Chapter 31 — Security operations and blue team: advanced cases
Lesson map
Lesson 31 published. Map, example, EX091.
flowchart TD
N0["Learning outcomes"]
N1["31.1 A harder case"]
N2["31.2 Competing explanations"]
N3["31.3 Gathering evidence"]
N4["31.4 Findings"]
N5["31.5 Coordinated response"]
N6["31.6 Uncertainty"]
N7["31.7 Lessons"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX091"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["31.1 A harder case"]
N2["31.2 Competing explanations"]
N3["31.3 Gathering evidence"]
N4["31.4 Findings"]
N5["31.5 Coordinated response"]
N6["31.6 Uncertainty"]
N7["31.7 Lessons"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX091"]
[Learning outcomes]
|
v
[31.1 A harder case]
|
v
[31.2 Competing explanations]
|
v
[31.3 Gathering evidence]
|
v
[31.4 Findings]
|
v
[31.5 Coordinated response]
|
v
[31.6 Uncertainty]
|
v
[31.7 Lessons]
|
v
[Worked example] --> [Exercise EX091]
Learning outcomes
You will (1) analyse complex cases involving several systems and teams; (2) handle uncertainty and incomplete data; (3) coordinate response across organisational units; (4) extract lessons from difficult cases.
31.1 A harder case
In spring term, the SOC sees unusual SSH logins to a research server from a collaborator's university at night, followed by large outbound transfers. The research group says the collaborator is legitimate; the transfers are larger than usual.
Unlike the phishing campaign, nothing here is clearly malicious on its own: collaborators do log in, sometimes late, and research groups do move data. The difficulty is deciding whether the same activity is legitimate this time. The case tests the skills from earlier chapters under real uncertainty.
31.2 Competing explanations
Possibilities: the collaborator is working late on a big dataset; the collaborator's account at the partner university was compromised; or someone in the group shared credentials. Each predicts different evidence.
Late work predicts the collaborator will confirm the activity; a compromised partner account predicts an unusual sign-in at the partner university; shared credentials predict logins from a Riverton group member's usual location. Listing predictions first tells Lucas what to look for, rather than gathering everything and hoping a pattern emerges.
31.3 Gathering evidence
Lucas checks: login times compared with the collaborator's usual pattern; files transferred (names and sizes from server logs); whether the partner university's SOC sees anything unusual. Contacting the partner goes through Dr. Kim.
Going through Dr. Kim matters because contacting another university's SOC involves sharing information about a person and a research project. She knows the partner's contacts and can agree what may be shared. Lucas prepares the questions and the evidence, but the formal request comes from her. File names alone answer much.
31.4 Findings
The partner SOC reports that the collaborator's account signed in from an unusual country that night, and the collaborator confirms they were not working. The transfers were of a shared dataset, not personal data.
The evidence fits the second explanation and rules out the first: the collaborator was not working, and their partner account showed an unusual country. Nothing suggested shared credentials. Lucas records which predictions were confirmed and which were not, so the conclusion can be traced back to the evidence.
31.5 Coordinated response
The research group disables the collaborator's server access; the partner resets the account; Riverton reviews which data left and informs the data owner.
Each organisation acts on what it controls. Riverton cannot reset the partner account, and the partner cannot disable access to Riverton's server. Clear division of tasks, agreed on a call between the two SOCs, avoided duplicated work and gaps. Informing the data owner let them judge whether the shared dataset's release mattered. Both SOCs kept notes of the call.
31.6 Uncertainty
Some questions stay open: whether the attacker targeted the research or simply used any access found. The report states this.
Lucas's report states that the evidence cannot distinguish a targeted attack on the research from opportunistic use of any access found. It explains what would help: logs from the partner showing the attacker's other activity. Stating the unknown prevents readers from assuming either answer. The report also notes that the partner's logs may never be shared in full, since they concern the partner's own users and systems. Lucas's recommendation therefore does not depend on resolving that question.
31.7 Lessons
Research collaborations need shared contacts between SOCs and a way to verify unusual access quickly.
Before this case, nobody at Riverton knew whom to call at the partner's SOC. The lessons led to a list of contacts for each university with research collaborations, and an agreement that unusual access by a collaborator can be checked with a phone call rather than a formal letter. The termly review of external collaborators with server access, recommended in the worked example, makes it easier to answer the first question in any future case quickly: should this person have access at all, and who at their home institution vouches for them?
Time pressure
Large transfers might have continued while questions were asked, so the group paused the collaborator's access within the hour as a precaution.
Worked example
Lucas's case summary separates facts (logins, transfers, partner findings), inferences (the collaborator's account was compromised) and unknowns (attacker's aim). It recommends listing external collaborators with server access and reviewing them each term.
Synthetic case. The case is invented.
Errors and limits
Cross-organisation cases depend on others' logs and willingness to share.
Exercises
- EX091 — Three explanations. List three explanations for the night-time SSH activity. Rubric: 3 = legitimate late work, partner account compromised, shared credentials; 2 = two; 1 = one; 0 = none.
- EX092 — Deciding evidence. What evidence decided the case? Rubric: 3 = partner SOC saw unusual country sign-in; collaborator denied working; 2 = partial; 1 = transfer size; 0 = none.
- EX093 — Collaboration lesson. What lesson concerns research collaborations? Rubric: 3 = shared SOC contacts; verify unusual access quickly; list external collaborators; 2 = partial; 1 = vague; 0 = none.
Synthesis
Complex cases need competing explanations, cross-team evidence and honest reporting of what remains unknown.
Continue studying — chapter 31 of 40
← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →