A plain-language, interactive version of the North Star Software Developers training manual. Learn how traffic analysis, firewalls, IDS/IPS, vulnerability assessment, network assessment, and log collection work together to protect people, data, and business operations.
North Star Software Developers had network servers compromised. Customer information and credit card numbers may have been exposed. The company needs a practical defense plan that both technical and non-technical stakeholders can understand.
Some servers were compromised, and the company does not yet know whether the attack came from inside or outside the network.
Protect customer information, payment data, software code, development systems, and everyday business operations.
Use layered defenses: watch traffic, control access, detect attacks, find weaknesses, map the network, and keep good records.
Think of NSSD like a city. The roads are network traffic, the buildings are servers, the locks are firewalls, the alarms are IDS/IPS tools, the inspections are vulnerability scans, the map is network assessment, and the security camera footage is log collection.
Click each card to expand it. Each layer explains what the tool does, why it matters, and what NSSD staff should do.
Like watching the roads to see where cars are going.
Traffic analysis helps IT staff see which systems are communicating and whether anything looks unusual.
Why it matters: It can reveal scanning, suspicious connections, malware beaconing, and possible data exfiltration.
What to use: Wireshark, tcpdump, firewall logs, IDS alerts, and system logs.
What to do: Capture traffic, filter by protocol or IP address, inspect packet details, and save evidence securely.
Like security gates that decide who gets in or out.
Firewalls allow approved traffic and block traffic that is risky, unnecessary, or unauthorized.
Why it matters: A poorly configured firewall can let attackers into sensitive systems.
What to use: Perimeter firewalls, internal firewall rules, host-based firewalls, and firewall logs.
What to do: Use least privilege, document rules, enable logging, test rules, and use a default deny policy.
Like alarms and guards that detect suspicious behavior.
IDS tools alert staff when traffic looks suspicious. IPS tools may block that traffic automatically.
Why it matters: IDS/IPS tools can detect port scans, brute-force attempts, exploit attempts, and malware activity.
What to use: Network IDS sensors, host-based IDS agents, firewall-integrated IPS, and SIEM alerts.
What to do: Configure allowlists and blocklists, place sensors strategically, monitor alerts, and tune rules.
Like a safety inspection before something breaks.
Vulnerability assessment finds weak spots before attackers can take advantage of them.
Why it matters: Missing patches, outdated software, weak encryption, and exposed services can lead to compromise.
What to use: Nmap, vulnerability scanners, asset discovery, and controlled penetration testing.
What to do: Define scope, scan ports and devices, review findings by severity, remediate, and rescan.
Like making a map of every road, building, and hidden shortcut.
Network assessment shows what devices exist, how they connect, and whether the network has risky paths.
Why it matters: NSSD cannot protect devices it does not know exist.
What to use: Network discovery, topology mapping, firewall logs, IDS/IPS alerts, and asset inventory.
What to do: Find rogue devices, detect suspicious connections, view topology, and correct weak segmentation.
Like keeping security camera footage and receipts.
Logs help NSSD prove what happened, when it happened, and which systems were involved.
Why it matters: Without logs, investigations become guesswork.
What to use: SIEM, firewall logs, IDS/IPS logs, authentication logs, endpoint logs, and vulnerability scanner reports.
What to do: Centralize logs, protect them, review alerts, correlate events, and retain records according to policy.
A simple way to understand the whole manual: find what exists, protect what matters, detect problems, respond fast, and improve after.
These are the tools NSSD IT employees can use as part of a layered defense strategy.
| Tool Category | Plain-English Purpose | Why NSSD Uses It |
|---|---|---|
| Wireshark / tcpdump | Looks closely at network packets. | Confirms what traffic actually moved across the network. |
| Firewalls | Controls allowed and blocked traffic. | Reduces unauthorized access and supports segmentation. |
| IDS/IPS | Detects or blocks suspicious activity. | Identifies attacks, scanning, exploit attempts, and policy violations. |
| Vulnerability Scanners | Finds weak spots before attackers do. | Supports patching, remediation, and risk prioritization. |
| Network Discovery / Topology Mapping | Maps devices and connections. | Finds rogue devices, unknown paths, and segmentation problems. |
| Endpoint Monitoring | Watches individual computers and servers. | Shows whether suspicious network activity affected a host. |
| SIEM / Centralized Log Collection | Collects security records in one place. | Connects related events and supports investigations, audits, and reports. |
Quick definitions for non-technical readers.
Test whether the main ideas make sense. Click an answer to see feedback.
A simplified reference list based on the training manual sources.
Cybersecurity and Infrastructure Security Agency. (n.d.). Cyber hygiene services. U.S. Department of Homeland Security.
Cybersecurity and Infrastructure Security Agency. (2023). Cross-sector cybersecurity performance goals. U.S. Department of Homeland Security.
Cybersecurity and Infrastructure Security Agency. (2023). Zero trust maturity model (Version 2.0). U.S. Department of Homeland Security.
Kent, K., & Souppaya, M. (2006). Guide to computer security log management (NIST Special Publication 800-92). National Institute of Standards and Technology.
National Institute of Standards and Technology. (2009). Guidelines on firewalls and firewall policy (NIST Special Publication 800-41 Revision 1). U.S. Department of Commerce.
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST Cybersecurity White Paper 29). U.S. Department of Commerce.
OpenAI. (2026). ChatGPT [AI image generation tool]. https://chatgpt.com/
Scarfone, K., & Mell, P. (2007). Guide to intrusion detection and prevention systems (IDPS) (NIST Special Publication 800-94). National Institute of Standards and Technology.
Scarfone, K., Souppaya, M., Cody, A., & Orebaugh, A. (2008). Technical guide to information security testing and assessment (NIST Special Publication 800-115). National Institute of Standards and Technology.
The Wireshark Foundation. (2024). Wireshark user’s guide.