Chapter 5 — Network and communications security: tools and interpretation
Lesson map
Lesson 05 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["5.1 Reading alerts"]
N2["5.2 Asset criticality"]
N3["Lab — Alert triage"]
N4["5.3 Reading the ranking"]
N5["5.4 Common misreadings"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 Reading alerts"]
N2["5.2 Asset criticality"]
N3["Lab — Alert triage"]
N4["5.3 Reading the ranking"]
N5["5.4 Common misreadings"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX021"]
[Learning outcomes]
|
v
[5.1 Reading alerts]
|
v
[5.2 Asset criticality]
|
v
[Lab — Alert triage]
|
v
[5.3 Reading the ranking]
|
v
[5.4 Common misreadings]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) interpret alerts and logs; (2) prioritise alerts by severity and asset value; (3) avoid common misreadings.
5.1 Reading alerts
Oakline's firewalls and email service produce alerts. Each alert has a type, severity, affected asset and time. Grace learns that severity set by a tool reflects the type of event, not the importance of the asset involved. A medium-severity alert on the document system may matter more than a high-severity alert on a guest phone. Interpreting alerts means combining the tool's view with knowledge of the organisation, which is exactly the judgement practitioners add. She writes down, for each alert type, which assets make it urgent and which make it routine.
5.2 Asset criticality
Grace and Priyanka rate assets by how much harm their compromise would cause: case files and email high, laptops medium, guest wireless and printers low. Combining severity with criticality gives a simple priority score. NIST SP 800-94 notes that intrusion detection outputs need tuning and context to be useful. A score is not a perfect measure, but it gives consistent ordering, so the most important alerts are looked at first when there are more alerts than time. The ratings are reviewed with Priyanka every six months.
Lab — Alert triage
"""Rank synthetic alerts by severity times asset criticality (stdlib only)."""
crit = {"case-files": 3, "email": 3, "laptop": 2, "guest-wifi": 1, "printer": 1}
alerts = [("A1", "laptop", 2, "malware callback blocked"), ("A2", "guest-wifi", 3, "port sweep from guest"),
("A3", "case-files", 3, "admin login from new country"), ("A4", "printer", 1, "firmware outdated"),
("A5", "email", 2, "mass forwarding rule created"), ("A6", "laptop", 1, "VPN login failure")]
ranked = sorted(alerts, key=lambda a: (-a[2] * crit[a[1]], a[0]))
for aid, asset, sev, txt in ranked: print(f"{aid} score {sev*crit[asset]} {asset:11}{txt}")
Run with python3 lab_triage.py. Verified output:
A3 score 9 case-files admin login from new country
A5 score 6 email mass forwarding rule created
A1 score 4 laptop malware callback blocked
A2 score 3 guest-wifi port sweep from guest
A6 score 2 laptop VPN login failure
A4 score 1 printer firmware outdated
5.3 Reading the ranking
The synthetic ranking puts an administrator login from a new country on the case files system first, with score nine, and a new mass email forwarding rule second, with score six. Both suggest possible account compromise affecting confidential data, so they deserve immediate attention. A blocked malware callback on a laptop scores four: important, but the block suggests the firewall did its job, and the laptop should be checked. The guest port sweep, VPN failure and printer firmware rank lower and can wait for routine review.
5.4 Common misreadings
Grace notes misreadings to avoid. Treating a blocked event as harmless ignores the infected device behind it. Treating every alert from a high-value system as an incident creates panic. Assuming an alert is false because it was false last time misses the one time it is real. And reading times in different time zones without converting causes confusion about sequence. She adds these to her practice log as a checklist for future triage sessions. She converts all times to UTC before comparing events from different systems, and notes the conversion.
Worked example
The triage ranks six alerts; the top two indicate possible account compromise on high-value systems.
Synthetic case. Alerts are synthetic.
Errors and limits
Ranking alerts by tool severity alone overweights low-value assets.
Exercises
- EX021 — Top alert. Which alert ranks first, and why? Rubric: 3 = admin login from new country on case files, score 9;; 2 = A3;; 1 = A2;; 0 = none.
- EX022 — Forwarding rule. Why is a mass email forwarding rule concerning? Rubric: 3 = possible compromise leaking email;; 2 = compromise;; 1 = vague;; 0 = none.
- EX023 — Blocked event. Why does a blocked malware callback still need action? Rubric: 3 = infected device remains;; 2 = infection;; 1 = vague;; 0 = none.
- EX024 — Severity limit. Why is tool severity not enough to prioritise? Rubric: 3 = ignores asset importance;; 2 = context;; 1 = accurate;; 0 = none.
- EX025 — Time zone misreading. What misreading do time zones cause? Rubric: 3 = confused event sequence;; 2 = order;; 1 = vague;; 0 = none.
Synthesis
Combining severity with asset criticality and careful reading focuses attention where harm would be greatest.
Continue studying — chapter 05 of 12
← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →