3 of 25

1: The MasterCard job SIM internship.

Mastercard Cybersecurity virtual experience program on Forage - March 2025

* Completed a job simulation where I served as an analyst on Mastercard’s

Security Awareness Team

* Helped identify and report security threats such as phishing

* Analyzed and identified which areas of the business needed more robust

security training and implemented training courses and procedures for those

teams

5 of 25

2. The following is the AIG shilds up SIM internship.

AIG Shields Up: Cybersecurity virtual experience program on Forage - March 2025

* Completed a cybersecurity threat analysis simulation for the Cyber Defense

Unit, staying updated on CISA publications.

* Researched and understood reported vulnerabilities, showcasing analytical

skills in cybersecurity.

* Drafted a clear and concise email to guide teams on vulnerability

remediation.

* Utilized Python skills to write a script for ethical hacking, avoiding ransom

payments by bruteforcing decryption keys.

6 of 25

1: (AIG) CASE STUDY:

You are an Information Security Analyst in the Cyber & Information Security Team.

A common task and responsibility of information security analysts is to stay on top of emerging vulnerabilities to make sure that the company can remediate them before an attacker can exploit them.

In this task, you will be asked to review some recent publications from the Cybersecurity & Infrastructure Security Agency (CISA). The Cybersecurity & Infrastructure Security Agency (CISA) is an Agency that has the goal of reducing the nation’s exposure to cyber security threats and risks.

After reviewing the publications, you will then need to draft an email to inform the relevant infrastructure owner at AIG of the seriousness of the vulnerability that has been reported.

Here are the instructions for your task

The CISA has recently published the following two advisories:

The first advisory (Log4j), outlines a serious vulnerability in one of the world’s most popular logging software.

The second advisory explores how ransomware has been increasing and is becoming professionalized - a concern for a large company like AIG.

Your task is to respond to the Apache Log4j zero-day vulnerability that was released to the public by advising affected teams of the vulnerability.

First, conduct your research on the vulnerability using the “CISA Advisory" resources provided above as a starting point.

Next, analyze the “Infrastructure List” below to find out which infrastructure may be affected by the vulnerability, and which team has ownership.

7 of 25

CASE STUDY 1 CONTINUED:

To finish this task, draft an advisory email to alert the infrastructure owner of the seriousness of this vulnerability.

From: AIG Cyber & Information Security Team

To: Product Development Team (product@email.com)

Subject: Security Advisory concerning Product Development Staging Environment | Log4j

Body:

Hello John Doe,

AIG Cyber & Information Security Team would like to inform you that a recent Log4j vulnerability has been discovered in the security community that may affect the Product Development Staging Environment infrastructure.

Vulnerability Overview

Log4j is a common open-source tool used for application logging and monitoring across the web. Recently, a vulnerability has been identified in versions Log4j2 2.0-beta9 through 2.15.0 that would allow an unauthenticated attacker to perform remote code execution on affected infrastructure, making this a critical vulnerability. You can learn more in the NIST disclosures: NVD - CVE-2021-44228 and NVD - CVE-2021-45046.

Affected products

Log4j2 2.0-beta9 through 2.15.0

Risk & Impact

Critical - remote code execution (RCE). An attacker will be able to remotely access the Product Development Staging Environment infrastructure to exfiltrate data or execute malicious actions.

Remediation

● Identify any assets or infrastructure running the affected Log4j version

● Update to the following versions: Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7)

● Be on the lookout for any signs of exploitation

If you identified any signs of exploitation, please immediately reach out. After you have remediated this vulnerability, please confirm with the security team by replying to this email.

For any questions or issues, don’t hesitate to reach out to us.

Kind regards,

AIG Cyber & Information Security Team

Back

8 of 25

2: (AIG) CASE STUDY

Your advisory email in the last task was great. It provided context to the affected teams on what the vulnerability was, and how to remediate it.

Unfortunately, an attacker was able to exploit the vulnerability on the affected server and began installing a ransomware virus. Luckily, the Incident Detection & Response team was able to prevent the ransomware virus from completely installing, so it only managed to encrypt one zip file.

Internally, the Chief Information Security Officer does not want to pay the ransom, because there isn’t any guarantee that the decryption key will be provided or that the attackers won’t strike again in the future.

Instead, we would like you to bruteforce the decryption key. Based on the attacker’s sloppiness, we don’t expect this to be a complicated encryption key, because they used copy-pasted payloads and immediately tried to use ransomware instead of moving around laterally on the network.

9 of 25

(AIG)CASE STUDY 2 CONTINUED:

In this task, you will write a Python script to bruteforce the decryption key of the encrypted file.

Bruteforcing is the act of repeatedly trying different combinations to break the password encryption (based on either randomly generated passwords, or from a list of passwords to try). In the resource below, we've provided a small subset of passwords from Rockyou - a widely know password wordlist that contains thousands of common passwords in one wordlist.

Ransomware will often encrypt all files on a device, and sometimes give the decryption key after the ransom has been paid (but this is not always the case!). In this task, we would like you to break the encryption without paying the ransom.

10 of 25

Python script to bruteforce the decryption key of the encrypted file.

from zipfile import ZipFile

def attempt_extract(zf_handle, password):

try:

zf_handle.extractall(pwd=password)

return True

except:

return False

def main():

print("[+] Beginning bruteforce ")

with ZipFile('enc.zip') as zf:

with open('rockyou.txt', 'rb') as f:

for p in f:

password =

p.strip()

if attempt_extract(zf, password):

print("[+] Correct password: %s" % password)

exit(0)

else:

print("[-] Incorrect password: %s" % password)

print("[+] Password not found in list")

if __name__ == "__main__":

main()

12 of 25

3: The following is the DATACOM SIM

Datacom Cybersecurity Job Simulation on Forage - March 2025

* Completed a simulation focussed on how Datacom's cybersecurity team helps

protect it's clients

* Investigated a cyberattack and produced a comprehensive report documenting

findings and outlining key recommendations to improve a client's

cybersecurity posture

* Conducted a comprehensive risk assessment

13 of 25

1: (DATACOM) CASE STUDY:

One of our leading tech corporation clients has fallen prey to a sophisticated cyberattack by a notorious Advanced Persistent Threat (APT) group known as APT34. The attack, believed to be sponsored by a foreign government, has left the organisation's network compromised, and valuable customer data and intellectual property has been stolen.

Your mission is to conduct initial research on this APT group, APT34, and assess the extent of the breach's impact on the organisation's information security. But fear not, for you will be provided with all the necessary tools required to understand cybersecurity concepts and principles, including cyberthreats, attack methods, and the importance of confidentiality, integrity and availability of information. In addition, you will also be familiarised with APT34's tactics, techniques and procedures (TTPs) and the common vulnerabilities they exploit to gain access to networks.

The objective of this task is to help our client conduct an initial investigation into APT34 and evaluate the potential impact of the attack on the organization. As a result, you will need to produce a comprehensive report documenting your findings and outlining key recommendations for improving the organisation's cybersecurity posture.

14 of 25

1: (DATACOM) CASE STUDY FINDINGS

What is their history?

Advanced Persistent Threat (APT) group 34, also known as OilRig or HelixKitten, is a state-sponsored cyber espionage group that has been active since at least 2014. APT34 is believed to operate out of Iran and has been associated with the Iranian government, specifically the Islamic Revolutionary Guard Corps.

Which nation/state are they associated with?

APT34 is believed to be associated with the Iranian government. Some cybersecurity experts have linked the group to Iran's Islamic Revolutionary Guard Corps (IRGC), a powerful military organisation that is also involved in Iran's cyber operations.

Do they target specific industries?

APT34 is known for targeting a wide range of industries, including energy, finance, telecommunications and government agencies, mainly in the Middle East and the United States. The group's main objectives are to collect sensitive information and conduct cyber espionage activities on behalf of the Iranian government.

What are their motives?

The motives of APT34 are believed to be primarily espionage-related. They are known to target sensitive information such as intellectual property, financial data and government secrets. Some experts believe that APT34's activities are aimed at supporting Iran's strategic interests.

What are the TTPs (tactics, techniques and procedures) they use to conduct their attacks?

APT34 uses a variety of TTPs to conduct their attacks. Some of their known TTPs include spear-phishing, social engineering, malware delivery through malicious websites and password spraying. They have also been known to use custom malware, including a backdoor called POWRUNER. Once inside a target's network, APT34 uses various TTPs to maintain persistence and avoid detection. For example, the group often employs custom-built malware and command-and-control (C2) servers, and uses legitimate tools and software to evade detection.

What security measures could the client implement to defend against cyberattacks conducted by this APT?

To defend against cyberattacks conducted by APT34, clients could implement several security measures, including:

Employee training: providing regular cybersecurity awareness training to employees can help prevent spear-phishing attacks and other social engineering tactics used by APT34. - Multi-factor authentication (MFA): implementing MFA can prevent unauthorised access to sensitive data even if an attacker has gained access to login credentials.

Endpoint protection: deploying endpoint protection solutions such as anti-virus and anti-malware software can help detect and prevent malware infections.

Network segmentation: segmenting the network into smaller, isolated networks can help contain and prevent the spread of malware in case of a breach.

Incident response plan: having an incident response plan in place can help the client respond quickly and effectively in case of a security breach and minimise the impact of the attack.

By implementing these security measures, the client can better protect their networks and systems against APT34's attacks and other cyberthreats.

16 of 25

4: The following is a Commonwealth Bank SIM

Commonwealth Bank Introduction to Cybersecurity Job Simulation on Forage - March 2025

Completed a job simulation involving the role of a cybersecurity generalist, specializing in fraud detection and prevention for Commonwealth Bank's Cybersecurity team.

Developed skills in building data visualization dashboards using Splunk to uncover patterns and insights in historical customer data, aiding in fraud detection.

Demonstrated the ability to respond effectively to cybersecurity incidents, including notifying relevant teams, collecting information, containing and stopping attacks, and aiding in recovery efforts.

Enhanced security awareness expertise by designing infographics promoting best practices for secure password management, following Australian Cybersecurity Centre advice.

Acquired practical experience in penetration testing, assessing the security of web applications, identifying vulnerabilities, and providing recommendations for remediation to bolster cybersecurity defenses.

17 of 25

CASE STUDY:

As a cyber security generalist at Commonwealth Bank, it is important to be aware of the increasing rate and complexity of financial fraud and the need for effective defence solutions. Financial fraud poses a significant challenge for financial institutions, and it is important for Commonwealth Bank to stay up to date with the latest fraud detection technologies and strategies to minimise risk. Protecting against and responding to fraud is a major responsibility for you and your team. By detecting and stopping fraud, the bank can protect its customers, employees and reputation while also enhancing the resilience of its financial system.

To help with this task, you will be using a tool called Splunk to visually represent the given data. Representing data in a visual format, also known as data visualisation, makes it easier for the data analytics team to understand and gain insights. Visual data is a universal, fast and effective way to communicate information.

You will be building a dashboard to make it easier to identify patterns and trends in the given dataset. The dashboard will provide crucial reporting and metrics information that can aid in identifying and detecting fraud. By using this dashboard, the team will be able to quickly identify any suspicious activity and take the necessary steps to prevent fraud from occurring. Overall, the goal of this task is to use data visualisation and a dashboard to make it easier to detect fraud and protect Commonwealth Bank and its customers from financial loss.

18 of 25

CASE STUDY1 DATASET:

About the dataset

Data was collected and structured by the Fraud team. This dataset consists of payments from various customers made in different periods and amounts. The feature columns include:

Step: This feature represents the month from the start of the simulation. The steps represent four months that the simulation ran virtually.

0: May 1: June 2: July 3: August

Customer: Customer ID

Age: Categorised age

0.0: <= 18 1.0: 19 - 25 **2.0: 26 - 35 **3.0: 36 - 45 **4.0: 46 - 55**5.0: 56 - 65

Gender: Gender of the customer

F: Female

M: Male

PostcodeOrigin: The postcode of origin/source.

Merchant: The merchant's ID.

Category: Category of the purchase.

Amount: Amount of the purchase.

Fraud: Target variable that shows if the transaction is fraudulent - 1 or non-fraudulent - 0.

19 of 25

CASE STUDY INSTRUCTIONS:

Using the “prepared_data” file in the Resources section, import this file into Splunk.

Study the file using the “Interesting Fields” section in Splunk. This tells you about the data you’re using.

Create a dashboard to include the following charts/tables:

Count by Category, Fraudulent transactions, Age and Merchant.

Fraud detected by Age, Category, Step (month) and Gender.

Which gender performed the most fraudulent activities and in what category?

Which age group performed the most fraudulent activities and to what merchant?

Prepared data link please open to view table.

https://docs.google.com/spreadsheets/d/1nZSu-NhnCCodRloQGh0kKFDbt-y1XvMQ/edit?usp=drivesdk&ouid=110292466337695303027&rtpof=true&sd=true

Fraud detection dashboard link open to view project.

https://drive.google.com/file/d/1nrDa9m9eBJosxNktIqebRwJ1reqif7C7/view?usp=drivesdk

20 of 25

CASE STUDY No2.

Security awareness is the knowledge and understanding of potential security threats and best practices for protecting yourself and your organisation against those threats. It's about being aware of the different types of cyber threats, such as phishing scams and malware, and understanding how to avoid them. It also means staying up to date with the latest security trends and information, so you can make informed decisions and take actions to keep yourself and your organisation safe.

Security awareness also includes knowing how to create strong and secure passwords, as well as understanding the best practices for keeping software and systems updated. Additionally, it involves understanding the legal and regulatory requirements related to information security. Overall, security awareness is important because it helps individuals and organisations stay vigilant against potential threats and take proactive steps to protect themselves and their assets.

One way to raise security awareness is by creating an infographic. An infographic can serve as a reminder to employees about the importance of secure passwords and other best practices for information security. It can also help to reinforce the organisation's commitment to security and raise awareness about the specific steps that should be taken to protect sensitive information.

Moreover, an infographic can be used as a tool for education, particularly in the aftermath of a security incident like the one in the previous task. It can help employees understand how to prevent similar incidents from happening in the future, serving as an effective tool for incident response management and employee engagement in security awareness. This is what you are going to be doing in this task, creating an infographic to raise security awareness on password security among your peers based on Australian Cyber Security Centre (ACSC) advice.

21 of 25

CASE STUDY 2 INFOGRAPHIC LINK:

https://drive.google.com/file/d/1o4t7Wt4TO5EJxgpL_LBTxtSc2fYNAfO3/view?usp=drivesdk

22 of 25

CASE STUDY 3: PENETRATION TEST

As a cybers ecurity generalist at CommBank, it's important to have a basic understanding of penetration testing. Penetration testing is a way to check the security of computer systems and networks by simulating an attack. This helps identify weaknesses in the system and evaluate the effectiveness of security measures. By regularly doing this, organisations can find and fix potential security problems before they can be exploited by bad people.

In this task, you will be completing the “Basic” web challenge from HackThisSite.org, which is an online platform that provides a safe and legal environment for students like you to improve their cyber security skills through a variety of challenges.

The challenge is divided into 11 levels and each level ranges from easy to difficult. The purpose of this challenge is to test your skills and knowledge in identifying vulnerabilities and exploiting them. By completing this challenge, you will gain a better understanding of how to identify and exploit vulnerabilities in web applications. Additionally, you will also learn how to apply this knowledge to real-world scenarios, which will help you improve your penetration testing skills. How exciting! Look at it like a game that helps you learn about web security.

After completing the challenge, you will need to create a pentest report detailing what you found and learnt, and give recommendations for how to better secure the web application. A penetration testing report is like a summary of the results of a security test. It shows any weaknesses or problems that were found during the test and suggests ways to fix them. This report is important because it helps organisations understand where they need to improve their security and how to do it. It also helps them comply with laws and regulations related to security. In simple terms, a pentest report is like a report card for a company's security and helps them pass security inspections. By having a good security posture, organisations can prevent data breaches, protect sensitive information, and maintain compliance with regulations and industry standards.

23 of 25

CASE STUDY 3 PENETRATION TESTING

To complete this task:

Go to HackThisSite and create an account.

On the left-hand side, Click on the “Challenges” section and select “Basic” (or click here).

Complete all levels from Basic Level 1 to 11.

After completing all levels, document a Penetration Testing Report that includes an executive summary, scope of web application tested, vulnerability description and key findings for each level, as well as recommendations on how to better secure the web application.

Additional resources are provided in the Resources for help, which will be especially useful if you have no prior experience with pentesting.

It's important to note that this is a legal and safe environment for individuals to improve their cyber security skills, and all activities should be done in accordance with the website's terms of service and ethical guidelines.

1 of 25

2 of 25