Protecting the Digital Frontier: An Expert Network Security Engineer
Successfully passed Fortinet NSE 4 - FortiOS 7.2 on October 20, 2023
Passed the Certified Network Security Specialist (CNSS) exam from ICSI (International CyberSecurity Institute), UK at June, 2020
Completed "Advanced Penetration Testing" on the Cybrary
Successfully passed Certified Security Awareness 1 certification from Mile2
Passed and received a 933 score on the MCSA 70-740 Installation, Storage, and Compute with Windows Server 2016 exam.
With over 4 years in network and security, I specialize in designing and securing intricate infrastructures. My expertise includes network design, VPN implementation, and managing devices like Fortinet FortiGate, Sophos UTM, and Palo Alto firewalls. I excel in LAN/WAN design, data center networking, and system administration across Windows Server, Linux, and Unix platforms. Proficient in routing and switching (Cisco, BGP, OSPF), I also handle network configuration management, patch management, and performance optimization. Proven in technical support, I’ve resolved over 1,200 technical cases, preserved significant revenue, and led projects to enhance security and network efficiency. Let’s optimize and safeguard your digital environment with robust solutions.
Md. Samsel Arifin Chowdhury
samselarifinchowdhury@gmail.com
+880 152 1428553
Banasree, Dhaka - 1219
Bachelor
Available
Assess network topology and hardware to identify bottlenecks. Develop diagrams with optimal configurations for routers, switches, and firewalls. Design failover, load balancing, and redundancy. Implement continuous monitoring to enhance efficiency.
Implement customized firewall solutions with tailored rules and policies. Monitor logs for real-time threat detection, conduct periodic audits, update firmware, and optimize performance. Receive expert guidance for robust, compliant security.
We will implement WPA3 and secure SSIDs for wireless security, strategically position access points to minimize interference, and use advanced security features to protect your network effectively.
We will implement web application firewalls (WAF) to defend against web attacks, filter content to block threats, install IDPS sensors for monitoring, and set up alerts and automated responses to mitigate risks.
We ensure compliance with ISO 27001, GDPR, HIPAA, PCI-DSS, and SOC 2, draft security policies, educate employees on best practices, and conduct audits to verify adherence to standards and regulations.
We offer expert server setup, secure configuration, and optimization. Services include installing server hardware/software, integrating DNS, DHCP, Active Directory, deploying endpoint protection, and configuring SIEM systems for centralized log management.
Responsible for installing, configuring, and maintaining server operating systems such as Windows Server, Linux, and Unix. I draft and update Information Security Management System (ISMS) policies to align with ISO/IEC 27001 standards and manage Fortigate, Sophos, and Cisco firewalls, as well as switches. My role involves configuring and managing MikroTik routers, including tunneling, routing protocols, and firewall features. I investigate and mitigate network threats on layer 2 and layer 3 devices, design and implement firewall rules, and enforce server-level security controls like access controls and encryption. Additionally, I develop security awareness training programs, conduct risk assessments, maintain network documentation, and provide technical support to resolve issues and optimize network performance.
At Aamra Networks Limited, I handled over 1,200 technical cases and successfully retained critical revenue exceeding 2.5 million BDT. My role involved investigating, diagnosing, and resolving network issues on layer 2 and layer 3 devices, and configuring Fortigate, Sophos, and Cisco firewalls and switches. I worked with diverse technical platforms, including mainframe systems, two-tiered client servers, and three-tiered client-server architectures. Additionally, I managed and configured MikroTik routers, handling tunneling, routing protocols, and firewall features. My responsibilities also included configuring firewalls, routing, and switching to optimize network efficiency and security, as well as troubleshooting mail-related issues across various applications such as Microsoft Outlook, MS O365, and MAC Mail.
As an Executive Engineer in Network Administration at Business Network – Bnet, I was responsible for configuring, troubleshooting, upgrading, and maintaining routers (MikroTik), switches (Cisco, BDCOM, etc.), OLTs (BDCOM, Huawei, VSOL, etc.), and servers. I handled full ISP setups, including VLAN, BGP routing, filters, NAT, PPP, and queues, and provided technical support for network operations at L2/L3 levels and FTTH. My role involved regular updates of server and router logs, documenting changes, and monitoring overall system and network traffic while maintaining network equipment to ensure optimal performance and reliability.
As a Virtual Intern, I received training in VMware, Kubernetes, and virtualization technologies. My responsibilities included learning how to configure and set up virtual machines, as well as implementing security measures to protect these virtual environments. This role provided hands-on experience with virtualization tools and best practices for managing and securing virtual infrastructures.
As a Communication Associate in the Digital Marketing Department, I managed social media queries and effectively diagnosed and addressed customer complaints using the LATTE method. I successfully increased the Facebook page response rate from 53% to 97% and enhanced communication by transitioning from robotic FAQ responses to engaging, conversational interactions. This role involved refining customer engagement strategies and improving overall digital communication effectiveness.
Completed Computer Science & Engineering at BIST under the affiliation of National Univeristy
I rarely like to write reviews, but the itemstore team truly deserve a standing ovation for their customer support, customisation and most importantly, friendliness and professionalism. Many thanks once again for everything and hope that I get to deal with you again in the near future.
I rarely like to write reviews, but the itemstore team truly deserve a standing ovation for their customer support, customisation and most importantly, friendliness and professionalism. Many thanks once again for everything and hope that I get to deal with you again in the near future.
I rarely like to write reviews, but the itemstore team truly deserve a standing ovation for their customer support, customisation and most importantly, friendliness and professionalism. Many thanks once again for everything and hope that I get to deal with you again in the near future.
The task was to newly set up Virtualisation, VMware ESXI for the in-house server, and also configure internet access through a manageable router. The server was a Dell PowerEdge R740 Rack Server. The project was done for my client.
Activities performed:
o Establishing WAN and LAN through the manageable router
o Implement Port security for the server port
o Installing VMware ESXI 8.02
o Configuring RAID and VM Machine for multiple development Services
I have designed and supervised the server room setup and network design for BacBon Ltd.
Activities performed:
o Becoming part of the procurement
o Selecting devices according to the need
o Maintaining proper security measures
I have completed configuration of CISCO switch and router of ISP POP location in Bangladesh to provide that area user’s internet connectivity and worked as Network Engineer during my job tenture at Business Network.
Activities performed:
o Configured VLAN, STP, Trunking port on CISCO Switch
o Configured NAT, routing, port security on CISCO Route
I have completed data connectivity through GRE Tunneling for 4 location of a RMG company, where Core device was Sophos Firewall at Head Office and MikroTik router at Branch Office end and worked as Project Network Engineer during my job tenture at Aamra Networks Limited.
Activities performed:
o Configured GRE Tunnel in Sophos and Mikortik
o Policy to access LAN to LAN
o Route manipulation through route precedence
o Data redundancy through tunneling
I have completed Firewall Migration, logical setup at DR/DC data center for a vehicle manufacturer company and worked as Project Network Engineer during my job tenure at Aamra Networks Limited.
Activities performed:
o Configuring fresh firewall with existing features
o Implanting SSL, IpSec Tunnel, Certificate
o Blocking Malicious IP and Address policy based
o User wise access list
Recently, there has been a surge in scams via WhatsApp and LinkedIn. Scammers, often from Africa and parts of South Asia, use random WhatsApp numbers to directly contact individuals, posing as HR representatives from reputable companies. These scammers mention seemingly legitimate company names, and victims can be deceived by calls or messages appearing to be from real people on WhatsApp.
In an increasingly sophisticated era of cyber threats, your business’s network security should never be an afterthought. Here’s how a Network Security Engineer can fortify your organization:
Need a Network Security Expert? Let’s Secure Your Business Together!
Are you concerned about your network security and looking for a dedicated professional to secure your business? Look no further! As a skilled Network Security Engineer with experience in designing, implementing, and maintaining secure network environments, I offer:
Ready to take your network security to the next level? Contact me today to discuss how I can help protect your business from cyber threats and ensure the integrity and confidentiality of your data. Together, we can build a secure and robust network environment that enables your business to thrive.
Creating a reliable and scalable network diagram is essential for any network security engineer. Understanding the organization’s unique business needs, current infrastructure, and future goals helps craft a tailored network design that enhances efficiency and security. In this post, I’ll share a questionnaire that not only guides network diagram creation but also helps identify key areas for improvement in any network setup.
The first step to design an effective network is understanding the business context. The questions below are essential for getting to know the organization:
Is it a data-driven organization, service-oriented, or a mix of both?
Knowing the scale of users helps define network load requirements.
This helps to determine if a WAN (Wide Area Network) or VPN setup is necessary.
Understanding their core business priorities helps in setting the network’s focus.
Knowing this helps prioritize network resources for critical users and decision-makers.
This can impact hardware placement and connectivity needs.
Determining the role of the network in business operations is vital for prioritization.
Next, explore the network’s current state, its desired characteristics, and required capabilities:
This baseline helps to compare post-implementation performance.
Documentation shows what’s working and where improvements are needed.
Knowing this influences the design of remote access solutions.
This shapes the design and hardware requirements.
Understanding telephony requirements ensures adequate bandwidth and QoS setup.
This determines if on-premise services are required or cloud solutions are preferred.
These critical systems can influence network load balancing and redundancy planning.
Cloud needs impact bandwidth and integration with external services.
A device overview helps plan for compatibility, security, and support.
This helps define firewalls, failover setups, and other security measures.
A centrally managed network is easier to control but requires specific tools.
This question determines the scope of external access.
Existing bandwidth informs decisions about possible upgrades.
Understanding the type of internet connection affects configurations.
This shapes the firewall and filtering rules for optimal network usage.
This dictates the balance between security measures and user experience.
This informs disaster recovery and high-availability requirements.
Lastly, it’s critical to consider budgetary constraints and any specific technology or vendor preferences:
This dictates the level of hardware and services that can be procured.
Preferred vendors might restrict or influence device choices.
This informs the design complexity and ongoing support model.
—
By answering these essential questions, a network security engineer can build a highly customized network diagram that meets both the current and future needs of the organization. The design becomes more than just lines and nodes on a page—it transforms into a strategic blueprint that drives the business forward.
This comprehensive questionnaire not only lays the groundwork for a successful network diagram but also strengthens communication with stakeholders and ensures alignment with business goals.
Need help with network design or security solutions? Reach out, and let’s discuss how to secure and optimize your network for the future!
“Installation Storage and Computers with Windows Server 2016”
MCTS certification exam course offers you a brief overview of server-side OS, Virtualization, Active Directory, Domain Controller, DHCP, Implementing DNS, Implementing Group policies, AD sign-in process, solution for central and secured management of networking objects and other schemas.
Many of us are using the Microsoft operating system — Windows 10/8/7. This is called Client OS. For connecting to the server, we will use Microsoft Windows Server, this is called Server OS.
Suppose, a company is using multiple data centers but these need to be managed centrally and securely. Here comes a directory solution among various solutions, which is Microsoft Active Directory Domain Services. If you want to use Microsoft Active Directory Domain Services, we will implement Active Directory service on Windows server.
There are many Windows Server editions available, such as — Foundations, Essentials, Standard, Data Center.
3 types of hardware we can see:
Currently, the Blade server is used in many companies. Mainly, this server hardware has a chassis [ like a dish plate] where you can implement multiple server blades, where required CPU, ram, storage, network controller, and other things have already been built into it. So, it can supply power to multiple servers using one chassis. The cable can be managed easily and can be configured or replaced if any problem occurs.
A directory service, which can manage all networking objects, users, groups, computers centrally and securely. AD actually stores the same windows server information, works as a central database of a Domain Controller.
So, we can say, Active directory is a collection of services (Server Roles and Features) used to manage identity and access for and to resources on a network.
Using Active Directory Domain Service [ AD DS], when we install an active directory on a windows server that is called Domain Controller.It authenticates users, stores user account information, and enforces security policy for a Windows domain.
In AD DS database file, which is formatted as ntds.dit. This stores AD data and manages the DC. Domain controllers host and replicate the directory service database inside the forest.
For sharing folders, SYSVOL — system volume is a special directory in the Domain controller. The default location is %SYSTEMROOT%\SYSVOL\sysvol for the shared folder, It is the repository for all of the active directory files.
AD has also a feature of multi-master replication. When we connect servers under one domain, we can get any files, information or changes happen in files from one server named SRV1 to another server SRV2 and vice versa, any data from SRV2 to SRV1.
Kerberos Authentication — It is the most secure authentication. Kerberos is the authentication protocol. KDC [Key Distribution Center] has two servers at least; KDC provides a secure session key and ticket according to the user’s request.
RODC and Bitlocker are also used for security purposes.
When we have multiple DC installed in one domain, we make a Domain Controller as a global catalog. A global catalog replicates the information of every object in a tree and forest. and user login will be ensured through the global catalog.
By default, a global catalog is created automatically on the first domain controller in the forest, but any domain controller can be made into a global catalog.
It is almost similar to a group. But we can apply the policy in OU. OU has users, computers. Delegate permission to administer a group of objects. Mainly created according to the company’s departments or hierarchical structure-wise.
Distribution Group: This group is only for email communication and sharing files. But no permission can be given.
Security Group: Here every user got a SID and security permission assigned to the group, then all users will get the access of files. Different roles can be assigned to users to permit them to do the specific task.
A combination of one or multiple domains in a single hood is called forest.
Domain — is the root of the single forest.
There are certain functions that can be handled by only one domain controller at a time, Active Directory uses Flexible Single Master Operations (FSMO) roles, also known as operations master roles.
In this topic you need to have a basic knowledge over IP address, MAC address, subnetting.
Dynamic Host Configuration Protocol (DHCP) services automatically assign IP addresses and related parameters (including subnet mask and default gateway and length of the lease) so that a host can immediately communicate on an IP network when it starts.
DHCP uses the DORA method to provide a user with an IP address.
Discover — In this section, a DHCP client searches for a DHCP server by broadcast in the network.
Offer — One DHCP server offers the DHCP client that it can provide the client IP address.
Request — DHCP client receives that message and requests the server to provide the client with available IP.
Acknowledge — DHCP server acknowledged the request and provided the IP to the client which is available at that time.
One IP address isn’t always available for that specific client. It routes client to client regarding the duration of usability of that IP address. In DHCP scope, we can set a valid range of available IP addresses to provide the client, lease to client computers on a particular subnet.
Sometimes we can reserve some IP addresses in the DHCP database for higher authorities.
Multiple DHCP servers can be implemented in servers, but each server must share a unique IP address. One DHCP server can have this range of IP, example— 192.168.10.0 to 192.168.10.254. Another one must have this — 192.168.11.0 to 192.168.11.254
When we have a server computer / host, which we add to a domain; then we get a domain name like this — Hostname.domain. This pattern is called Fully Qualified Domain Name [ FQDN]
For the FQDN result.bist.com, the TCP/IP hostname is result and its domain is bist.com. The “result” is the part of netbios.
That means in an address — the name we got before a dot [.] is the part of netbios.
DNS or Domain Name System is like a phonebook on the internet. When we save a contact in our phone. We put a name over their mobile number and also have other information about them. So, like that, when we call — medium.com at the address bar. The DNS server translates the domain name to the IP address so browsers can load Internet resources.
We can resolve hostnames to IP addresses, vice versa. It can locate global catalog and also if someone hits on the server for sending an email it locates the mail server to deliver the email.
DNS Zone:
Forward Lookup Zone: We call by hostname
Reverse Lookup Zone: We call by IP address
There are also many DNS records:
In Active Directory, you can have domain controllers running different versions of Windows servers, such as Windows 2000, Windows Server 2003, or Windows Server 2008.
The forest functional level depends on which Windows Server operating system versions are running on the domain controllers in that forest.
You can add any DC only using the same Windows Server operating system version or above.
In Domain Functional Level, it depends on which Windows Server operating system versions are running on the domain controllers in that domain.
As a domain keeps under a forest. So, the Server OS version we used in forest, must use that version or above in the domain to install DC.
This device performance increased serially. The IOPM [ Input Output per Minute] is the performance measurement scale. SSD is the best because it reads very fast. Approx. 1.5 mio IOPM. Basically, choose your device according to applications read-write on the device.
DAS — Direct Attached Storage — it is attached with the server and it can be configured very easily. But the performance got a little bit slower.
NAS — Network Attached Storage — There are multiple servers connected through IP within a network. It can easily share the files to the client PC.
SAN — Storage Area Network — This is the most reliable, faster storage. We can connect multiple servers in the SAN switch port with individual HBA [ Host Bus Adapter] for individual servers. To configure the SAN switch, HBA cards have WWID [ World Wide ID] to keep themselves unique. Without it we cannot share any resources. To ensure high performance, we use SAN storage to write high end applications faster.
Another way to restore the data if a single server goes down is “Redundant Array Independent Disk” [RAID].
RAID is basically a data storage technology which combines multiple physical disks into one single logical unit to prevent data loss, improve data redundancy.
RAID provides fault tolerance by using:
A number of standard schemes have evolved. These are called levels. The RAID levels are:
RAID 0 — This has 2 disks, which stores by stripe. Stripe means — One data fills in disk1, then the 2nd data will fill in the disk2. This is how it will store data on disks.
RAID 1 — This mirrors the data of the both disk. Mirrors means — Copying the files in other disk. It copies very slowly
RAID 5 — It also stores data by stripe but has a parity disk which mirrors the whole disk. It has 5 disks.
RAID 6 — It also stores data by stripe but has two parity disks which mirror the whole disk. It has 6 disks.
RAID 0 + 1 — It is widely used and gives high performance. It is a combination of RAID 0 and RAID 1 disks. Data is stored by stripe. The same data gets mirrored in other disks. So there is less risk of losing data.
Sites are associated with IP subnets ;
AD sites represent the location of DCs in a single server. AD sites and services provide the benefits of managing organizations that have branches in different locations, but fall under the same forest.
A bridghead used for the replication within multiple DCs in a single sites. It also helps to control the data replication from one server to another.
Suppose, there are 3 data centers of a company which are located in different locations. The 3 sites has multiple Domain Controller, As AD has multimaster replication features so all data will replicate within each site’s DC to another sites. To make it easier, we can set a DC as a BridgeHead server from a single server. So that data only replicates via server head to server head, not all site’s DC at a time. Then it will replicate within the site’s Domain Controller.
Group Policy is one of the most powerful features of Active Directory that controls the working environment for user accounts and computer accounts.
Group Policy provides centralized management and configuration of operating systems, applications, and user settings in an Active Directory environment.
Group Policy Object is the set of Group Policy Setting. Group Policy setting is the implementation of a single specific user, windows, computer policy to prevent data breach, solidify the security, imposing rules.
Group policy splits in two ways:
Group Policy Containers — In this section this keeps the updated record of the policy, the Policy Version.
Group Policy Template — here we can get the location of registry‑based policy settings and also group policy settings.
In this blog you will get an overview of the course, not get 100% topic coverage. Please do googling with the topic names and watch YouTube videos regarding the topics if you got puzzled.
#HappyLearning #ShareOpportunities
Copyright © 2024 Md. Samsel Arifin Chowdhury. All rights reserved.
