Blueteam Fundamental - Third Batch - Day 1

Summary

The first day of the Blue Team fundamentals workshop introduces defensive security. It begins with networking basics and progresses to security controls, common attacks, and Security Operations Center (SOC) operations.

Workshop goals and scope

Participants are expected to learn what blue-team work involves, recommend security improvements, perform basic operating-system and web-server hardening, respond to incidents, and understand SOC operations and incident analysis.

Offensive techniques and tools are discussed for educational purposes, with an emphasis on detecting and mitigating them. Testing systems without authorization is explicitly discouraged.

Network fundamentals and secure design

Networks connect computers and other devices—including phones, IoT devices, and CCTV systems—so they can communicate. Good network architecture accounts for critical assets and limits exposure.

A typical design separates public-facing services in a DMZ from private internal systems and sensitive databases, using firewalls and access controls between zones. The lecture also stresses identifying assets and valuable data before deciding what to protect.

Protocols and services

The session contrasts TCP, which establishes a connection and supports reliable delivery, with UDP, which is connectionless. It introduces transport ports and common protocols, including HTTP/HTTPS, DHCP, DNS, FTP/FTPS/SFTP, and SSH.

A port number does not guarantee which application protocol is using it. Traffic on a commonly allowed port can carry something else, so inspection beyond basic port filtering may be needed.

• HTTP and HTTPS: HTTP methods and status codes are introduced, including 200, 403, and 404. HTTPS uses TLS to protect HTTP traffic.
• DHCP and DNS: DHCP assigns network addresses to clients. DNS resolves names to IP addresses and uses records such as A, MX, and TXT.
• SSH and file transfer: SSH supports secure remote access and can also carry SFTP traffic. The lecture mentions key-based and password-based authentication.
• Proxy and VPN: Proxies relay client traffic and can support monitoring or filtering. VPNs create encrypted connections over public networks, but compromised VPN credentials or tunnels can be abused.

Threats and defensive controls

The instructor reviews ransomware, phishing, denial-of-service, man-in-the-middle attacks, malware, social engineering, spoofing, and zero-day vulnerabilities. Examples of social engineering include deceptive links and attachments, impersonation, voice phishing, shoulder surfing, and malicious mobile apps.

Recommended defenses include user awareness, secure system configuration, and layered network protections. The session also introduces firewalls, web application firewalls, spam filters, and other network security devices.

IDS, IPS, and visibility

An IDS detects suspicious activity and generates alerts, while an IPS can intervene—for example, by dropping traffic that matches a rule or signature. Detection tools improve visibility, while prevention depends on appropriately configured controls.

Example technologies mentioned include Suricata and Snort for network monitoring, as well as host-monitoring and file-integrity tools. Some tool names in the auto-generated captions are unclear.

Vulnerability assessment and penetration testing

The instructor distinguishes vulnerability scanning or assessment from penetration testing. A scan may report a possible weakness, while an authorized penetration test attempts to validate findings and document demonstrated impact.

Static analysis examines source code; dynamic analysis tests a running application. The workshop also discusses exploit development and zero-days at a conceptual level.

Blue-team and SOC operations

Blue-team work includes maintaining an accurate asset inventory, monitoring systems, identifying threats, assessing risks, applying security recommendations, and verifying that controls work after deployment.

SOC roles may include analysts, infrastructure staff, incident responders, threat hunters, forensic investigators, and managers. Tier 1 typically monitors alerts and performs initial triage; more complex cases are escalated to higher tiers or specialists. Effective operations depend on documented procedures, playbooks, handovers, reporting, and clear escalation paths.

Security operations technology and terminology

The session refers to log collection and management, network-flow data, endpoint and incident-response tools, SIEM, and SOAR automation.

It distinguishes indicators of attack (IOA)—signs of attack activity—from indicators of compromise (IOC), such as suspicious IP addresses or file hashes. Threat-intelligence sources and reputation services can help investigate indicators.

Guides, tutorials, and practical work

The lecture serves as an introductory guide to network protocols, secure network segmentation, common threats, defensive controls, and SOC workflows.

Participants were asked to inspect a local vulnerable web application referred to in the captions as “localhost library” and review its weaknesses in preparation for the next session. The exact application name is unclear in the subtitles.

The presenter said slides would be available through the learning platform, with the recording shared through the course’s Discord or LMS channels.

Reviews

No product reviews or comparative product evaluations are presented. Tools and technologies are mentioned as examples.

Main speaker and sources

• Main speaker: Sida, presenting the workshop on behalf of the element.id platform.
• Other sources: Participant questions and discussion during the live training; the platform and instructor’s slides are referenced as course materials.