⚠️ Disclaimer: All attack simulations were performed in a controlled lab environment using intentionally vulnerable systems (Metasploitable). No real systems were targeted. This framework is for educational and advisory purposes only.
A practical, execution-ready cybersecurity framework developed for small businesses, built on NIST CSF 2.0 and CIS IG1 baseline controls. Developed as a consulting engagement for Spinnaker Analytics (Mar 2026).
The framework delivers enterprise-grade defence at zero licensing cost using a fully open-source security stack — eliminating the need for expensive commercial software.
Small businesses face escalating cyber threats — ransomware, phishing, DoS attacks, insider threats — with limited IT resources. A successful attack rarely causes just a temporary outage; it translates directly to financial loss, reputational damage, and frequently, business insolvency.
| Principle | Detail |
|---|---|
| Framework baseline | NIST CSF 2.0 + CIS IG1 |
| Cost model | Zero licensing fees — 100% open-source |
| Deployment | Phased 8-week roadmap |
| Validation | Live DoS simulation with documented PoC |
| Threat | Mitigation Strategy |
|---|---|
| Ransomware | Endpoint hardening, backup strategy, network segmentation |
| Phishing / BEC | Email filtering, MFA, user awareness |
| Insecure Remote Access | VPN policy, access control, least privilege |
| Data Breaches | Encryption, DLP controls, access logging |
| DoS / DDoS | iptables firewall rules, traffic filtering, rate limiting |
| Insider Threats | RBAC, audit logging, behavioural monitoring |
A controlled Denial-of-Service attack simulation was executed to validate the effectiveness of the implemented firewall controls.
Environment:
| Component | Role |
|---|---|
| Kali Linux (192.168.197.131) | Attacker |
| Metasploitable (192.168.197.130) | Target |
| iptables | Host-level firewall |
Method: SYN flood attack generated using hping3 against the protected host.
Result: iptables state-based packet filtering rules successfully mitigated the attack. Findings documented in a formal PoC Validation Report.
smb-cybersecurity-framework/
│
├── Framework-Document/
│ └── Cybersecurity Framework Document.pdf
│
├── DoS-Protection-Guide/
│ └── DoSDDoS Protection Guide.pdf
│
├── PoC-Validation/
│ └── Proof of Concept (PoC) & Validation Report.pdf
│
├── Implementation-Timeline/
│ └── Project Action Plan & Implementation Timeline.pdf
│
└── README.md
- Cybersecurity Framework Document — Full NIST/CIS-aligned strategy
- DoS/DDoS Protection Guide — Practical firewall configuration guide
- PoC & Validation Report — Live attack simulation results and findings
- Implementation Timeline — Phased 8-week deployment roadmap
- Kali Linux · Metasploitable · iptables · hping3
- Open-source: firewall, antivirus, IDS alternatives
- NIST CSF 2.0 · CIS IG1 · MITRE ATT&CK
Omkar Sawant — Cybersecurity Analyst & Ethical Hacker LinkedIn · GitHub