◇ OpenCyber Academy
Bachelor's · Chapter 2 · English

Chapter 2 — Computing systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Computing systems

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Layers"]
  N2["2.2 Clients and servers"]
  N3["2.3 Services as chains"]
  N4["2.4 Where events come from"]
  N5["2.5 Managed and unmanaged devices"]
  N6["2.6 Mapping a service"]
  N7["2.7 Why maps help"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Layers"]
  N2["2.2 Clients and servers"]
  N3["2.3 Services as chains"]
  N4["2.4 Where events come from"]
  N5["2.5 Managed and unmanaged devices"]
  N6["2.6 Mapping a service"]
  N7["2.7 Why maps help"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Layers]
    |
    v
[2.2 Clients and servers]
    |
    v
[2.3 Services as chains]
    |
    v
[2.4 Where events come from]
    |
    v
[2.5 Managed and unmanaged devices]
    |
    v
[2.6 Mapping a service]
    |
    v
[2.7 Why maps help]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) describe the hardware and software layers of a computing system; (2) explain how users, applications and services interact; (3) identify where security events are produced; (4) map a campus service end to end.

2.1 Layers

A computing system has hardware, firmware, an operating system, applications and the people using them. Security events can arise at each layer, and SOC analysts need to know which layer produced a record to interpret it.

In the phishing case, the fake sign-in page lived on an attacker's server, the stolen password was used at the identity provider, and the mailbox rules were created in the mail service's application layer. Each layer kept different records, so Lucas had to know which one would hold evidence of each step before he could look for it.

2.2 Clients and servers

When a student opens webmail, a browser on their laptop (client) talks to a mail service (server) run by a cloud provider. Sign-in is handled by the university's identity provider, which checks the password and, if enabled, a second factor.

This matters for the case because the attacker never touched a victim's laptop. Once the password was stolen, the attacker's own browser became the client, and the identity provider and mail service saw an ordinary sign-in from a different address. The evidence therefore sits on the servers' side, in sign-in and mailbox logs.

2.3 Services as chains

One action passes through many systems: laptop, campus Wi-Fi, internet, identity provider, mail service. Each keeps its own logs with its own clock and format.

For the phishing campaign this means a single click can leave traces in the browser, a campus DNS resolver, the identity provider and the mail service, each timestamped by its own clock. Lucas learns early that matching events across these records requires converting them to one time zone and allowing for small clock differences between systems run by different teams.

2.4 Where events come from

The identity provider records sign-ins; the mail service records sent messages and rule changes; Wi-Fi controllers record device connections; laptops record local events if managed.

Each source answers a different question. Sign-in logs show who authenticated, from where and whether a second factor was used. Mail logs show rules created and messages sent, which reveal what an attacker did with an account. Wi-Fi logs would show whether a device was on campus, which matters when judging whether a sign-in is unusual.

2.5 Managed and unmanaged devices

Staff laptops are university-managed and send logs to the SOC. Student laptops are personal and do not; the SOC sees students only through university services.

In the case, this meant the SOC could not check whether a student's laptop had been infected after clicking; it could only examine the student's university account. For staff, the managed laptop's logs could confirm or rule out anything happening on the device itself. The difference shapes what each investigation can conclude, and Lucas states it in his notes.

2.6 Mapping a service

Lucas maps webmail from end to end, listing each component, its owner and its logs.

His map lists the student's browser and laptop as unmanaged with no logs, campus Wi-Fi as owned by the network team with controller logs, the identity provider owned by the identity team with sign-in logs, and the mail service owned by the cloud provider with message and rule logs. Gaps are marked in red. The map fits on one page and is updated when a service changes.

2.7 Why maps help

When the phishing campaign begins, the map tells analysts which logs to check for each question.

For example, when asked whether a suspicious sign-in came from campus, Lucas's map pointed him straight to the Wi-Fi controller logs, and also showed that those logs were not forwarded to the SOC. That gap explained why the question could not be answered quickly, and it became one of the improvements recorded after the incident, with the network team as owner and a target date.

Clocks across systems

Each system stamps events with its own clock. The SOC converts all times to UTC so events from laptops, identity and mail line up.

Worked example

Lucas's map shows that the SOC receives identity-provider and mail-service logs but not Wi-Fi controller logs. Dr. Kim notes that without Wi-Fi logs, the SOC cannot tell whether a suspicious sign-in came from campus. Forwarding them becomes a backlog item.

Synthetic case. Systems and maps are invented.

Errors and limits

Maps simplify; cloud services may change internal components without notice.

Exercises

Synthesis

Understanding layers and service chains tells analysts where events originate and which are missing.

Continue studying — chapter 02 of 40

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →