Chapter 25 — Laboratory I

Chapter 25 — Laboratory I

Lesson map

Lesson 25 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["25.1 Purpose and rules"]
  N2["25.2 The task"]
  N3["25.3 Method and reproducibility"]
  N4["25.4 Structure of the note"]
  N5["25.6 Assessment rubric"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["25.1 Purpose and rules"]
  N2["25.2 The task"]
  N3["25.3 Method and reproducibility"]
  N4["25.4 Structure of the note"]
  N5["25.6 Assessment rubric"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX049"]

[Learning outcomes and connection]
    |
    v
[25.1 Purpose and rules]
    |
    v
[25.2 The task]
    |
    v
[25.3 Method and reproducibility]
    |
    v
[25.4 Structure of the note]
    |
    v
[25.6 Assessment rubric]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes and connection

After this laboratory you can (1) combine inventory, network-flow, vulnerability and access evidence into one assessment of a synthetic operator; (2) record methods, versions and outputs so that someone else can reproduce your results; (3) separate findings, interpretations and recommendations; and (4) assess your own work against a rubric. It integrates Labs 2, 4, 5 and 7 (Chapters 3, 7, 9 and 13) and the methods of Chapters 15, 23 and 24. It is the first project checkpoint of the course.

25.1 Purpose and rules

This laboratory is a contained assessment of the synthetic Calder operators using only the book's offline labs. Its rules of engagement (Chapter 10, practical activity) apply: your own computer, no network access to real systems, no real data. The skill being assessed is not running code — that is the easy part — but assembling evidence into a defensible judgement and documenting it so that another student could reproduce it.

Its stop conditions apply here too: if any Calder lab script tries to reach the network, stop, record the script hash and tell your tutor.

25.2 The task

You are an intern for the County Resilience Partnership. Produce a 1,500-word assessment note answering: "Across the evidence available, what are the three highest-priority security improvements for Calder's operators, and how confident are we?" Use:

1. Lab 2 (CVH inventory): unsupported and misplaced devices.
2. Lab 4 (CW flows): violations of the conduit policy.
3. Lab 5 (CPN advisories): vulnerable assets, ordered by exploitation and exposure.
4. Lab 7 (access review): orphaned, dormant, shared and toxic accounts.

The question asks for three priorities across four operators, which forces comparison: a CW conduit violation and a CPN gateway flaw must be ranked against each other by consequence, not reported in separate lists.

25.3 Method and reproducibility

Record for each lab: the file name and a SHA-256 hash of the script you ran (python3 -c "import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" lab05.py), the Python version, the exact output and any change you made. Reproducibility is evidence: a reader who reruns your script and gets the same output can trust your findings section without trusting you (Sandve et al., 2013).

If you changed Lab 5's version list to test VPN-01 against a different fix release, the hash in your appendix must be of that edited file, and the change listed beside it.

25.4 Structure of the note

1. Summary — three priorities, one sentence each, with confidence (high/medium/low) and why.
2. Scope and method — what was examined, how, what was not.
3. Findings — facts from outputs only (e.g. "VPN-01 runs 9.1; the fix is 9.3; the advisory states exploitation").
4. Analysis — consequence-first reasoning (Chapter 23): which findings could lead to the worst outcomes for which service.
5. Recommendations — each mapped to findings, with control type (Chapter 24) and owner.
6. Limits — sample size, synthetic data, unverified claims.
7. Appendix — hashes, versions, outputs.

"VPN-01 runs 9.1; the fix is 9.3" belongs in findings; "so CPN remote access is priority 1" belongs in analysis, where the consequence reasoning can be challenged separately.

25.5 Worked example: one priority, fully argued (synthetic)

Priority 1 — upgrade and re-architect CPN remote access (confidence: high). Finding: VPN-01 (internet-exposed) runs a version older than the fix for an exploited, critical flaw (Lab 5). Finding: the original design places remote users directly on the control network (Chapter 16). Analysis: this is the shortest path from the internet to feeder control; the consequence is loss of control of distribution, the most severe outcome in the CPN service model (Chapter 21). Recommendation: emergency upgrade to 9.3 (corrective/technical; owner: CPN infrastructure lead, this week), then terminate remote access on a DMZ jump host with per-session vendor approval (preventive/technical and procedural; owner: CPN OT security, next quarter). Confidence: high, because the finding comes directly from version data and the advisory, and the consequence follows from the architecture. Limit: the lab cannot show whether the flaw has already been exploited; a compromise assessment of VPN-01 is recommended.

25.6 Assessment rubric

The rubric rewards the same habits as the worked priority: every finding traced to output, consequences compared across operators, owners and dates on recommendations, honest limits and a reproducible appendix. A note that scores 3 on evidence but 1 on prioritisation has listed findings without judging them.

25.7 Common errors and limits

• Listing every finding instead of prioritising.
• Recommendations that do not follow from any finding.
• Mixing facts and interpretations in the findings section.
• Claiming certainty that synthetic data cannot provide.

A note that lists all six Lab 4 flows, all five unsupported devices and every Lab 7 account has made the first error. Recommending MFA for CW without a finding about CW accounts is the second. Writing "the RDP connection is an intruder" in findings is the third. Claiming high confidence about real-world exploitation from synthetic data is the fourth.

Exercises — chapter 25

EX049 — Priorities 2 and 3. Objective: complete the assessment. Inputs: Labs 2, 4, 7. Steps: write priorities 2 and 3 in the format of the worked priority above. Expected evidence: two argued priorities. Rubric: use the laboratory's assessment rubric; 3 = e.g. CW corporate→control RDP and control→internet flows investigated and closed (Lab 4), and leaver/toxic/vendor accounts (Lab 7) or isolation of unsupported clinical devices (Lab 2), each with consequence reasoning, owner and confidence; lower scores per rubric.

EX050 — Reproducibility check. Objective: verify a peer's work. Inputs: a classmate's appendix (or your own, exchanged). Steps: rerun each script, compare hashes and outputs, and write a 100-word verification statement. Expected evidence: the statement. Rubric: 3 = hashes and outputs compared, any discrepancy explained (e.g. edited script, Python version); 2 = outputs only; 1 = statement without rerunning; 0 = none.

Chapter synthesis

Laboratory I turns separate exercises into one judgement. Trace every finding to reproducible output, reason from consequences across operators, map recommendations to findings and owners, and state confidence and limits explicitly.

Continue studying — chapter 25 of 40

← Chapter 24 · Course chapter index · Chapter 26 →

Continue to the next authored lesson.