Conduct a Network Security Analysis in a Sanctioned Environment

Proof required

Submit: five Wireshark captures (pcap files) each demonstrating one security-relevant event, with a written analysis (at least 150 words per event) documenting what was observed, why it is a security concern, and the correct countermeasure; and evidence the captures are from real traffic in a controlled environment you own — not downloaded sample pcap files. A security practitioner, network engineer, or CS lecturer with security experience must confirm the analyses are accurate.

What gets checked

• Five distinct capture files — each showing a different security-relevant event
• Captures are from real traffic in a controlled environment you own — not downloaded sample files
• A security practitioner has confirmed the analyses and countermeasures are accurate

Common mistakes

• Using downloaded sample pcap files rather than capturing traffic from a controlled environment
• Analyses that name the security concern without explaining why the observed traffic pattern indicates it

Resources

What a verifier looks for

• Are the captures from a controlled environment — not downloaded samples?
• Does each analysis explain why the traffic pattern is a security concern — not just name the concern?
• Ask: 'why does ARP spoofing work despite ARP being a Layer 2 protocol?' — tests understanding of the protocol mechanism

Proof required

Submit: a structured network security assessment report (at least 800 words) covering network enumeration, service fingerprinting, vulnerability identification, and one controlled exploitation — each section with findings, methodology, and screenshots of your own terminal and target; and evidence the assessment was on a system you own (VM IP address in a private range, VM setup documentation). A security practitioner or penetration tester must review and confirm the methodology is sound.

What gets checked

• Assessment is on a system you own — private range IP, VM setup documentation included
• Report covers all four phases with findings, methodology, and screenshots from your terminal
• A security practitioner or penetration tester has confirmed the methodology is sound

Common mistakes

• Assessment conducted on a system you do not own — all testing must be on systems you control
• Report that describes tools used without documenting the specific findings from the assessment

Resources

What a verifier looks for

• Is the assessment on a system you own — private range IP, VM documentation?
• Does the report document actual findings from each phase — not describe the tools used?
• Ask: 'what would an attacker do next after the exploitation step in your report?' — tests understanding of the kill chain

Proof required

Submit: a professional security assessment report (at least 1,000 words) with executive summary, severity-ranked findings with CVSS scores, evidence appendix, and remediation recommendations; and a recording or transcript of a presentation to a security practitioner who challenged at least two severity ratings or remediations.

What gets checked

• Findings include CVSS scores with justification for each severity rating
• Remediation recommendations are specific and actionable — not generic advice
• A security practitioner challenged at least two severity ratings or remediations in the documented presentation

Common mistakes

• CVSS scores assigned without justification — the score must be derived from the specific vulnerability attributes
• Remediations that say 'patch the system' without specifying the specific patch, configuration, or design change

Resources

What a verifier looks for

• Do findings include CVSS scores with justified severity ratings?
• Are remediation recommendations specific — not generic 'patch the system'?
• Were at least two severity ratings or remediations challenged in the documented presentation?