🛡️ CIS Top 20 Controls — Defensive Controls Implementation Portfolio (30 Labs)

Security Controls Implementation • System Hardening • Asset Control • Logging & SIEM • Cloud Baselines • Encryption • Backup Validation • Incident Response

A structured, execution-first 30-lab portfolio implementing CIS-style baseline controls across endpoints, networks, and cloud systems — with reproducible steps, validation evidence, and documentation artifacts.

Progression: inventory → hardening → monitoring → access control → SIEM → cloud security → encryption → backup verification → IR

---

---

🎯 Executive Summary

This repository demonstrates hands-on implementation of CIS-aligned defensive security controls across 30 structured labs.

It showcases practical capability in:

• Asset inventory & exposure validation (hardware/software reconciliation)
• Vulnerability scanning & remediation tracking (OpenVAS)
• Least-privilege enforcement & access governance
• Endpoint & network hardening (Linux + Windows)
• Firewall & boundary defense (UFW, iptables)
• Log monitoring & SIEM integration (ELK, Wazuh)
• Encryption at rest (BitLocker, LUKS) and in transit (TLS/HTTPS)
• Backup, restore & integrity validation (diff + hashing)
• Incident response lifecycle documentation & containment concepts
• Cloud instance hardening (OpenStack security groups)

This is execution-first security engineering: commands are run, outputs validated, controls tested, and evidence documented per lab.

The portfolio reflects practical defensive operations aligned with real-world SOC environments — not theoretical exercises.

---

📌 About This Repository

This is a structured 30-lab security engineering program focused on implementing foundational and operational defensive controls across:

• Endpoint security
• Network hardening
• Identity & access governance
• Logging & SIEM workflows
• Encryption enforcement
• Backup validation
• Cloud security configuration
• Incident response process execution

All labs were executed in controlled Ubuntu and Windows lab environments using open-source tooling.

Each lab includes:

• Command execution steps
• Validation outputs
• Configuration artifacts (sanitized)
• Structured documentation
• Troubleshooting notes

The progression moves from baseline controls (inventory, hardening, firewalling) to operational security (SIEM integration, encryption verification, policy enforcement).

---

👤 Who This Repository Is For

This portfolio is designed for:

• SOC Analyst (Tier 1 / Tier 2) roles
• Blue Team & Defensive Security learners
• System / Endpoint Hardening engineers
• Junior Detection Engineering candidates
• IT professionals transitioning into cybersecurity
• Recruiters evaluating hands-on defensive capability

It demonstrates the ability to implement, validate, and document real security controls — not just describe them.

---

🗂️ Labs Index (1–30)

Click any lab title to jump directly to its folder.

---

🗂 Lab Architecture Overview

🧱 Section 1 — Security Foundations (Labs 1–15)

Lab	Title	Focus Area
01	Hardware Asset Inventory	Asset discovery & reconciliation
02	Software Asset Inventory	Installed software auditing
03	Basic Vulnerability Scanning	OpenVAS / GVM scanning
04	Controlled Admin Privileges	Least privilege enforcement
05	Secure Endpoint Configuration	CIS-style hardening
06	Audit Log Monitoring & Analysis	Log triage workflow
07	Email & Browser Hardening	Anti-phishing controls
08	Malware Defenses	ClamAV validation
09	Limiting Ports & Services	UFW + iptables enforcement
10	Data Recovery Capabilities	Backup + restore + diff validation
11	Network Device Hardening	SSH-only management
12	Boundary Defense	Inbound filtering + nc validation
13	Data Protection Basics	TLS + file encryption
14	Need-to-Know Access Control	Linux groups & permissions
15	Wireless Access Control	WPA2 AES + WPS disable

🧠 Skills Demonstrated (Labs 1–15)

• Hardware/software asset reconciliation
• Nmap host discovery validation
• OpenVAS vulnerability triage
• Admin privilege auditing (sudo/wheel)
• CIS-style endpoint hardening mindset
• UFW & iptables rule enforcement
• Port/service minimization
• Backup automation (cron) + integrity validation (diff)
• Router hardening (SSH-only, disable HTTP)
• TLS certificate configuration + handshake validation
• File encryption validation (AES-256)
• Linux access control (chmod/chown/groups)
• Wireless security hardening

These labs implement foundational baseline controls across endpoints and networks using open-source tooling and validation workflows.

---

🔐 Section 2 — Security Hardening, Operations & Encryption (Labs 16–30)

Lab	Title	Focus Area
16	Account Monitoring & Control	UID auditing + lockout policy
17	Security Awareness Training	Phishing defense training
18	Application Software Security	SQLi/XSS mitigation
19	Incident Response & Management	IR lifecycle
20	Penetration Testing (Authorized)	Nmap + remediation workflow
21	Patch Management Basics	Update validation
22	Hardening Windows System	Policy enforcement
23	Hardening Linux System	SSH hardening
24	SIEM Log Integration (ELK)	Filebeat → Elasticsearch
25	Secure Cloud Instance	OpenStack security groups
26	Endpoint Security Tool Intro	Wazuh alert validation
27	Data at Rest Encryption	BitLocker + LUKS
28	Data in Transit Encryption	Nginx TLS + redirect
29	Verifying Backups	Hash + diff validation
30	Strengthening Password Policies	pwquality + Windows policy

🧠 Skills Demonstrated (Labs 16–30)

• Account auditing & session timeout enforcement
• PAM-based lockout configuration
• Security awareness content development
• SQL injection & XSS mitigation strategies
• Incident lifecycle execution (Detect → Contain → Recover)
• Patch deployment & validation workflows
• SSH hardening & service minimization
• ELK + Filebeat log shipping
• Wazuh endpoint monitoring validation (EICAR)
• OpenStack cloud security groups
• BitLocker + LUKS encryption
• HTTPS enforcement (301 redirect)
• Backup integrity validation (sha256sum)
• Password complexity & expiration enforcement

These labs expand from baseline hardening into operational SOC controls and encryption validation workflows.

---

✅ Validation Style (How Evidence Is Proved)

Across labs, validation is explicitly demonstrated with:

• Before/after checks (ports, services, policies, configs)
• Negative tests (unauthorized access fails, blocked ports time out)
• Integrity proof (diff output, SHA256 hashes)
• Security telemetry proof (auth logs, SIEM indexes, Wazuh alerts)
• TLS proof (curl -I, handshake/cipher confirmation)

---

🧰 Tools & Technologies Used

Click to expand

🖥️ Operating Systems

• Ubuntu 24.04/24.04.1 LTS (primary lab host)
• Windows (inventory exports, policies, encryption tooling)

🌐 Networking & Discovery

• nmap, ss, netstat (net-tools), ip, ip route, nc (netcat)

🔎 Vulnerability & Endpoint Security

• OpenVAS / Greenbone (GVM)
• Lynis (baseline auditing approach)
• ClamAV (freshclam, clamscan)

🔥 Firewalls & Boundary Controls

• ufw, iptables (+ save/restore)
• Service management: systemctl

📊 Logging / SIEM / Monitoring

• rsyslog, /var/log/auth.log, grep, tail
• Elastic Stack: Elasticsearch + Kibana
• Filebeat (log shipper)
• Wazuh (manager/dashboard; endpoint alert validation)

💾 Backup / Recovery / Integrity

• tar, gzip, cron, crontab, diff, sha256sum

🔐 Secure Access & Encryption

• OpenSSH (SSH hardening)
• Apache2 TLS (OpenSSL cert generation + TLS handshake validation)
• Nginx TLS (HTTPS + redirect)
• BitLocker (Windows), LUKS / cryptsetup (Linux)
• Windows utilities: 7-Zip AES-256, VeraCrypt

☁️ Cloud Security

• OpenStack (Horizon + CLI)
• Security groups (restrictive ingress rules)
• MFA workflow enforcement

🗂️ Repository Structure

This repository is organized as a 30-lab defensive controls portfolio:

CIS-Top-20-Controls/
├─ 🔹 Security Foundations (Labs 1–15)
├─ 🔹 Security Hardening, Operations & Encryption (Labs 16–30)
└─ README.md

Track Overview

• Labs 1–15: Security Foundations (inventory, hardening, logging, boundary defense, encryption, access control)
• Labs 16–30: Operations & Enforcement (identity controls, patching, SIEM, cloud security, encryption validation, backup assurance)

🧱 Standard Lab Folder Structure

Each lab follows a consistent, GitHub-ready structure:

labXX-lab-name/
├── README.md              # Objectives, steps, validation checklist
├── commands.sh            # Executed commands (copy/paste runnable where applicable)
├── output.txt             # Sanitized outputs (proof of validation)
├── reports/               # Findings, policies, configs, verification notes
├── troubleshooting.md     # Common issues + fixes
└── interview_qna.md       # (optional) interview-ready questions & answers

This structure ensures reproducibility, evidence capture, and portfolio-grade documentation across all labs.

---

🎓 Learning Outcomes Across 30 Labs

After completing all 30 labs, this portfolio demonstrates the ability to:

• Build and reconcile hardware & software asset inventories with discovery validation
• Perform vulnerability scanning and document remediation priorities (OpenVAS/GVM)
• Enforce least privilege (admin access governance + need-to-know access models)
• Harden Linux and Windows systems using baseline security standards
• Implement deny-by-default firewall and boundary defense controls (UFW/iptables)
• Enable logging, perform log triage, and integrate events into SIEM workflows (ELK/Wazuh)
• Configure and validate encryption controls (BitLocker, LUKS, TLS/HTTPS)
• Design and test backup, restore, and integrity verification workflows (diff + hashes)
• Apply patch management and password/account policy enforcement
• Execute documented incident response containment and recovery steps
• Secure cloud instances by designing restrictive security group rules (OpenStack)

This is practical implementation — not theoretical configuration summaries.

---

🌍 Real-World Alignment

These labs are designed to mirror defensive security work performed in production environments:

• CIS-style baseline security control implementation and validation
• SOC visibility workflows: log collection → triage → alert thresholds
• Access governance: admin privilege control and need-to-know enforcement
• Boundary defense: firewalling, exposure reduction, and verification testing
• Encryption enforcement to meet data protection and compliance requirements
• Recovery assurance through backup verification and integrity checks
• Cloud hardening using least-exposure network security groups
• Incident readiness through documented response workflows and containment actions

All labs were executed in controlled lab environments using open-source tooling.

---

📈 Professional Relevance

This portfolio reflects capability aligned with:

• SOC Analyst (Tier 1 / Tier 2)
• Blue Team & Defensive Security roles
• System / Endpoint Hardening Engineer
• Security Operations Engineer
• Junior Security Administrator

It demonstrates:

• Security-first, validation-driven mindset
• Strong documentation and evidence discipline
• Practical implementation of baseline controls across OS, network, and cloud layers
• Repeatable verification workflows (ports, logs, backups, encryption behavior)

---

🧪 Real-World Simulation

All labs were executed in controlled environments and designed to simulate realistic defensive security operations workflows:

• Asset visibility & exposure management (inventory + scanning + reconciliation)
• Hardening & secure configuration enforcement (services, policies, SSH, Windows controls)
• Monitoring & detection readiness (audit logs, SIEM shipping, alert validation)
• Boundary defense verification (deny-by-default, allowed service checks, blocked port tests)
• Data protection enforcement (BitLocker/LUKS + TLS configuration + HTTPS redirects)
• Recovery assurance (backup restore validation with diff + hash verification)
• Cloud security baselining (restrictive security groups, removal of overly broad rules)
• Incident readiness execution (containment concepts + lifecycle documentation)

This repository represents operational defensive controls implementation — not theoretical notes.

---

📊 Security Skills Heatmap

This heatmap reflects hands-on defensive controls implementation across 30 labs in:

Asset Governance • System Hardening • Access Control • Logging & SIEM • Encryption • Cloud Security • Recovery Assurance • Incident Readiness

Exposure bars represent depth of practical implementation and validation.

Skill Area	Exposure Level	Practical Depth	Tools / Technologies Used
🗂 Asset Inventory & Discovery	██████████ 100%	HW/SW inventory, Nmap reconciliation, exposure validation	nmap, dpkg-query, WMIC
🔎 Vulnerability Scanning	█████████░ 90%	OpenVAS scanning, severity review, remediation documentation	OpenVAS / GVM
👥 Least Privilege & Access Control	██████████ 100%	sudo governance, group-based ACLs, permission validation	sudo, chmod, chown, PAM
🖥 Endpoint Hardening (Linux)	██████████ 100%	Service minimization, SSH hardening, baseline enforcement	systemctl, Lynis
🪟 Endpoint Hardening (Windows)	█████████░ 90%	Policy enforcement, feature reduction, password controls	Local Security Policy
🔥 Firewall & Boundary Defense	██████████ 100%	Deny-by-default, rule validation, blocked port testing	UFW, iptables, nc
📜 Logging & Audit Monitoring	█████████░ 90%	Auth log triage, suspicious pattern filtering	rsyslog, grep
📡 SIEM Integration	█████████░ 90%	Log shipping, index validation, alert rule testing	ELK, Filebeat, Wazuh
☁️ Cloud Security Baselines	████████░░ 80%	Restrictive security groups, exposure reduction	OpenStack
🔐 Encryption (Data at Rest)	█████████░ 90%	BitLocker, LUKS configuration + reboot validation	BitLocker, cryptsetup
🌐 Encryption (Data in Transit)	█████████░ 90%	TLS config, HTTPS enforcement, redirect validation	Apache, Nginx, OpenSSL
💾 Backup & Recovery Assurance	██████████ 100%	tar backups, restore validation, diff + hash integrity checks	tar, diff, sha256sum
🔄 Patch & Policy Enforcement	█████████░ 90%	OS updates, password complexity, expiration validation	apt, Windows Update
🚨 Incident Response Readiness	████████░░ 80%	IR phase documentation, containment concepts	ClamAV, firewall controls

📌 Proficiency Scale

• ██████████ = Implemented end-to-end with validation & documented evidence
• █████████░ = Strong working implementation with practical verification
• ████████░░ = Functional exposure with applied context

This heatmap reflects operational defensive capability, not isolated configuration steps — covering:

Inventory → Hardening → Monitoring → Access Control → SIEM → Cloud → Encryption → Recovery → Incident Readiness

---

🧪 How To Use

# Clone repository
git clone https://github.com/abdul4rehman215/CIS-Top-20-Controls.git
cd CIS-Top-20-Controls

# Open any lab
cd labXX-name

# Review documentation
cat README.md

# Execute commands (if applicable)
bash commands.sh

# Review outputs / reports
cat output.txt

Each lab is self-contained and follows a structured defensive workflow:

1. Objective – What control is being implemented
2. Implementation – Commands & configuration steps
3. Validation – Proof via logs, port checks, policy enforcement, encryption behavior, or restore testing
4. Artifacts – Config snippets, reports, sanitized outputs
5. Troubleshooting Notes – Operational considerations

---

📂 Lab Structure

labXX-name/
│
├── README.md
├── commands.sh (or documented command blocks)
├── output.txt (sanitized validation outputs)
├── reports/
└── troubleshooting.md

---

This repository is designed to be:

• 📘 Educational (defensive security training)
• 🔍 Validation-focused (controls are tested, not just configured)
• 🛡️ Aligned with CIS-style baseline implementation
• 📎 Interview-ready (clear evidence of hands-on execution)

---

🧪 Execution Environment

All 30 labs were executed in controlled lab environments designed to simulate real defensive security operations.

Environment Characteristics

• Ubuntu 24.04 LTS (primary lab host)
• Windows 11 Pro (policy, encryption, and endpoint testing)
• OpenStack cloud instances (security group & exposure control testing)
• Open-source security tooling (OpenVAS, Lynis, ELK, Wazuh, ClamAV, UFW, iptables)
• Segmented test networks for firewall and boundary validation
• Local TLS/HTTPS deployments for encryption verification
• Backup and restore simulations using non-production datasets

Controls were not only configured — they were validated through:

• Port verification tests
• Log generation & SIEM indexing checks
• Encryption behavior validation (reboot + access tests)
• Backup restore + integrity comparisons (diff + sha256sum)

This portfolio reflects implementation + verification, not configuration alone.

---

🎯 Intended Use

This repository is designed to support:

• Defensive security training
• SOC operations skill development
• System & endpoint hardening practice
• Secure configuration validation workflows
• Encryption and recovery assurance testing
• Cloud baseline security implementation
• Incident response documentation exercises

All techniques are demonstrated strictly within authorized lab environments and are intended for defensive security improvement.

---

⚖️ Ethical & Legal Notice

All research, simulations, and security control testing in this repository were conducted:

• In isolated, authorized lab environments
• Against self-configured or intentionally vulnerable systems
• Using synthetic or non-sensitive datasets
• For educational and professional defensive development purposes

No production systems were targeted. No unauthorized access was performed.

The techniques demonstrated are intended solely for responsible defensive security implementation and training.

---

⭐ Final Note

This repository reflects real, execution-first defensive security work — not theoretical configuration notes.

It demonstrates the ability to implement and validate controls across the full defensive lifecycle:

Inventory → Hardening → Access Control → Monitoring → SIEM → Encryption → Recovery → Enforcement

Security engineering is not just configuration.
It is control implementation + validation + repeatability. 🛡️

If this portfolio adds value, consider starring ⭐ the repository.

---

🌐 Labs Portfolio Post on LinkedIn

I also shared this Lab series Portfolio on LinkedIn with a concise portfolio summary, key highlights, and implementation context.

---

👨‍💻 Author

Abdul Rehman

Defensive Security • SOC Operations • System Hardening • SIEM • Cloud Baselines • Encryption Controls

📧 Reach Out

---