Chapter 8 — Network and communications security: supervised case analysis | Professional Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 The event"]
  N2["8.2 Building a timeline"]
  N3["8.3 Containment"]
  N4["8.4 Root causes"]
  N5["8.5 Recommendations"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 The event"]
  N2["8.2 Building a timeline"]
  N3["8.3 Containment"]
  N4["8.4 Root causes"]
  N5["8.5 Recommendations"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 The event]
    |
    v
[8.2 Building a timeline]
    |
    v
[8.3 Containment]
    |
    v
[8.4 Root causes]
    |
    v
[8.5 Recommendations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) investigate a security event under supervision; (2) build a timeline; (3) recommend actions.

8.1 The event

One morning, the triage list shows an administrator login to the document system from an unfamiliar country, followed by a new email forwarding rule on a lawyer's mailbox. Under Sam's supervision and with Priyanka's approval, Grace investigates. The aim is to establish what happened, whether confidential data was exposed and what to do next. She follows the escalation criteria: this is a suspected compromise of an account with case-file access, so Priyanka and the compliance officer are informed immediately. She notes the time each step began.

8.2 Building a timeline

Grace collects VPN, email and document system logs for the relevant period and builds a timeline in UTC. The lawyer's password was entered on a fake login page the previous evening, according to a phishing report from another staff member. Shortly after, a login from abroad succeeded because the email service did not require a second factor. A forwarding rule was created. The document system login came from the same address but used a separate administrator account, which was denied by multi-factor authentication.

8.3 Containment

With the timeline, Priyanka resets the lawyer's password, removes the forwarding rule, revokes active sessions and blocks the foreign address at the email service. The administrator account's denial shows multi-factor authentication worked where it was enabled. Grace checks which emails were forwarded during the window: twelve, three containing client material. The compliance officer assesses whether client notification is required under the firm's obligations. All actions are logged with times and the person who performed them. Grace confirms afterwards that no further logins came from the foreign address and that the forwarding rule did not reappear.

8.4 Root causes

Grace identifies causes: the phishing email reached the user; the email service lacked multi-factor authentication for ordinary accounts; and forwarding to external addresses was permitted without review. She avoids blaming the lawyer, noting that phishing is designed to deceive and that the system should not depend on every person spotting every fake. Root causes point to fixes in controls, not just in individual behaviour. She also checks whether other mailboxes received the same phishing email and whether any of those users entered their passwords, since attackers rarely target one person only.

8.5 Recommendations

Grace recommends enabling multi-factor authentication for all email accounts, blocking automatic forwarding to external addresses except by approved exception, adding an alert for new forwarding rules and continuing staff phishing awareness. Each recommendation has an owner and a date. Sam reviews her report and asks her to separate confirmed facts from inferences more clearly, which she does. The firm adopts all four recommendations within a month. Progress is tracked in the ticket system, and Grace checks after a month that the forwarding alert actually fires on a test rule created by the IT team.

Worked example

The investigation finds twelve emails forwarded, three with client material; four recommendations are adopted.

Synthetic case. The event is synthetic.

Errors and limits

Blaming individuals for phishing distracts from control gaps that allowed harm.

Exercises

EX036 — Escalation reason. Why was the event escalated immediately?
Show marking criteria
Rubric: 3 = suspected compromise of case-file account;; 2 = criterion;; 1 = severity;; 0 = none.
EX037 — MFA evidence. What showed multi-factor authentication working?
Show marking criteria
Rubric: 3 = admin login denied by MFA;; 2 = admin denied;; 1 = vague;; 0 = none.
EX038 — Forwarded emails. How many forwarded emails contained client material?
Show marking criteria
Rubric: 3 = three of twelve;; 2 = three;; 1 = twelve;; 0 = none.
EX039 — Root cause list. List the three root causes.
Show marking criteria
Rubric: 3 = phishing reached user, no MFA on email, external forwarding allowed;; 2 = two;; 1 = one;; 0 = none.
EX040 — Facts versus inferences. What did Sam ask Grace to improve?
Show marking criteria
Rubric: 3 = separate confirmed facts from inferences;; 2 = clarity;; 1 = vague;; 0 = none.

Synthesis

Supervised investigation with a timeline, containment and root causes leads to lasting control improvements.

Continue studying — chapter 08 of 12

← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →