendments, security and devices, summary and budget, and references. The marking scheme allocates 50% of the module mark to this coursework, with the individual report submitted as a single DOC, DOCX or PDF document.
Read Model Answer →