Andrew Vu
Digital Forensics & Incident Response · Security Analyst
Oregon, USAB.S. Computer Science + Cybersecurity Certificate, Oregon State University, 2026
CompTIA Security+ — scheduled August 2026
Casework
Each page states what the evidence established, and — separately — what it did not, with the artifact that would settle each open question.
Tooling
Grouped by function.
Forensics & Incident Response
- Autopsy
- FTK Imager
- Registry Explorer
- ShellBags Explorer
- HxD
- Windows Event Viewer
- E01 evidence images
- Registry hive analysis (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat)
- USBSTOR & MountedDevices
- ShellBags
- MRU keys
- Event log analysis
- File carving & signature analysis
- Timeline reconstruction
- Malware detection triage
- Anti-forensics detection
- Chain of custody
- Expert witness reporting
Detection, Windows & Active Directory
- Wazuh (SIEM)
- Sysmon
- Autoruns
- Process Explorer
- Process Monitor
- Windows Advanced Audit Policy
- PowerShell script-block logging
- Active Directory Domain Services
- Group Policy
- NTLM & Kerberos
- SMB signing
- RDP / Network Level Authentication
Linux, Network & Cloud
- Linux hardening
- OpenSSH / sshd_config
- vsftpd
- Wireshark
- Packet analysis
- TCP/IP
- DNS
- AWS IAM
- Google Cloud IAM
- Service accounts
- Least-privilege role design
- RBAC
- VMware vSphere
- Docker
- CI/CD
Governance & Frameworks
- NIST Cybersecurity Framework
- CIS Controls
- COBIT
- ISO 27001
- DISA STIGs
- Risk assessment
- Vulnerability assessment
- Security policy development
Development & ML
- Python
- Java
- JavaScript/TypeScript
- C/C++
- SQL
- Bash
- PyTorch
- Convolutional neural networks
- React Native
- Next.js
- FastAPI
- REST APIs
- PostgreSQL
Security coursework
Oregon State University.
- CS 473Digital Forensics
- CS 373Defense Against the Dark Arts: Enterprise Defense
- ECE 478Network Security
- CS 427Cryptography
- CS 370Introduction to Security
- BIS 482Information Security Governance
- Cloud Application Development
Additional security work
Security governance framework comparison
BIS 482 Information Security Governance · Team assignment
Compared CIS Controls, the NIST Cybersecurity Framework, and COBIT for a small healthcare clinic risk assessment, evaluating control specificity, implementation burden, governance scope, and top-down versus bottom-up adoption; recommended CIS Controls as the practical entry point for an organization without a mature risk program. Also designed an enterprise security staffing model spanning CISO, security manager, architect, analyst, incident responder, IAM specialist, GRC analyst, and security engineer roles.
Google Cloud IAM for a deployed application
Cloud Application Development
Configured GCP IAM for a deployed application: dedicated service accounts per component with least-privilege roles scoped to required resources rather than broad predefined roles, eliminating shared high-privilege credentials between services.
AWS IAM access-control model
StrokeVision · iOS application, pre-release
Implemented the access-control model for an iOS application preparing for TestFlight release: scoped S3 bucket policies and IAM roles per service, isolated each user's uploaded video under least-privilege access, and kept long-lived credentials out of the mobile client.
StrokeVision case studyApplied security in systems I built
Attack surface and mitigations for systems I built, rather than environments I was given.
LLM → Home Assistant Safe Execution
Home Assistant AIThreats
- Prompt injection → unauthorized service calls
- Entity spoofing → control wrong devices
- API key leakage → unauthorized HA access
- Malformed JSON → unexpected execution behavior
Mitigations
- Allow-listed services (explicit whitelist)
- Entity ID validation against known devices
- JSON Schema validation on all LLM output
- API keys in environment variables only
- Input sanitization before prompt construction
- Error isolation per command
SponsorHub Payout Correctness & Fraud
SponsorHubThreats
- Fake conversions → inflated payouts
- Replay attacks → duplicate payouts
- Budget overrun → overspending client funds
- Tampered attribution → incorrect creator credit
Mitigations
- HMAC-signed attribution artifacts
- Composite key dedup + time window
- Append-only ledger (no mutation)
- Idempotent Stripe payouts
- Funding gate (state machine enforcement)
- Budget cap at rollup layer
Cybersecurity resume
Tooling, coursework, and experience in one page.