Chapter 5 — Security literacy | Bachelor's Security operations and blue team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Universities as targets"]
  N2["5.2 Phishing"]
  N3["5.3 Account compromise"]
  N4["5.4 What a SOC does"]
  N5["5.5 Helpful behaviours"]
  N6["5.6 Reporting culture"]
  N7["5.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Universities as targets"]
  N2["5.2 Phishing"]
  N3["5.3 Account compromise"]
  N4["5.4 What a SOC does"]
  N5["5.5 Helpful behaviours"]
  N6["5.6 Reporting culture"]
  N7["5.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Universities as targets]
    |
    v
[5.2 Phishing]
    |
    v
[5.3 Account compromise]
    |
    v
[5.4 What a SOC does]
    |
    v
[5.5 Helpful behaviours]
    |
    v
[5.6 Reporting culture]
    |
    v
[5.7 Case]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain common threats to universities; (2) describe phishing and account compromise from the defender's view; (3) explain the role of a SOC; (4) recognise everyday security behaviours that help defenders.

5.1 Universities as targets

Universities hold personal data, research and payment systems, and have open networks and many users. Common incidents include phishing, account compromise, ransomware and misuse of research computing.

Riverton's case shows why: thousands of students change every year, staff share accounts across departments, and many people use the same email address for teaching, research and administration. A single compromised account can reach many others because messages from a university address look legitimate to colleagues and students alike. Open networks for visitors add further exposure.

5.2 Phishing

Phishing emails imitate trusted senders to trick people into revealing passwords or opening harmful files. The "Library fines overdue" email linked to a fake sign-in page styled like Riverton's.

The email's subject played on a common worry, and the fake page used Riverton's logo and colours. The domain resembled the library's real address but was registered only days before the campaign. Students who entered their password were redirected to the real library site, so many did not realise anything had happened.

5.3 Account compromise

With a stolen password, an attacker signs in as the victim, reads mail, creates rules to hide replies or forward mail, and sends more phishing to contacts. Compromised accounts spread campaigns because messages come from a trusted sender.

In the case, the attacker used s2047 to create a rule forwarding its mail to an external address and then sent the library-fines email to the account's contacts. Recipients saw a message from a classmate's real address, which made them more likely to click. This is how one stolen password can extend a campaign.

5.4 What a SOC does

A SOC monitors logs and alerts, investigates suspicious activity, coordinates response and helps improve defences. Riverton's SOC is small: two staff and six student analysts.

With so few people, Riverton's SOC relies on clear priorities. During the campaign, one staff member coordinated with the identity team while student analysts handled reports and searched logs. Monitoring continued for other alerts throughout, because a large phishing campaign can hide a quieter attack happening at the same time, and student analysts are trained to escalate anything unrelated.

5.5 Helpful behaviours

Reporting suspicious emails, using multi-factor authentication and not reusing passwords make defenders' work easier. Reports often arrive before technical detection.

In the library-fines campaign, the first report arrived from a staff member several minutes before any filter flagged the message. Accounts with multi-factor authentication were much harder to misuse even after a password was entered on the fake page, because the attacker also needed the second factor. Unique passwords kept the stolen ones from opening other services, such as library and payment accounts.

5.6 Reporting culture

People report more when they are thanked, not blamed. The SOC replies to every report.

During the campaign, one student who had clicked and entered her password reported it herself. The SOC reset her password, signed out her sessions, checked for new mail rules and thanked her. Treating her as a helpful reporter rather than a careless user encourages others to come forward quickly, which is when response is easiest. The reply also told her what to watch for afterwards, such as unexpected sign-in prompts.

5.7 Case

Within an hour of the campaign, 95 reports reach the SOC's phishing mailbox — the first signal of the incident.

Lucas sorts the first reports by arrival time and finds that they all quote the same subject and sender, which confirms a single campaign rather than several unrelated ones. The earliest report gives the time the campaign started, which later becomes the starting point for searching sign-in logs for suspicious activity. He also notes that the campaign's subject line is reusable in a mail search, which shows how many mailboxes received it and lets the mail team remove the message from those that have not yet opened it.

Multi-factor authentication

MFA asks for a second proof, such as an app approval. Riverton requires it for staff but only recommends it for students, which matters later in the case.

Worked example

A student reports that she entered her password before noticing the fake address. The SOC resets her password, signs out her sessions, checks for new mail rules and thanks her. Her quick report prevented the account being used.

Synthetic case. The campaign and reports are invented.

Errors and limits

Awareness reduces but never removes clicks; technical controls must assume some will happen.

Exercises

EX013 — Compromise actions. What might an attacker do with a stolen campus mail account? Rubric: 3 = read mail, create rules to hide/forward, send more phishing; 2 = two; 1 = one; 0 = none.
EX014 — Report value. Why are user reports valuable to a SOC? Rubric: 3 = often arrive before technical detection; 2 = partial; 1 = vague; 0 = none.
EX015 — Reporter response. How did the SOC handle the student who entered her password? Rubric: 3 = reset, sign out sessions, check rules, thank her; 2 = three; 1 = one; 0 = none.

Synthesis

Security literacy lets everyone recognise threats and helps the SOC by reporting early.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →