◇ OpenCyber Academy
Bachelor's · Chapter 5 · English

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Common patterns"]
  N2["5.2 Evidence left behind"]
  N3["5.3 Recognising phishing"]
  N4["5.4 Incident to investigation"]
  N5["5.5 Defensive framing"]
  N6["5.6 Users are not culprits"]
  N7["5.7 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Common patterns"]
  N2["5.2 Evidence left behind"]
  N3["5.3 Recognising phishing"]
  N4["5.4 Incident to investigation"]
  N5["5.5 Defensive framing"]
  N6["5.6 Users are not culprits"]
  N7["5.7 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Common patterns]
    |
    v
[5.2 Evidence left behind]
    |
    v
[5.3 Recognising phishing]
    |
    v
[5.4 Incident to investigation]
    |
    v
[5.5 Defensive framing]
    |
    v
[5.6 Users are not culprits]
    |
    v
[5.7 Reporting]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain common attack patterns at a conceptual level; (2) identify the evidence they leave; (3) recognise phishing; (4) explain how incidents lead to forensic work.

5.1 Common patterns

Phishing messages lure users to fake login pages or malicious attachments. Stolen credentials let intruders log in as the user. Malware may then persist, steal data or spread. MITRE ATT&CK names these behaviours as techniques, such as phishing for initial access, and lists data sources that may reveal them.

The ws-114 case follows this chain: a phishing email, a downloaded file, a process that loads update.dll. Naming each step with an ATT&CK technique helps Leah search for the right evidence, because each technique entry lists the logs and artefacts likely to show it.

5.2 Evidence left behind

Phishing leaves email headers and bodies, browser history of the fake page, and perhaps a downloaded file. Credential misuse leaves logon records from unusual locations or times. Persistence leaves registry entries, scheduled tasks or services.

Each step leaves its own traces in different places, so an investigation that checks only one source sees part of the story. For ws-114, Leah lists where to look for each step: the mailbox for the email, the browser history for the fake page, the Downloads folder for the file, logon records for credential use, and the registry and task scheduler for persistence. Missing traces in a source are also recorded.

5.3 Recognising phishing

Mismatched sender domains, urgent language, links whose visible text differs from their destination, and requests for credentials. Leah practises on synthetic emails supplied by the security office.

Each indicator is weak alone: real IT messages can sound urgent, and legitimate links sometimes go through tracking domains. Several together, as in the ws-114 email with its example.net sender and mismatched link, make a strong case. Leah records each indicator with the exact header or body line, so a reader can check it without trusting her judgement.

5.4 Incident to investigation

NIST SP 800-61r3 frames incident response as part of risk management: detect, respond, recover, improve. Forensic examination answers questions responders need: how did it start, what was affected, is it contained?

For ws-114, responders need to know whether s.kaur's credentials were stolen, whether other machines were affected, and whether isolation stopped the activity. The forensic work is shaped by these questions: it prioritizes evidence that answers them quickly and records the rest for deeper analysis later, so urgent answers are not delayed.

5.5 Defensive framing

The course studies attacks only to recognise and investigate them. No techniques for committing attacks are taught.

In practice this means the labs use synthetic artefacts and safe scripts that read data, never code that exploits a system. When students study a malware sample's behaviour, they do so from reports or in an isolated environment approved by the lecturer. Knowing how an attack leaves traces is enough to investigate it; knowing how to build one is not part of the course.

5.6 Users are not culprits

A user who clicked a convincing link is usually a victim. Reports describe actions, not blame.

Reports that blame users discourage reporting: someone who fears blame may hide a mistake that responders need to know about quickly. For ws-114, the report describes what s.kaur's account did and when, and treats the phishing email's quality as a finding about the attack. Recommendations focus on controls such as link checking and multi-factor authentication rather than on the person, which is where improvements can be made.

5.7 Reporting

Students learn to report suspicious messages through official channels, never by forwarding them to friends.

Forwarding a phishing message spreads the link to more people and may strip headers that responders need. The official channel, such as a reporting button or the security office's address, preserves the message with its headers and alerts staff who can block the sender for everyone. At Harrowgate, Grace Lin's team receives these reports and uses them to find other recipients of the same campaign.

Worked example

The ws-114 phishing email claims to come from "IT Servicedesk" but its sender domain is example.net, not the university's. The link text reads "intranet login" but points to login-portal.example.net. Leah lists each indicator with the header or body line that shows it.

Synthetic case. The email is invented.

Errors and limits

Indicators raise suspicion; a legitimate external service can also look unusual, so verification with the sender's organisation matters.

Exercises

Synthesis

Recognise attack patterns by the evidence they leave, and investigate without blaming victims.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →