Module Introduction

The Preparation Phase is the starting point of this cybersecurity home lab project. Its purpose is to clearly define what I want to build, why I’m building it, and how I plan to approach it. Since this project is both a learning journey and a technical experiment, this section lays out the initial ideas, goals, and structure that will guide all future steps.

The goal is not to create a production ready environment from day one, but rather to design a realistic and flexible lab that can grow as my knowledge expands. By planning things properly at the beginning; from objectives and scope to required tools and documentation. I ensure that every new component I add later (like network segments, firewalls, SIEM platforms, or attack simulations) will fit into a cohesive, well organized system.

1.1 Objectives

This lab is being built as a personal project to help me develop hands-on cybersecurity skills in a safe and controlled environment. It’s meant to simulate the core elements of a Security Operations Center (SOC), but at a smaller scale and with flexibility for experimentation and learning.

The key objectives of this project are:

• Practical Experience: Build and manage real world cybersecurity components, from firewalls and monitoring tools to vulnerability scanners and response workflows.
• Safe Experimentation: Test attacks, defenses, and configurations without impacting any production systems.
• Skill Development: Strengthen my knowledge in areas like networking, incident response, threat detection, and ethical hacking.
• Scalability: Start small but design the lab so that it can evolve over time as I learn new tools and techniques.

Example:
I plan to simulate common cybersecurity scenarios, such as detecting a brute force attack, responding to a malware incident, or conducting a vulnerability scan, to practice how these situations are handled in real world environments.

1.2 Project Scope and Use Cases

To keep the project organized and achievable, it’s important to define what the lab will include and the types of activities it will support. The initial scope focuses on building a virtual environment that mimics a small organization’s IT infrastructure and security operations.

The home lab will consist of virtualized environments, network segments, security platforms, and monitoring solutions configured to emulate a small to medium enterprise infrastructure.

What the project includes:

• Virtualization using Proxmox
• Virtual machines running Windows and Linux systems
• Network segmentation with VLANs and routing
• Deployment of a firewall for traffic control
• Security services such as SIEM, IDS/IPS, vulnerability scanning, and automation
• Offensive tools for penetration testing, malware analysis, and simulated attacks

Use Case Examples:

• Conduct a vulnerability scan and analyze the results to understand system weaknesses.
• Capture and investigate logs in a SIEM platform to detect suspicious activity.
• Create an incident case and track the investigation process using an incident response tool.
• Test network segmentation and firewall rules by simulating internal and external attacks.

1.3 Architecture Overview

The architecture of this lab is designed to be modular and scalable, allowing me to add new elements over time as I learn. It will run on a virtualization platform (Proxmox) and will include multiple network segments to separate different types of activity and devices.

Key components of the architecture:

• Virtualization Layer: Proxmox hosting virtual machines and possibly containers.
• Network Layer: Segmented networks with VLANs and routing policies.
• Core Services: Virtual machines for Windows and Linux hosts, domain controller, DNS, DHCP, Active Directory, and basic infrastructure services.
• Security Layer: SIEM, IDS/IPS, vulnerability scanners, and automation tools.
• Offensive Layer: Tools and environments for penetration testing, ethical hacking, and malware analysis.
• Monitoring and Management: Centralized dashboards, logging systems, and automation services.

Example:
A potential workflow: a simulated attacker VM performs a port scan → the firewall blocks suspicious traffic → Wazuh generates an alert → TheHive creates an incident case → Shuffle automates part of the response.

1.4 Hardware & Software Requirements

Building this lab requires some planning around available resources. Since this is a learning project, I’m starting with hardware that’s sufficient for small to medium scale experiments, with room to upgrade later as the project grows.

Recommended Hardware:

• CPU: At least 8 cores with virtualization support
• RAM: Minimum 32 GB (64 GB recommended for more VMs)
• Storage: 1 TB SSD or NVMe for faster performance
• Networking: 1 Gbps NIC / Router / Switch (optional)

Recommended Software Stack (some of them):

• Hypervisor: Proxmox VE
• Firewall: pfSense
• Operating Systems: Windows Server, Windows 10/11, Ubuntu/Debian, Kali Linux
• Security Tools: Wazuh, TheHive, Shuffle, Nessus, OpenVAS, Security Onion
• Utilities: Docker, Git, ELK Stack, Sysinternals, Python tools

Example Setup:
A dedicated workstation or server running Proxmox hosts several virtual machines. pfSense controls network traffic, Wazuh monitors logs, and Nessus scans for vulnerabilities; all within isolated VLANs.

1.5 Documentation and Version Control

Proper documentation is essential for tracking progress, replicating setups, and learning from experiments. Since this is a continuous learning project, keeping clear records of configurations, results, and changes is a priority.

Best Practices I’m Using:

• Version Control: Using tools like OneNote or similar, to store scripts, configuration files, and automation code.
• Change Logs: Maintaining a record of major updates, changes, and test results.
• Documentation: Writing setup guides, network diagrams, and test case notes for future reference.
• VM Snapshots: Creating snapshots before major changes to allow easy rollback if something breaks.

Example:
I will document each test (like a vulnerability scan or SIEM rule configuration) with its purpose, setup steps, results, and lessons learned. This will help me refine future tests and track my learning progress over time.

Summary:
The Preparation Phase sets the direction for the entire cybersecurity lab. It’s not about building a perfect SOC from the start, it’s about defining goals, planning the environment, and creating a flexible structure for continuous learning. With clear objectives, a defined scope, and a thoughtful architecture, this project will serve as a long term platform to experiment, improve, and grow as a cybersecurity professional.