QudratSec

Qudtratulla

Cybersecurity specialist in the public sector

I work on the defensive side of cybersecurity: monitoring critical systems, building detections and responding to incidents. I’ve had a hacker’s mindset since I was eleven, and today I use it to find and stop attacks.

Connect on LinkedIn Read my background
Network segmentation diagramFour nested zones: internet, perimeter, internal network and critical systems. A request from a user passes through an opening in each boundary to reach a database. A compromised workstation that tries to reach the critical zone directly is blocked at the boundary, and the attempt is logged.internetuserperimetergatewayinternalapp serverworkstationcriticaldatabaseblockedand logged
A compromised workstation tries to reach critical systems directly. The attempt is blocked at the boundary and logged, while approved traffic passes through the openings in each zone.
Focus
Monitoring, detection and incident response
Tools
SIEM, EDR and XDR
Principles
Zero Trust, network segmentation, access control
Background
Self-taught, with a hacker’s mindset since age eleven

Where it started

I got into security at eleven, after getting hacked in the middle of a game.

  1. Age 11

    Getting hacked

    I was playing Counter-Strike: Source when someone used an exploit against me. It turned out to be two members of the U.S. military. Instead of leaving it there, they got on Ventrilo with me and explained exactly what they had done and how to clean it up.

    That is where my hacker mindset comes from. From then on I wasn’t satisfied with just using computers. I wanted to know how they work, and how they can be broken.

  2. School years

    Learning from the people who hacked me

    A friend and I stayed in contact with the two of them, and they ended up mentoring us. They gave us VPS environments to practice in and taught us real techniques, one step at a time. The rest I learned on IRC, forums and through a lot of trial and error.

    I was a kid, and I didn’t always think about where the line was. Today I do, and the rule is simple: I only touch systems I have permission to work on.

  3. Today

    On the defensive side

    The mindset is the same, but I use it differently now. Knowing how attackers think and operate is what makes it possible to spot them and stop them.

    Outside of work I still spend time in labs, trying out new attack techniques and tools so I know what to look for.

How I work

  • Think like an attacker

    Attacks are rarely one big flaw. They are a chain of small steps: a phishing email, a reused password, an account with too many rights. I map those chains and make sure we can detect and break them as early as possible.

  • Make it visible

    A security control only helps if you know when it fails. I make sure the right logs are collected, that alerts are worth investigating, and that there is a clear plan for when one fires.

  • Stay within the mandate

    Public-sector systems serve citizens and are bound by strict rules. Everything I do, including testing, happens with clear authorization and an agreed scope.

What I do

Most of my time goes to defensive work: keeping watch, investigating and responding. Alongside that I do testing, hardening and architecture work.

  • Monitoring and triage

    Monitoring critical systems with SIEM, EDR and XDR, and investigating alerts to tell real threats from noise.

  • Detection engineering

    Writing and tuning detection rules based on real attacker techniques, so alerts are accurate and worth acting on.

  • Incident response

    Containing, investigating and cleaning up when something gets through, and fixing the cause so it doesn’t happen again.

  • Threat hunting

    Searching logs and endpoints for signs of compromise that automated tools miss.

  • Vulnerability management

    Tracking vulnerabilities, deciding what to patch first and hardening systems so there is less to attack.

  • Penetration testing

    Authorized tests of systems and applications to find weaknesses first, and to check that our detections actually catch them.

  • Secure architecture

    Network segmentation, access control and Zero Trust principles built into new and existing solutions.

  • Risk and reporting

    Turning technical findings into clear risk assessments and recommendations that management can act on.

Get in touch

If you work in security and want to connect, you can find me on LinkedIn.

LinkedIn