Scribd
Upload
2 views4 pages

Sn-Databases and SQL: Week 04

This project involves using SQL to analyze security threats in an enterprise database by querying data related to login attempts and suspicious activities. It includes steps for reconnaissance, investigating failed infiltrations, after-hours activity, identifying insider threats, cross-referencing failed attempts, and conducting a comprehensive security audit. The final deliverable is a report detailing the queries used and insights gained from the analysis.

Uploaded by

brahimachoco59
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
2 views4 pages

Sn-Databases and SQL: Week 04

This project involves using SQL to analyze security threats in an enterprise database by querying data related to login attempts and suspicious activities. It includes steps for reconnaissance, investigating failed infiltrations, after-hours activity, identifying insider threats, cross-referencing failed attempts, and conducting a comprehensive security audit. The final deliverable is a report detailing the queries used and insights gained from the analysis.

Uploaded by

brahimachoco59
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

SN-DATABASES AND SQL

24 HOURS

SN-BT-003

Week 04
Analyze a database with SQL queries
INTRODUCTION

In this project, you'll use SQL to analyze security threats in an enterprise


database. You'll learn how to query databases, examine connection
attempts and identify suspicious activity. This hands-on project
demonstrates the use of SQL to analyze cybersecurity logs, with sample
logs and queries to detect threats.

Target skills
• Querying a database with SQL queries
• Filter and sort data
• Join tables and aggregate data

THE PROJECT

Step 1: Reconnaissance

You're new to the company and need to understand the database structure.

• How many tables are in the database?


• What columns are present in the log_in_attempts table?
• What information does the employees table contain?

Step 2: Failed Infiltrations

There's been an increase in failed login attempts. Investigate these failures.


• How many failed login attempts are there?

• Are there any usernames with multiple failed attempts?

• Do you notice any patterns in the times or locations of these attempts?

Step 3: After Hours Activity

Security is concerned about logins outside business hours (before 9 AM or after 5


PM).

• How many after-hours login attempts were there?

• Are these attempts mostly successful or failed?

• Are there any employees consistently logging in after hours?

Step 4: Insider Threat?

IT department staff have elevated privileges. We need to identify them for a


security audit.

• How many employees are in the IT department?

• What offices are the IT employees located in?

• Do you notice anything unusual about the device IDs assigned to IT staff?

Step 5: Cross-Reference Investigation

We need more context about the failed login attempts.

• Which department has the most failed login attempts?

• Are there any failed attempts from countries where we don't have offices?

• Do you see any patterns between employee departments and login times?
Step 6: Comprehensive Security Audit

Create a full report of all login activity with employee details.

• What insights can you draw from this comprehensive view of login
attempts?

• Are there any correlations between department, office location, and login
success rate?

• Based on this data, what security recommendations would you make to


the company?

Delivery

A document containing a report of the various queries used to answer all the
questions

You might also like