Systems I built, then tested as a target

Problem

Cloud environments are usually reviewed against a diagram rather than tested as a live target. I built the full stack first so I could assess real running infrastructure instead of intended architecture.

What I did

• ▸Deployed a scalable environment on EC2, ALB, Auto Scaling, RDS, S3, CloudFront, Route 53, and VPC networking, with WAF, ACM, KMS, security groups, and NACLs providing layered protection.
• ▸Reviewed IAM permissions, EC2 hardening, authentication boundaries, network controls, encryption, logging, and patching, and found exposed secrets, insecure file permissions, and firewall gaps.
• ▸Remediated with least privilege IAM, HTTPS and TLS, encryption at rest, CloudWatch, CloudTrail, and VPC Flow Logs, prioritizing fixes by exploitability, severity, and blast radius.
• ▸Documented full attack paths from exposed credentials and cloud misconfiguration through to privilege escalation and data exposure, each mapped to a remediation and a detection control.

Problem

A working LAMP stack says nothing about whether an intrusion would be contained or even noticed. I set out to segment the tiers, model the threats formally, and prove the environment was observable at scale.

What I did

• ▸Architected a two tier LAMP environment across Ubuntu servers, separating web and database tiers running Apache, PHP, and MySQL.
• ▸Hardened access with least privilege RBAC and ACLs, restricted SSH, service specific UFW rules, and network segmentation that limits lateral movement between tiers.
• ▸Applied STRIDE threat modeling to classify 16 vulnerabilities across trust boundaries, then scored 12 threat scenarios with DREAD to prioritize remediation by risk.
• ▸Deployed centralized monitoring with Filebeat, Elasticsearch, and Kibana, ingesting over 17.4 million SSH and web events for real time investigation.