The project focuses on performing a structured security analysis and simulated penetration testing for a fictional organisation, NovaTech Financial Solutions.
I have uploaded this work to GitHub to demonstrate my knowledge and practical understanding of information security concepts, risk assessment, and penetration testing methodologies.
⚠️ All testing was conducted in a controlled, university-approved lab environment against simulated systems. No real-world organisations were targeted.
The main goals of this assignment were to:
- Assess an organisation’s security posture using industry frameworks
- Identify risks, vulnerabilities, and threats
- Perform simulated penetration testing using approved tools
- Evaluate the impact of vulnerabilities on confidentiality, integrity, and availability (CIA triad)
- Propose realistic mitigation and remediation strategies
- Risk assessment using recognised security frameworks (e.g. NIST / ISO 27005)
- Security policies and technical controls
- Penetration testing methodology and reporting
- Vulnerability analysis and risk evaluation
- Mitigation strategies aligned with industry standards
As part of the assignment, I carried out simulated penetration testing to identify security weaknesses within the scoped environment. This included:
-
Network scanning and reconnaissance
- Identifying open ports and exposed services
- Mapping system attack surfaces
-
Vulnerability identification
- Analysing services for known weaknesses
- Assessing outdated or misconfigured systems
- Evaluating vulnerabilities using CVSS-style risk scoring
-
Attack vector analysis
- Identifying potential exploitation paths
- Assessing the impact of vulnerabilities on critical systems
- Linking findings to business and operational risk
-
Security impact assessment
- Evaluating how identified vulnerabilities affect:
- Confidentiality
- Integrity
- Availability
- Evaluating how identified vulnerabilities affect:
All findings were documented in a professional penetration testing report format, including severity, impact, and remediation recommendations.
- Network scanning and enumeration tools (e.g. Nmap)
- Vulnerability assessment techniques
- Risk analysis and reporting methodologies
- Security best practices aligned with:
- ISO 27001
- NIST
- GDPR considerations
- Written Report: Detailed security analysis, penetration testing findings, and remediation plan
- Executive Presentation: High-level summary designed for non-technical stakeholders
This project was completed strictly for academic purposes.
No real systems were tested, and all scenarios were fictional and compliant with university ethical guidelines.