Edwin
Ngobeni Computer networks & security.
Pretoria, Gauteng.

I built a small multi-subnet lab on Ubuntu and put a firewall and an intrusion detection sensor on the same host, so I could set a policy and then watch what the sensor made of the traffic that policy allowed through.

UFW started from default-deny inbound, then opened only what the lab actually needed: remote access, web traffic, one internal service restricted to a single trusted host, and an explicit block on a host I wanted shut out entirely. Adding a second interface and enabling forwarding between the subnets turned the box into a routing firewall rather than just a protected endpoint.

For detection I ran Snort against a custom ruleset alongside the distribution signatures, and configured Suricata on the same host to compare how the two engines behaved. Writing my own rules for ICMP, HTTP requests and SYN-flagged scans is what turns signature syntax from something you read about into something you can debug when a badly scoped rule floods your console.

What the sensor mostly caught was not attacks. Repeating service-discovery broadcasts, and a session using a port pairing that no longer makes sense on a modern network. Low-priority, easily explained, and exactly the reason triage matters more than alert volume. Learning to clear that kind of traffic quickly is what keeps a real alert visible.

Things breaking is where the useful part happens: a packet filter expression that wouldn't parse, a log Snort refused to replay because of its own format, UFW rejecting a protocol until the rule is written the way it expects. That is the loop I want to be in daily. Set a policy, watch what the sensors say about it, then cut the noise down so the alerts that matter stay visible.

Seven student teams were handed the same crisis. A hacktivist group had exploited unpatched control software to trigger a thirty-hour blackout, hospitals had been forced onto generators, eighty-nine people were dead, and the group had issued a seventy-two-hour ultimatum threatening to publish their exploit. We had to write a policy brief and defend it to a judging panel playing the President's Cabinet.

The technical picture was the easy half. A vendor patch existed, but rollout was uneven: two metros and a key gateway were still exposed, an internal change freeze had slowed updates, and there was evidence of insider-enabled access. The hard half was that the group's demands were popular ones. An independent security audit and open policy hearings are things you would want anyway. Agreeing to them under a deadline means agreeing to them under extortion.

We weighed three routes: harden and prosecute, concede and negotiate, or a hybrid. We recommended the hybrid. Lock down the operational network, finish the patch rollout with checksum validation, deploy emergency power support, announce an independent audit on our own terms, and signal civil society consultations to buy time. We named its weakness out loud rather than hiding it: coordination across that many departments is where it would most likely fail.

The habit I want to bring into a security team is what we attached to the recommendation. Explicit escalation and de-escalation triggers, so decision-makers know in advance what would change the plan. Metrics they can check for themselves: substations patched, residual access points closed, regional cooperation with Eswatini and Namibia through the Southern African Power Pool. A recommendation with no way to hold it accountable is just an opinion delivered confidently.

Security work reaches people who will never read a packet capture. I want to keep doing the technical half and stay able to explain it to the room that has to sign it off.

The CHPC Student Cluster Competition is the CSIR's flagship HPC programme: an intensive training week on remote cluster hardware in Cape Town, continuous assessment throughout, and only the ten strongest teams nationally go through to the finals.

I captained Switch Squad through selection and we qualified. In December we get a fixed budget and a hardware list, build a cluster on the conference exhibition floor, and are judged on benchmark results, application efficiency and design.

It reads like a different discipline to networking, but it isn't. A cluster is a network with unusually demanding neighbours. Addressing, routing, firewalls, NAT and SSH are the ground floor before a single benchmark runs.