IT Notebook

Hardware · Software · Network · Security · Cyber

OSI-Driven 5-Plane Audit Gamified Quiz

OSI Diagnostic Ladder

Physical A

Check: Link lights · reseat cable · swap port

show interfaces status

TAP FOR DETAILS

Pass Criteria

Solid green/amber link light on both ends.

Fail Action

Swap cable/port; reboot device; check SFP/module.

Commands

show interfaces status · ethtool eth0

Data Link G

Check: VLAN/trunk · MAC table · port errors (CRC)

show mac address-table

TAP FOR DETAILS

Pass Criteria

MAC learned on correct VLAN; 0 interface errors (CRC, collisions).

Fail Action

Fix VLAN mismatch; disable storm control if port flapping; check duplex settings.

Commands

show mac address-table · show vlan brief · show interfaces counters errors

Network G

Check: IP/subnet · gateway · routes · NAT

ping gateway · traceroute

TAP FOR DETAILS

Pass Criteria

Successful ping to gateway and remote IP. Correct subnet mask applied.

Fail Action

Add static route; correct IP/subnet; check NAT rules; verify routing protocol adjacency.

Commands

ping gateway · traceroute 8.8.8.8 · show ip route · ip addr show

Transport G

Check: Port reachability · TCP handshake · firewall

nc -vz IP PORT

TAP FOR DETAILS

Pass Criteria

Port = OPEN; TCP 3-way handshake (SYN-SYN/ACK-ACK) completes.

Fail Action

Open firewall port; fix ACL; check for SYN floods; verify service is listening.

Commands

nc -vz IP PORT · ss -tlnp · show firewall sessions

Session C

Check: Timeouts · keepalives · session tables

show sessions · app timeout config

TAP FOR DETAILS

Pass Criteria

Sessions established and stable (no abrupt resets or premature drops).

Fail Action

Increase timeouts; fix load balancer stickiness; check keepalive intervals; review IDP/session limits.

Commands

show sessions · show vpn ipsec sa · app config review

Presentation C

Check: TLS handshake · cipher suite · encoding

openssl s_client -connect IP:443

TAP FOR DETAILS

Pass Criteria

TLS 1.2/1.3 handshake successful; no encoding errors in JSON/XML payloads.

Fail Action

Enable TLS 1.3; update cipher suites; fix JSON/XML parsers; check certificate chain.

Commands

openssl s_client -connect IP:443 · openssl x509 -text -noout · nmap --ssl-enum-ciphers

Application Ae

Check: HTTP response · auth · API keys · WAF

curl -v https://URL

TAP FOR DETAILS

Pass Criteria

HTTP 200 OK; valid auth token (JWT/API key); expected data returned.

Fail Action

Fix application code; rotate API keys; check IAM permissions; review WAF rules for false positives.

Commands

curl -v https://URL · curl -H "Auth: Bearer TOKEN" · jq to parse response

5-Plane Hardening Matrix

Hardware

Software

Network

Security

Cyber

A — Hardware Plane

SMART Status: Check all drives for reallocated sectors. Replace if > 0.

RAID Sync: Verify RAID array health and rebuild status.
mdadm --detail /dev/md0

PSU/Fan Health: Check hardware sensors, fan RPM, temperature thresholds.

Evidence: Screenshot of RAID/SMART dashboard with timestamp.

C — Software Plane

Patches: OS and application patches must be < 30 days old.

Local Admins: Remove all unauthorized local admin accounts.

Windows: wmic qfe list

Linux: apt list --upgradable · dnf check-update

Evidence: Patch compliance report with datestamps.

G — Network Plane

VLAN Segmentation: Verify all ports on correct VLANs.
show vlan brief

Default-Deny: Firewall baseline = deny all; allow specific.

NTP Sync: All core devices synchronized. Offset < 100ms.
ntpq -p

Evidence: Netflow/syslog exports; NTP offset logs.

T — Security Plane

MFA: Enforced on all admin and remote access. Test login flow.

3-2-1 Backups: 3 copies, 2 media types, 1 offline/immutable.

Test Restore: Perform a real restore from offline backup.

Privileged Access: Review and justify all admin accounts.

Evidence: Restore completion log; access review signoff.

Ae — Cyber Plane

EDR Active: Verify agent heartbeat on all endpoints.

Vuln Scan: Run scan < 7 days. Use Nessus/OpenVAS.

Attack Path: Crown-jewel assets mapped with attack graph.

CVE Priorities: Critical/High CVEs assigned owners and deadlines.

Evidence: Scan report with CVE priorities and owner assignments.

Phase 1: Diagnose (Fix It)

OSI Ladder Workflow

L1: Link lights · reseat cable · test with known-good

L2: show mac address-table · verify VLAN/trunk

L3: ping gateway · traceroute · show ip route

L4: nc -vz IP PORT · TCP 3-way handshake

L5: Session timeouts · keepalive settings · session tables

L6: openssl s_client -connect IP:443 · TLS version/cipher

L7: curl -v https://URL · HTTP 200 · auth validation

Phase 2: Harden (Secure It)

5-Plane Audit

A — Hardware: SMART health · RAID sync · PSU/fan

C — Software: Patches < 30d · remove local admins · apt list --upgradable

G — Network: VLAN seg · default-deny · NTP sync · ntpq -p

T — Security: MFA enforced · 3-2-1 backups (1 offline/immutable)

Ae — Cyber: EDR active · vuln scan < 7d · attack path mapped

Phase 3: Incident (Contain It)

6-Step Response

5 MIN Contain: Isolate asset — unplug NIC or disable switch port

10 MIN Preserve: RAM dump · copy logs · sha256sum critical binaries

15 MIN Triage: Identify IOC (IP, domain, hash) · EDR kill-chain stage

60 MIN Remediate: Wipe/reimage · rotate all credentials used on host

24 HR Validate: Reconnect · monitor 24hrs · verify no beaconing

48 HR Retire: Root cause doc · update detections (Sigma/Splunk rule)

Phase 4: Daily Health (Prevent It)

Recurring Checks

Every Morning (5 min): Dashboard clean · backup success · auth anomalies (>50 failed from single IP) · NTP sync

Every Friday (15 min): Patch status for internet-facing assets · test one random restore · review firewall change requests

Monthly (30 min): Full vulnerability scan · audit local admins · verify MFA coverage · update runbooks

Quarterly (1 hr): Tabletop incident exercise · backup restore drill · review and rotate service account credentials

Evidence Collection Kit

ScreenshotsTimestamped PNG

Command Outputscript / tee to file

Log Exportssyslog / JSON / CEF

Hash Verificationsha256sum > hashes.txt

Chain of CustodySigned form + timestamps

Top 15 Ports to Know

Port	Service	Why It Matters
22	SSH	Remote admin; key-based auth required
53	DNS	Resolution; DNS tunneling vector
80/443	HTTP/S	Web apps; TLS termination
123	NTP	Time sync; NTP amplification risk
389/636	LDAP/S	Directory auth; plain-text risk on 389
445	SMB	File sharing; EternalBlue target
3389	RDP	Remote desktop; brute-force target
3306	MySQL	Database; never expose to internet
5432	PostgreSQL	Database; restrict to app servers
8080	HTTP Alt	Proxy/dev servers; often unmonitored
8443	HTTPS Alt	Management consoles; check auth
27017	MongoDB	NoSQL; default no-auth risk

Subnetting Quick Reference

/24 = 256 hosts (254 usable) — standard LAN
/25 = 128 hosts (126 usable) — split LAN
/26 = 64 hosts (62 usable) — small VLAN
/27 = 32 hosts (30 usable) — department segment
/28 = 16 hosts (14 usable) — point-to-point or micro-seg
/29 = 8 hosts (6 usable) — small link or VPN pool
/30 = 4 hosts (2 usable) — point-to-point link
/32 = 1 host — loopback or host route

Execution Rule

Always start at L1 and climb up.

Never skip layers. L1 problem masquerades as L7 symptom.

Flash Cards

How to Use

Tap a card to reveal the answer. Repeat until instant recall.

Knowledge Check

15 questions across all OSI layers and 5 planes. Timed. Streak bonus for consecutive correct answers.

Q 1/15

Streak 0

Time 0:00

LAYER 3 — NETWORK

Question text here

Explanation

Score

Correct

Wrong

Best Streak