# Security Operations Assessment and Risk Reduction Plan

## What this is
An independent portfolio simulation for a fictional 250-person professional-services company. It uses synthetic authentication telemetry to demonstrate log triage, risk prioritization, and executive communication. It is not a real client engagement and does not represent a real breach.

## Folder structure
- `projects/security-operations-assessment.html` — standalone portfolio project page.
- `data/synthetic_authentication_events.csv` — 600 fabricated events over a simulated 30-day period.
- `analysis/analyze_auth_logs.py` — reproducible Python analysis.
- `files/analysis_summary.json` — high-level data summary.
- `files/triage_findings.csv` — output findings and recommended actions.
- `files/risk_register.csv` — prioritized risk register.
- `files/Executive-Brief.md` and `files/Executive-Brief.pdf` — executive deliverable.
- `index.html` — an updated copy of the portfolio homepage with the project added.

## Run the analysis
1. Install Python 3 and pandas: `python -m pip install pandas`
2. From the extracted project folder, run: `python analysis/analyze_auth_logs.py`
3. Review the generated outputs in `files/`.

## Rules used
- Repeated failures: at least 20 failed events from one source IP and at least five distinct user accounts.
- Unusual location: successful events tagged as part of the synthetic scenario.
- Legacy-style authentication: events tagged as legacy scenario and without an MFA challenge.
- Privileged sign-in without MFA: successful sign-ins for synthetic `admin` users without an MFA challenge.

Scenario tags are deliberately present in the dataset for auditability. They are labels for constructed examples, not an analyst's independent detection signal. A production assessment would not rely on such tags; it would use event fields, identity-provider context, and validated detection logic.

## Framework references
- NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
- NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cyber Risk Management: https://csrc.nist.gov/pubs/sp/800/61/r3/final
- CISA, Implementing Phishing-Resistant MFA: https://www.cisa.gov/resources-tools/resources/implementing-phishing-resistant-mfa
- MITRE ATT&CK, Brute Force (T1110): https://attack.mitre.org/techniques/T1110/

The frames are reference points, not a claim of certification or formal compliance assessment.