Bridging Code and Security: Risk, Pen Testing, MITRE ATT&CK and Stapler | GCF Parul University (Part 2)

This is the second half of my one-week cybersecurity training with the Global Certification Forum (GCF) at Parul University. Part 1 covered security principles, network security and endpoint hardening: Part-1

This half has the topics I was most looking forward to, and the one lab that gave me trouble.

4. Vulnerability assessment and risk management
Threat intel was first: CVEs, security reports, news, and automated vs. ad hoc intelligence. The syllabus is clear about where they fall short. A CVE tells you a weakness exists. Whether it matters in your environment is a separate question, and that’s where risk comes in.

A vulnerability is a weakness. Risk is that weakness plus how likely it is to be exploited and how bad the damage would be. The way I remember it:

risk = likelihood x impact

The syllabus uses four severity levels: low, medium, high and extremely high.

Then pen testing, which is the part I care about most, since offensive security is where I want to end up. You start with vulnerability identification, active and passive recon, and port scanning and automation. At the end comes the report to stakeholders, with recommendations for fixing what you found. I’d have skipped over that last step before this week. It turns out a bug nobody can act on isn’t much use.

If you build software, there’s one more piece: testing an app before it ships.

5. Incident handling
This domain is dense. Monitoring with SIEM and SOAR. Forensics, including evidence handling and chain of custody. Frameworks like the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model and the Pyramid of Pain. The NIST SP 800-61 response lifecycle, how GDPR, HIPAA and PCI-DSS change reporting requirements, and DR/BCP basics (RPO, RTO, hot, warm and cold standby).

The easiest thing to get wrong is telling alerts apart, so here’s the table I wish I’d had earlier:

False negatives are the worst of the four. If nothing fired, nobody’s looking.

MITRE ATT&CK was my favourite part of the domain. Thinking in tactics, techniques and procedures makes an incident read like a sequence instead of a pile of events.

Stapler on VulnHub
Outside the syllabus, I solved Stapler from VulnHub. It was challenging.

It pulls together recon, enumeration and choosing a path to follow. More than once I’d run everything I knew and nothing worked. That was frustrating, but it’s much closer to a real assessment than a guided lab, where there’s one intended answer waiting for you.

I’m writing up the full walkthrough, so no spoilers. If you’re starting boot2root machines, don’t skip enumeration, and take notes as you go.

Closing thoughts
My main takeaway is that revision wasn’t wasted time. Going through familiar topics in a structured week showed me gaps I’d have missed otherwise. The labs, the SQL injection ones in Part 1 and Stapler here, taught me more than any slide did. And “entry-level” doesn’t mean easy, because the hard part is connecting the domains.

If you’re a student thinking about security, grab the syllabus, do the labs, and write about what you learn. Writing is how I found out what I didn’t understand.

Which boot2root machine gave you the most trouble? Drop it in the comments. I’m looking for my next one.