Chapter 20 — Network and communications security: foundational cases

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 Learning from cases"]
  N2["20.2 Case: flat network spread"]
  N3["20.3 Case: forgotten remote access"]
  N4["20.4 Case: expired certificate"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 Learning from cases"]
  N2["20.2 Case: flat network spread"]
  N3["20.3 Case: forgotten remote access"]
  N4["20.4 Case: expired certificate"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 Learning from cases]
    |
    v
[20.2 Case: flat network spread]
    |
    v
[20.3 Case: forgotten remote access]
    |
    v
[20.4 Case: expired certificate]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) analyse common network incidents; (2) extract lessons; (3) relate cases to the clinics.

20.1 Learning from cases

Cases teach how failures happen in practice. Priya studies anonymised, synthetic case summaries prepared by her tutor, each based on common patterns rather than specific events. For each, she asks what happened, which controls were missing or failed, how it was detected and what changed afterwards. The aim is not to memorise incidents but to recognise patterns that recur, so that she can spot them in new settings such as the clinics before they turn into incidents. She records each pattern in a short table she can reuse.

20.2 Case: flat network spread

In the first case, a visitor's infected laptop at a small practice joins the shared wireless network. Malware scans the local network, finds a file share on a reception computer and encrypts its files. With no separation and no logging, the practice notices only when staff cannot open documents. The lessons are separation of visitor devices, host firewalls on shared computers and basic logging. Priya notes how closely this matches the clinics' current design, which strengthens her case for change.

20.3 Case: forgotten remote access

In the second case, a supplier installed remote access software on a server years ago for maintenance. The account used a weak password and was forgotten when the contract ended. Someone outside the organisation used it to log in. The lesson is that remote access paths must be inventoried, controlled through a known route, protected with strong authentication and removed when no longer needed. Priya adds a question to her clinic review: which suppliers have any form of remote access today?

20.4 Case: expired certificate

In the third case, a booking site's certificate expired over a weekend. Users saw warnings and many clicked through; some phoned to complain, and staff told them to ignore warnings. When a genuine fake site appeared later, users were already used to ignoring warnings. The lessons are certificate expiry monitoring and clear messages that warnings must not be ignored. This connects directly to the booking portal certificate Priya found close to expiry. Monitoring expiry dates is cheap compared with the cost of retraining users to trust warnings again.

Worked example

Priya's case table lists three cases, their missing controls and the matching clinic risk for each.

Synthetic case. All cases are synthetic composites.

Errors and limits

Treating cases as stories rather than extracting controls leaves no practical lesson.

Exercises

• EX058 — Flat spread lessons. List three controls that would have limited the flat network case.
  Show marking criteria

  Rubric: 3 = separation, host firewall, logging;; 2 = two;; 1 = one;; 0 = none.
• EX059 — Supplier access question. What question did the remote access case add to the clinic review?
  Show marking criteria

  Rubric: 3 = which suppliers have remote access now;; 2 = suppliers;; 1 = vague;; 0 = none.
• EX060 — Warning fatigue. How did the expired certificate later help a fake site?
  Show marking criteria

  Rubric: 3 = users trained to ignore warnings;; 2 = warnings;; 1 = vague;; 0 = none.

Synthesis

Common incident patterns reveal which basic controls matter most for small organisations.

Continue studying — chapter 20 of 40

← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →