Chapter 29 — Systems, endpoints and hardware security: operations
Lesson map
Lesson 29 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes"]
N1["29.1 Logon review"]
N2["Lab — admin logons"]
N3["29.2 Reading the result"]
N4["29.3 Investigation"]
N5["29.4 Routine"]
N6["What logon records show"]
N7["Keeping the review small"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["29.1 Logon review"]
N2["Lab — admin logons"]
N3["29.2 Reading the result"]
N4["29.3 Investigation"]
N5["29.4 Routine"]
N6["What logon records show"]
N7["Keeping the review small"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX085"]
[Learning outcomes]
|
v
[29.1 Logon review]
|
v
[Lab — admin logons]
|
v
[29.2 Reading the result]
|
v
[29.3 Investigation]
|
v
[29.4 Routine]
|
v
[What logon records show]
|
v
[Keeping the review small]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes
You will (1) review admin logons; (2) set simple alerts; (3) run a weekly routine.
29.1 Logon review
Admin logons to servers are reviewed weekly.
The review covers sign-ins to the four servers and to laptops using the two named admin accounts. Gareth exports the week's records from the management server and runs the logon lab over them. Each flagged record is checked against the change log or with the person involved before it is closed. The review takes about ten minutes, because the flag rules are tuned to produce only a handful of items each week. The flag rules are written in the lab so Gareth can change them.
Lab — admin logons
"""Review synthetic administrator logons and flag unusual ones (stdlib only)."""
logons = [("it-gareth", "BHA-S01", "09:12"), ("it-gareth", "BHA-S02", "10:40"), ("it-contractor", "BHA-S03", "14:05"),
("it-gareth", "BHA-L22", "11:30"), ("admin", "BHA-S04", "02:47"), ("it-contractor", "BHA-S01", "23:15"),
("it-gareth", "BHA-S01", "16:20")]
named = {"it-gareth", "it-contractor"}
for u, h, t in logons:
hr = int(t[:2]); flags = []
if u not in named: flags.append("shared/default account")
if hr < 7 or hr >= 20: flags.append("out of hours")
if flags: print(f"{t} {u:14} {h}: {', '.join(flags)}")
print(f"logons {len(logons)}")
Run with python3 lab_logons.py. Verified output:
02:47 admin BHA-S04: shared/default account, out of hours
23:15 it-contractor BHA-S01: out of hours
logons 7
29.2 Reading the result
Of 7 logons, 2 are flagged: the default "admin" account on S04 at 02:47, and the contractor on S01 at 23:15.
Both flags turn out to have ordinary explanations, which is the usual result. The 02:47 sign-in is flagged twice, as an unnamed account and as out of hours, so it is checked first. The other five sign-ins are named accounts during working hours and need no action. The lab prints only the flagged records and a total, so Gareth sees two lines to check rather than seven to read.
29.3 Investigation
The 23:15 logon was planned maintenance; the 02:47 default-account logon was a scheduled task using the old account, which is reconfigured and the account disabled.
Both explanations lead to a small fix rather than an incident. The contractor's maintenance had not been written in the change log, so contractors now record planned work in advance. The scheduled task is moved to a named service account before the default account is disabled. Gareth records both explanations in the change log, so the same flags can be closed quickly if they appear again.
29.4 Routine
Weekly: logon review, failed updates, unmanaged devices.
The weekly routine is a one-page checklist Gareth follows every Monday. It covers the logon review, failed and overdue updates, the inventory comparison and backup completion. Monthly, he adds the encryption verification and the services check, and each completed checklist is saved as evidence. The routine names the report for each step and its expected time, and a trained colleague follows it when Gareth is on leave. Urgent findings, such as a missing backup, are handled the same day.
What logon records show
Windows records successful and failed sign-ins in its security log, and the management server can collect them centrally. NIST SP 800-92 describes log management as collecting, storing and reviewing records so that unusual events can be noticed. For Bramley, the question is modest: did anyone sign in to a server at a strange hour, or fail many times in a row?
Aisha's lab reads seven synthetic records, each with an account, a device and a time. It flags sign-ins before 07:00 or from 20:00 onwards, and any account that is not one of the two named admin accounts. Two of seven are flagged: the default "admin" account on S04 at 02:47 and the contractor on S01 at 23:15.
Gareth checks both. The contractor was doing agreed maintenance, which had not been written in the change log; the 02:47 sign-in was a scheduled task still using the old default account. Neither is an incident, but both lead to small improvements: contractors now log planned work in advance, and the task is moved to a named service account before the default account is disabled.
Aisha stresses that a flag is a question, not a verdict. Most flags will have ordinary explanations, and the point of the review is to know them.
Keeping the review small
A weekly ten-minute review is sustainable for one officer; a daily hour is not. The flags are therefore tuned to produce a handful of items per week. If the list grows long, the rules are adjusted rather than ignored.
Privacy
Logon records are personal data. They are kept for 90 days, viewed only by IT and used only for security.
Contractor access
Contractor accounts are enabled only for agreed maintenance windows.
Worked example
Aisha writes the weekly routine as a one-page checklist taking about 30 minutes.
Synthetic case. Synthetic.
Errors and limits
Out-of-hours alone is not suspicious; check context.
Exercises
- EX085 — Lab flags. Which logons were flagged? Rubric: 3 = admin S04 02:47; contractor S01 23:15; 2 = partial; 1 = vague; 0 = none.
- EX086 — 02:47 cause. What explained the 02:47 logon? Rubric: 3 = scheduled task with old account; 2 = partial; 1 = vague; 0 = none.
- EX087 — Routine. What does the weekly routine cover? Rubric: 3 = logons, failed updates, unmanaged; 2 = two; 1 = one; 0 = none.
Synthesis
Simple weekly reviews catch leftovers.
Continue studying — chapter 29 of 40
← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →