Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 What the field does"]
N2["1.2 Key terms"]
N3["1.3 Your place in the team"]
N4["1.4 The course case"]
N5["1.5 Why it matters"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 What the field does"]
N2["1.2 Key terms"]
N3["1.3 Your place in the team"]
N4["1.4 The course case"]
N5["1.5 Why it matters"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 What the field does]
|
v
[1.2 Key terms]
|
v
[1.3 Your place in the team]
|
v
[1.4 The course case]
|
v
[1.5 Why it matters]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) explain what digital forensics and malware analysis do inside an organisation; (2) define evidence, artefact, incident and scope; (3) describe the practitioner's place in a supervised team; (4) recognise the course case.
1.1 What the field does
Digital forensics answers questions about what happened on computers and online services, using records that can be checked by others. Malware analysis asks what a suspicious program does, so defenders can find and remove it. Both feed incident response: NIST SP 800-61 places analysis between detection and containment, and lessons learned after recovery. In Marlow's case the forensic questions dominate: who signed in to Joy's mailbox, what they changed, and which messages left the company. No program ran on her PC, so malware analysis contributes little here, which is why Lena's later learning plan turns to static triage separately.
1.2 Key terms
An incident is an event that harms or threatens systems or data. An artefact is any trace left by activity: a log line, a file, a mailbox rule. Evidence is an artefact collected and handled so its integrity can be shown. Scope is the agreed set of systems, accounts and time ranges you may examine. Applied to the case, the incident is the takeover of Joy's mailbox, the forwarding rule is an artefact, and the exported rule list becomes evidence once Lena hashes it and logs its custody. The scope Dev approves at 10:02 covers one mailbox and its sign-in logs for 1 to 3 March.
1.3 Your place in the team
New practitioners collect, preserve and organise evidence and run checks, under a supervisor who approves scope and conclusions. You are expected to ask when unsure, and to write down everything you do. At Marlow that supervisor is Dev Anand, who approves scope at the start, containment actions and conclusions before any report goes out. Lena's part is practical: exporting records with her named admin account, hashing them, running the small scripts and keeping a timed log. When the case raises a question outside her written scope, such as whether other recipients clicked, she asks Dev to widen it rather than looking first.
1.4 The course case
The book follows Lena Hart, a new security analyst at the fictional Marlow Logistics, supervised by security manager Dev Anand. On 3 March, accounts clerk Joy Okafor clicks a link in a fake "shared invoice" email and types her password into a look-alike page. Someone then signs in to her mailbox, creates a rule forwarding her mail outside the company and emails a supplier, the fictional Kestrel Packaging, asking to change bank details. Kestrel's finance team grows suspicious and phones Marlow at 10:00, which is how the case reaches Lena on the same morning.
1.5 Why it matters
No malware ran on Joy's PC, yet the incident is serious: money could be redirected. Forensics here relies on cloud service logs more than disk images. The risk is financial and personal rather than damage to systems: a supplier payment could be redirected, and eleven forwarded messages carried supplier contact names outside the company. Because nothing ran on Joy's PC, the key records sit with the email and identity provider, the proxy and IT's change log. Several of those cloud audit records are kept for only 30 days by default, so the evidence has a deadline from the first hour.
Worked example
Lena's first note: "03/03 10:00. Reported by Kestrel's finance team via phone: suspicious bank-change email from J. Okafor's account. Scope (approved D. Anand 10:02): Joy's mailbox and sign-in logs, 01–03 March. No action on other accounts yet."
Synthetic case. Marlow Logistics, Kestrel Packaging and all people are invented.
Errors and limits
Starting without written scope risks examining data you are not entitled to see.
Exercises
- EX001 — Two disciplines. Contrast digital forensics with malware analysis. Rubric: 3 = what happened from checkable records vs what a program does; 2 = partial; 1 = same thing; 0 = none.
- EX002 — Artefact or evidence. Distinguish an artefact from evidence. Rubric: 3 = trace vs collected and integrity-handled; 2 = partial; 1 = same; 0 = none.
- EX003 — Practitioner role. Describe what a new practitioner does in the team. Rubric: 3 = collect, preserve, organise, run checks under supervision, record actions; 2 = partial; 1 = decides alone; 0 = none.
- EX004 — Case summary. In two sentences, state what happened to Joy's account. Rubric: 3 = phishing page, attacker sign-in, external forward rule, bank-change email; 2 = partial; 1 = virus; 0 = none.
- EX005 — First note. Name four facts in Lena's first note. Rubric: 3 = time, reporter, scope with approver, no other actions; 2 = three; 1 = one; 0 = none.
Synthesis
Forensics and malware analysis support incident response with checkable evidence, within agreed scope and under supervision.