C3 2025 Cyber Defense Competition

Competition Overview

Network Architecture: Defense-in-Depth Design

I designed and implemented a three-tier network segmentation strategy that became the cornerstone of our defensive posture. This architecture enforced strict security boundaries through OPNsense firewall rules and isolated systems based on trust level and function.

Application Security Remediations

We identified and fixed four high-severity vulnerabilities in the news website and weather backend applications that could have allowed complete system compromise.

Threat Hunting & Malware Removal

I led comprehensive threat hunting activities across all systems, identifying and removing numerous Red Team persistence mechanisms. Our systematic approach checked multiple layers where attackers commonly establish backdoors.

System Hardening Measures

Competition Results & Scoring Breakdown

Competition Screenshots

Key Technical Achievements

• Three-Tier Network Segmentation: Designed and implemented defense-in-depth architecture using OPNsense that isolated critical infrastructure and limited Red Team lateral movement
• Comprehensive Documentation: Created detailed white team documentation (93/100) covering network architecture, vulnerability remediation, threat hunting, and system hardening
• Application Security: Identified and fixed four high-severity vulnerabilities including SQL injection, API key exposure, broken access control, and hardcoded credentials
• Malware Eradication: Systematically hunted and removed persistence mechanisms across Windows and Linux systems including scheduled tasks, WMI subscriptions, malicious services, cron jobs, and LD_PRELOAD backdoors
• System Hardening: Implemented security patches, SSH hardening, firewall configuration, and secure password hashing across all systems
• Service Availability: Maintained 93.8% uptime across all required services while defending against active Red Team attacks

Lessons Learned

Leading the team through the C3 2025 CDC provided invaluable insights into enterprise network defense and incident response:

• Network Segmentation is Critical: Our three-tier architecture was our strongest defensive control. Even when Red Team compromised systems in the UNTRUSTED network, they couldn't pivot to AD or management infrastructure.
• Documentation Under Pressure: Creating comprehensive documentation during active defense operations requires careful organization. Using Notion for real-time tracking of vulnerabilities and remediation proved essential.
• Systematic Threat Hunting: Rather than reactive defense, proactive hunting for persistence mechanisms across multiple layers (scheduled tasks, services, cron jobs, PAM) was crucial for removing Red Team footholds.
• Application Security Matters: Infrastructure security is insufficient if applications have vulnerabilities. The SQL injection and API key exposure could have compromised our entire defense.
• Leadership During Crisis: Taking the lead as competition approached finals required balancing technical work with team coordination, prioritization, and maintaining morale under pressure.
• Configuration Management: Small misconfigurations (disabled Windows Update, commented security repositories) create massive vulnerabilities. Baseline hardening is essential before active defense begins.

Project Resources