// defensive security · whitecliffe mc1a · 2026

Cyber Technician lab portfolio

I completed every exercise in all 22 EC-Council Certified Cybersecurity Technician lab modules, as part of Whitecliffe's Level 6 Cyber Technician micro-credential. For the assessed portfolio I documented ten of them screenshot by screenshot, then used them to design a security and disaster recovery strategy for a real-world scenario.

22/22lab modules completed

10exercises documented in full

350+pages of step-by-step evidence

Monitoring: catching the attack in the SIEM

The most involved exercise was running Suricata as a network intrusion detection system and forwarding its alerts into Splunk. The final search pulled the Suricata log and surfaced repeated "potential FTP brute-force" alerts from a single attacker, then charted them over time. Getting there took a lot of resets, and taught me to verify each hop: is the sensor seeing traffic, is the forwarder shipping it, is the index receiving it.

Splunk search results listing Suricata ET SCAN FTP brute-force alerts — Splunk search over the Suricata fast.log, showing the FTP brute-force alerts.

Assessment: finding what's exposed

OpenVAS flagged anonymous FTP access on the target. Nmap confirmed the open services and showed SMB signing disabled. CWE research turned the finding into a root cause, CWE-306 Missing Authentication, which is what a fix has to address.

OpenVAS result detail for anonymous FTP login — OpenVAS detection result: anonymous FTP login permitted.

Zenmap service and version scan output — Nmap service and version scan of the target.

The ten documented exercises

Exercise 01 · Module 08

Vulnerability assessment with OpenVAS

Scanned endpoint 10.10.1.16 with OpenVAS and found anonymous FTP login on port 21, an unauthenticated foothold.

Exercise 02 · Module 16

Network discovery with Nmap

Host discovery across the subnet, then a service and version scan that showed exposed FTP, SMB and RDP, with SMB signing disabled.

Exercise 03 · Module 08

Weakness research with CWE

Mapped the anonymous FTP finding to CWE-306, Missing Authentication for Critical Function, to explain the root cause rather than just list it.

Exercise 04 · Module 07

Host firewall with iptables

Wrote OUTPUT rules to block web traffic for one user, and proved the effect with before and after tests.

Exercise 05 · Module 07

Intrusion detection with Suricata and Splunk

Ran Suricata as a network IDS, forwarded its log to Splunk, and searched and charted the alerts to confirm an FTP brute-force attempt.

Exercise 06 · Module 07

Encrypted VPN with SoftEther

Built a virtual hub with password-authenticated users and verified an encrypted session.

Exercise 07 · Module 11

Wireless router hardening

Configured WPA2, MAC filtering, firewall rules and logging on a wireless router.

Exercise 08 · Module 19

Malware incident analysis

Worked a suspected malware incident through identify, analyse and validate, using VirusTotal and PEiD.

Exercise 09 · Module 15

Backup and restore

Ran Windows backups and restored data after simulated loss.

Exercise 10 · Module 13

Securing IoT/OT traffic with TLS

Moved a live sensor data feed onto TLS so readings can't be altered in transit.

Applying it: a research-vessel network

The scenario: two University of Otago research boats send collected data to a central server each week, for a three-month, $15 million project. The network had unprotected endpoints on the boats and no continuity or disaster recovery plan if a boat was lost.

My strategy used only tools I had documented:

Assess: OpenVAS, Nmap and CWE to find and rank weaknesses on each boat endpoint.
Protect: iptables host firewalls, Suricata feeding Splunk for visibility, a VPN for the weekly transmission, and a hardened wireless link.
Respond and recover: a structured incident process, TLS on the sensor feed, and centralised backups so a boat lost at sea doesn't take its data with it.

It was aligned with CERT NZ incident reporting guidance and the NZ Information Security Manual baseline for firewalls, IDS, encryption and logging.

What I took from it

The Nmap troubleshooting exercise felt the most natural, because reconnaissance is where I started as an attacker. The Suricata and Splunk lab was the hardest, with too many moving parts. It taught me that slower is faster: document each step, isolate variables, and read the logs. I now think of defence as a lifecycle of assessing, protecting, responding and recovering, rather than a set of separate tools.

All 22 modules

01Information Security Threats and Vulnerabilities
02Information Security Attacks
03Network Security Fundamentals
04Identification, Authentication and Authorization
05Network Security Controls: Administrative
06Network Security Controls: Physical
07Network Security Controls: Technicaldocumented
08Network Security Assessment Techniques and Toolsdocumented
09Application Security
10Virtualization and Cloud Computing
11Wireless Network Securitydocumented
12Mobile Device Security
13IoT and OT Securitydocumented
14Cryptography
15Data Securitydocumented
16Network Troubleshootingdocumented
17Network Traffic Monitoring
18Network Log Monitoring and Analysis
19Incident Responsedocumented
20Computer Forensics
21Business Continuity and Disaster Recovery
22Risk Management

Every exercise in every module is complete. "Documented" marks the modules the ten assessed portfolio exercises came from.