Seth Steed

Information security professional with extensive experience in safeguarding digital assets and implementing robust security frameworks. Known for strong team collaboration and achieving results, while adapting to evolving security challenges. Proficient in risk management and threat mitigation, with reliable and flexible approach.

• Certified Information Systems Security Professional (CISSP), (ISC2), 2023
• CompTIA Advanced Security Practitioner (CASP+), 2025
• Certified Cloud Security Professional (CCSP), (ISC2), 2025
• CompTIA Cybersecurity Analyst (CySA+), 2022
• CompTIA Pentest+, 2025
• CompTIA Security+, 2022
• CompTIA Network+, 2025
• CompTIA Linux+, 2025
• Axelos ITIL4, 2025

T-Pot Honeypot Deployment and SIEM Integration

Implemented a full-featured honeypot environment using the T-Pot platform, which integrates multiple deception technologies such as Log4Pot, Snare, DDoSPot, Cowrie, and others. The environment emulated various vulnerable services to attract, detect, and log adversarial behavior in a controlled setting.

To capture and analyze traffic:

• Utilized FATT (Fingerprinting the Attack Traffic) with PyShark to process PCAP files, extract session metadata, and perform protocol-level fingerprinting.
• Deployed Suricata for real-time deep packet inspection (DPI), generating high-fidelity IDS/IPS alerts and protocol logs based on defined rulesets (e.g., Emerging Threats).

For centralized log management and threat visualization:

• Integrated the honeypot output with the Elastic Stack (Elasticsearch, Logstash, Kibana).
  Logstash was configured to parse and normalize logs from multiple honeypot sensors.
  Elasticsearch indexed the enriched data for querying and correlation.
  Built custom Kibana dashboards for visualizing attack trends, including:
  Source geolocation (via GeoIP enrichment)
  Top destination ports targeted
  Frequency of attack signatures
  IP reputation overlays

Conducted OSINT and threat enrichment using:

• VirusTotal: to scan and correlate malicious indicators (e.g., IPs, domains).
• AbuseIPDB: to determine historical reputation and classification of attacker IPs.
• Isolated VM analysis: to investigate suspicious connections and payloads in a safe environment.

This intelligence was then leveraged to design tailored IPS rules for systems like Suricata, improving network defense capabilities based on observed TTPs (Tactics, Techniques, and Procedures).

Overall, the project demonstrated end-to-end threat collection, enrichment, analysis, and actionable defense automation using open-source tools in a production-like setting.

Led the end-to-end design and deployment of a Zero Trust Security Framework for a simulated enterprise environment (“ORG Fiction”), focused on aligning with modern cybersecurity principles to minimize implicit trust and reduce the attack surface.

• Assessment of Existing Infrastructure: Conducted a thorough evaluation of the fictional organization's network topology, access controls, authentication mechanisms, and data flows to identify security gaps and legacy trust assumptions.
• Zero Trust Strategy Design:
  Defined a comprehensive Zero Trust policy architecture tailored to the organization's operational model and threat landscape.
  Developed an identity-centric access control model incorporating Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) to enforce least privilege.
  Designed and documented network micro-segmentation strategies using VLANs, software-defined networking (SDN), and host-based firewalls to contain lateral movement.
  Integrated continuous monitoring and policy enforcement leveraging tools for real-time logging, anomaly detection, and adaptive access decisions.

• Delivered a Zero Trust implementation roadmap, including phased deployment steps, technology recommendations, and risk mitigation strategies.
• Developed a proof-of-concept (PoC) lab environment demonstrating key Zero Trust components, including policy enforcement points, identity providers (IdPs), segmentation policies, and monitoring integrations.
• The final architecture demonstrated measurable improvements in security posture, reducing exposure to insider threats, unauthorized access, and lateral network traversal.

This project showcased the practical application of Zero Trust principles using a layered defense model, supporting both executive-level strategy and hands-on technical implementation.