Completing Security Engineer on THM – Part I

Introduction

Security Engineer is TryHackMe’s role path for the building side of security: 31 rooms across six modules, from cryptography and governance to hardening, secure development, and incident response. I finished it this week, a few months after passing SEC1, working through it in parallel with the offensive rooms I keep writing up here, most recently The Hollow Shell and Do Not Disturb.

There is no exam at the end; the rooms are the point. Where SEC1 had me attacking boxes under a clock, this path seats you on the other side of the fence and asks how you would have built, configured, and monitored the systems you have been breaking. As a platform engineer that framing worked for me: half of this path describes the job I already do, the other half is the job I will need to do the day something breaks.

There is too much material for one post, so this is part 1 of 2. This half covers the foundations, the risk paperwork, and the hardening module. Part 2 handles software security, incident management, and the OWASP wrap-up.

What the path covers

Module	Rooms	What it drills
Introduction to security engineering	4	CIA and friends, security models, cryptography, IAAA
Threats and risks	4	GRC, threat modeling frameworks, risk and vulnerability management
Network and system security	9	Segmentation, Linux/Windows/AD hardening, protocols, virtualization, cloud, auditing
Software security	7	OWASP API Security Top 10, SSDLC, SAST, DAST, weaponized vulnerabilities, DevSecOps
Managing incidents	4	Incident response, logging, first response, crisis management
OWASP Top 10	3	The 2025 list through the IAAA lens

Foundations

The first module compresses the vocabulary the rest of the path leans on.

CIA triad: confidentiality, integrity, availability, extended with authenticity, nonrepudiation, utility, and possession
DAD: disclosure, alteration, destruction; the same three properties seen from the attacker’s side
Defense in depth: multiple layers so one broken control does not end the game
Zero trust: no implicit trust, authenticate and authorize every access; “trust but verify” is the weaker cousin that still monitors trusted entities
IAAA: identification, authentication, authorization, accountability; the spine the whole path hangs on and the lens of the final OWASP module

The security models read like trivia until you need them:

Bell-LaPadula: confidentiality through “no read up, no write down”; you cannot read above your level or write down to a lower one
Biba: integrity with both rules flipped; pick the wrong model for your goal and you protect the wrong property
Clark-Wilson: integrity through constrained data items and transformation procedures; the accounting-brain model

The cryptography primer covers the load-bearing parts:

Symmetric (AES) versus asymmetric (RSA); encrypting with the recipient’s public key gives confidentiality, with your private key gives authenticity
Diffie-Hellman lets two parties agree on a shared secret over a hostile channel, but nothing in the protocol authenticates either side, so a man in the middle runs one exchange with each party; certificates and PKI exist to close that hole
Hashing: SHA-256 for integrity, HMAC when you need authentication too, and salting before password hashing so identical passwords do not produce identical hashes

Threats, risk math, and paperwork

Module two opens with governance, risk, and compliance. After my Security+ series this was revision, but the path repeats it for a reason: later rooms assume this vocabulary.

GDPR : fines up to 4% of annual revenue or EUR 20 million (severe tier), 2% or EUR 10 million otherwise
PCI DSS]: cardholder data handling, strict access control, monitoring
HIPAA and GLBA: health data and financial data respectively
ISO 27001 for the ISMS, SOC 2 for service organizations, NIST 800-53 as the control catalog and 800-63B for digital identity

Threat modeling gets a full room, and each framework answers a different question:

MITRE ATT&CK: what adversaries do, as tactics (objectives) and techniques (methods), with mitigations and detections per technique; the Navigator visualizes and annotates it per environment
STRIDE: a checklist that names the property each threat violates, applied per node of a data flow diagram
DREAD: five categories scored 1 to 10 to rank what STRIDE found
PASTA: seven stages from business objectives down to attack analysis; the framework for when you need buy-in from non-security people

The risk management room commits to arithmetic, which everyone can understand:

SLE = Asset Value x Exposure Factor
ALE = SLE x Annualized Rate of Occurrence
Safeguard value = ALE(before) - ALE(after) - Annual cost of safeguard

Say a database worth $50,000 loses 40% of its value in a flood that hits once every four years:

SLE = $50,000 x 0.40 = $20,000
ARO = 0.25
ALE = $5,000 per year
Any control costing less per year than the ALE reduction it buys is worth discussing; a positive safeguard value pays for itself

The four legitimate responses to risk are avoid, transfer, mitigate, and accept. “Ignore” is not on the list: accepting a risk means you analyzed it, priced it, and signed off; ignoring it means you did not.

Vulnerability management closes the module:

The SCAP family: CVE names vulnerabilities, CPE names platforms, CVSS (FIRST) scores severity 0 to 10
The lifecycle, in order: discover, prioritize, assess, report, remediate, verify
False positives get confirmed and flagged before they reach a report
The NIST CSF hangs over all of it: identify, protect, detect, respond, recover

Hardening the stack

Module three is the largest and the one I can use today: nine rooms of concrete configuration.

Zones and segmentation

Subnets route; VLANs isolate. A VLAN segments at layer 2, the 802.1q tag names which one a frame belongs to, and untagged traffic lands in the native VLAN. On Open vSwitch that looks like this:

ovs-vsctl set port eth1 tag=10
ovs-vsctl set port eth0 tag=10 vlan_mode=native-untagged
ovs-vsctl add-br br0
ovs-vsctl add-port br0 eth0 tag=10

Security zones then give VLANs identity, and zone-pair policies enforce stateful rules between them:

External, DMZ, trusted (workstations), restricted (databases, domain controllers), management, audit
Two layer 2 attacks get paired countermeasures: DHCP snooping validates DHCP traffic against a binding database of MAC to IP mappings, and dynamic ARP inspection reuses that same database to drop ARP packets whose MAC and IP do not match
One source of truth feeding two defenses; I like that economics

Linux

The Linux room is a checklist I have already partially applied to my own VPS fleet:

LUKS disk encryption via cryptsetup, with the master key wrapped by up to eight password-encrypted key slots
Host firewall ladder: netfilter in the kernel, then iptables or nftables, then ufw as the front-end to the front-end
Default-deny policy: block everything, allow exceptions; the reverse policy rots as exceptions pile up
sshd locked down: PermitRootLogin no, key-only authentication
Stale accounts get /sbin/nologin as their shell, libpwquality enforces password policy
SELinux and AppArmor when port-based rules are too coarse and you need per-binary control (I really LOVE these two)

Allowing SSH and dropping everything else, first in iptables:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

The same policy in nftables, where you build the table and chains yourself:

nft add table fwfilter
nft add chain fwfilter fwinput { type filter hook input priority 0 \; }
nft add chain fwfilter fwoutput { type filter hook output priority 0 \; }
nft add rule fwfilter fwinput tcp dport 22 accept
nft add rule fwfilter fwoutput tcp sport 22 accept

And ufw earning its “uncomplicated” name:

ufw allow 22/tcp
ufw status

Encrypting a partition with LUKS, condensed to the commands that matter:

cryptsetup -y -v luksFormat /dev/sdb1
cryptsetup luksOpen /dev/sdb1 EDCdrive
mkfs.ext4 /dev/mapper/EDCdrive
mount /dev/mapper/EDCdrive /media/secure-USB
cryptsetup luksDump /dev/sdb1

The luksDump output is worth reading once: cipher aes-xts-plain64, a 512-bit key, PBKDF2 with a salt.

Windows and Active Directory

Windows hardening in bullet form:

UAC cranked to Always Notify; administrator accounts for sensitive tasks only
AppLocker to block executables, scripts, and installers by rule
BitLocker drive encryption on top of a TPM, plus Secure Boot
Defender real-time protection and attack surface reduction rules, including macro lockdown for Office
RDP disabled unless you need it, SMB secured or disabled, unused network interfaces off

Active Directory gets its own room because AD is its own universe:

Disable LM hash storage via Group Policy; the format is breakable and modern domains do not need it
SMB signing for integrity against man-in-the-middle, LDAP signing against replay
Kerberoasting (T1558/003): service tickets can be requested and cracked offline, so service account passwords go long, or better, use gMSA and let the domain rotate them
The tiered access model is the structural fix I found most interesting:

Tier	Holds	Rule
0	Domain controllers, admin accounts	Never touches anything below
1	Servers and applications	No interaction with Tier 0 credentials
2	End-user devices	Most restricted, most exposed

Microsoft’s Security Compliance Toolkit ships the baselines plus Policy Analyzer for finding where your GPOs drift from them
A quick audit of exposed shares (from PowerShell):

Get-SmbOpenFile

Network devices and VPNs

The network device room repeats the classics with router-flavored specifics:

Patch firmware, change default credentials, disable HTTP and Telnet management, prefer SSH and HTTPS
WPA2/WPA3, SSID broadcast off if you are feeling traditional
Monitoring trio: syslog for log shipping, SNMP for alerts, NetFlow for traffic analysis
OpenVPN hardening: AES-256 cipher, SHA256 hashing, tls-crypt for key protection and perfect forward secrecy, and a dedicated unprivileged user for the daemon

Virtualization and cloud

This was the victory lap for me; I run this stack for a living and hold the certs to prove it. Type 1 hypervisors (ESXi, Proxmox, KVM) on bare metal versus type 2 (VirtualBox, QEMU) hosted on a desktop OS. Containers share the host kernel instead of virtualizing hardware, which is why they are fast and why a kernel escape hurts more. Kubernetes adds self-healing, rollout, and rollback machinery on top.

The AWS room still taught me plenty (it’s been a while since I last touched it):

Layered network controls: security groups are stateful and allow-only with implicit deny, NACLs are stateless and can explicitly deny, then vendor services like Network Firewall sit on top
IAM vocabulary that clicked: principals request, entities authenticate, identities act, resources get acted upon
CloudTrail logs API calls, GuardDuty hunts malicious behavior, Systems Manager Patch Manager keeps instances current
Disaster recovery tiers as a pricing problem:

Tier	How	RTO
Cold	Restore from snapshots	Hours to days
Warm	Near real-time sync	Minutes
Hot	Active-active	Zero

Auditing and monitoring

The audit room separates three things people blur: auditing is a systematic check against a standard, monitoring is real-time observation, logging is the record both consume. Frameworks named: COBIT, ISO 27001, PCI DSS, SOX.

On Linux the audit daemon does the work, and the tooling is direct. Failed events summary first:

aureport --failed

Failed Summary Report
======================
Range of time in logs: 06/08/2023 12:18:12.635 - 07/06/2023 23:09:20.083
Number of failed logins: 87
Number of failed authentications: 421

Then drill into who is eating the failures:

ausearch --message USER_LOGIN --success no --interpret | grep ct=root | wc -l
76

Seventy-six failed root logins on that box tell their own story.

Windows keeps its telemetry in Event Viewer, and these IDs are pure muscle memory fuel:

Event ID	Meaning
4624	Successful logon
4625	Failed logon
4647	User-initiated logoff
4634	System-completed logoff
4779	Session disconnected

The first half of this path is a hardening checklist with the reasoning attached: segment first, default-deny, encrypt at rest, tier your admin access, and log enough to answer questions later. I came in expecting the cloud and container rooms to carry the module and left with the AD tiering model and the DHCP snooping plus ARP inspection pair as the two ideas I would steal first.

Part 2 covers the half I came for: the API top 10, static and dynamic testing with real tool output, an exploit chain from SQL injection to web shell, and what to do when the pager goes off anyway.