◇ OpenCyber Academy
Engineering · Chapter 15 · English

Chapter 15 — Security fundamentals

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Security fundamentals

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 CIA in a forensic lab"]
  N2["15.2 Incidents and forensics"]
  N3["15.3 Techniques and artefacts"]
  N4["15.4 Least privilege"]
  N5["15.5 Evidence store security"]
  N6["15.6 Defence in depth"]
  N7["15.7 Malware handling"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 CIA in a forensic lab"]
  N2["15.2 Incidents and forensics"]
  N3["15.3 Techniques and artefacts"]
  N4["15.4 Least privilege"]
  N5["15.5 Evidence store security"]
  N6["15.6 Defence in depth"]
  N7["15.7 Malware handling"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 CIA in a forensic lab]
    |
    v
[15.2 Incidents and forensics]
    |
    v
[15.3 Techniques and artefacts]
    |
    v
[15.4 Least privilege]
    |
    v
[15.5 Evidence store security]
    |
    v
[15.6 Defence in depth]
    |
    v
[15.7 Malware handling]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) apply confidentiality, integrity and availability to forensic systems; (2) explain how incidents create forensic work; (3) relate attacker techniques to artefacts; (4) secure evidence stores.

15.1 CIA in a forensic lab

Confidentiality: case data reach only authorised staff. Integrity: evidence and findings cannot change unnoticed. Availability: evidence can be produced when the court asks, years later. A forensic lab is itself a security target, because evidence and case information are valuable to the parties in a case.

Each property maps to concrete controls. Confidentiality needs access control and encryption at rest. Integrity needs hashes, append-only records and signed manifests. Availability needs tested backups, format migration and retention planning. An attacker who wanted to embarrass a prosecution might target integrity, while one hunting for victim data would target confidentiality, so the threat model covers both.

15.2 Incidents and forensics

NIST SP 800-61r3 places incident response within broader cybersecurity risk management; forensic examination supports it by establishing what happened. An intrusion leaves artefacts that responders and examiners collect.

Incident responders aim to contain and recover quickly, while forensic examiners aim to establish facts that will stand up to scrutiny. The goals can conflict. Wiping and rebuilding a compromised server restores service but destroys evidence. Good programmes decide in advance which systems get imaged before rebuild and how long containment can wait, so the decision is not improvised under pressure.

15.3 Techniques and artefacts

MITRE ATT&CK catalogues adversary techniques with data sources that can detect them. Priya uses it to ask, for each technique, which artefact would show it — for example, scheduled task creation appears in specific logs.

For scheduled task creation, relevant sources include the task scheduler's operational log, the task definition files on disk and registry entries recording task metadata. Priya builds a table with the technique, the artefacts that could show it and whether Northfield's synthetic systems actually record them. Blank cells show where an intrusion could happen without leaving the expected trace.

15.4 Least privilege

Examiners get only the access their cases need; administrators cannot alter evidence without leaving logs that others review.

In EvidenceDesk, an examiner can register acquisitions for assigned cases but cannot change other examiners' records. A reviewer can read but not write. An administrator manages accounts but cannot read evidence contents without a logged request. Every privileged action creates an audit entry that the administrator cannot delete, and a second person reviews those entries each month. Permissions are reviewed whenever someone changes role, and accounts for leavers are disabled on their last day.

15.5 Evidence store security

Encrypted storage, access logging, offline backups and physical access control protect the evidence store itself. Backups are tested by restoring them, not merely by confirming they ran.

Offline backups matter because ransomware or a compromised administrator account could encrypt or delete everything reachable online. A restore test picks a random case each quarter, restores it to an isolated system and verifies every hash against the original manifest. A failed restore is treated as an incident, because a backup that cannot be restored provides no protection.

15.6 Defence in depth

No single control is trusted alone; layers catch what one misses.

For the evidence store, the layers might include physical access control, network isolation, account control, file permissions, encryption and hash verification. An attacker who gets past one layer, for example with stolen credentials, still meets the others. Priya maps each threat in her model to at least two independent controls and notes where only one exists, which marks that gap as a priority. Layers also need monitoring, because a control nobody watches can fail without anyone noticing.

15.7 Malware handling

Analysis of suspicious files happens on isolated systems; samples are stored in password-protected archives so they are not run by accident.

Archive passwords are conventional rather than secret, such as 'infected', and their purpose is to stop accidental execution and antivirus deletion, not to keep the files confidential. Samples are named by hash, not by original filename, so that a double-click on something like 'invoice.pdf.exe' cannot happen. Transfers into the analysis zone go through the logged transfer point like any other file.

Threats to evidence

Threats include insiders altering files, ransomware encrypting the store and simple loss of media. Priya ranks them by likelihood and impact before proposing controls.

Worked example

Priya reviews Northfield's synthetic storage design: one shared network drive, all examiners with write access. She recommends per-case permissions, write-once storage for images and logged administrative access, mapping each to integrity or confidentiality.

Synthetic case. The design is invented.

Errors and limits

Security controls reduce risk; logging matters because no control is perfect.

Exercises

Synthesis

Forensic labs apply CIA to themselves, map techniques to artefacts and handle samples in isolation.

Continue studying — chapter 15 of 50

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →