Access Control Lab Part 2 - danniel-giri/SEC-250 GitHub Wiki

Deliverable 1: What does "Inbound connections" show for each profile (Domain, Private, Public)? What is the default behavior… block or allow? For each profile, inbound connections are enabled, but the default behavior is set to block.

Why might this default make sense from a security perspective? This makes sense from a security perspective because we don't want people sending anything malicious to our computers.

Deliverable 2:

Deliverable 3: Take a screenshot of a failed RDP session for your neighbors.

Deliverable 4: Take a screenshot of a failed ping from the blocked IP address.

Deliverable 5: Create an Attack Timeline

Deliverable 6: Answer these analysis questions What activity shows up in IIS logs but NOT in Event Viewer?

Website access attempts show up in IIS logs but not Event Viewer.

What activity shows up in Event Viewer but NOT in IIS logs?

RDP connection attempts show up in Event Viewer but not IIS logs

Which neighbor's blocked web attempts appear in your logs? Why?

Ryan's blocked web attempts appear in my logs. This is because he is trying to access it when access to the website is restricted.

If you saw 50 Event ID 4625 entries in 2 minutes, what would that indicate?

50 Event ID 4625 entries in 2 minutes indicates that someone was successfully able to login to a computer with RDP 50 times. How many failed login attempts before you'd investigate?

I would investigate after 5 failed login attempts because while people do forget their credentials, after a couple attempts most people would likely request a credential change or reset their password.