OpenCyber Academy
Rapid course · Lesson 11 · English
Course code: OCA-015Lesson 11: OCA-015-A011

The password-only window is twelve minutes

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 11. Map, example, EX057.

flowchart TD
  A["10:05 approval"] --> B["10:08 sessions revoked"]
  B --> C["10:09 password reset"]
  C --> D["10:11 rule removed"]
  D --> E["10:20 MFA"]
  B --> W["10:20 minus 10:08 = 12"]
  C --> X["10:20 minus 10:09 = 11"]

Each pair of clocks answers a different question.

Logical drawing

10:05 to 10:08 = 3 minutes
10:08 to 10:20 = 12 minutes
10:09 to 10:20 = 11 minutes
10:05 to 10:20 = 15 minutes
password-only window = the 12

Learning outcomes

After this chapter, you should be able to:

  1. Subtract each recorded pair.
  2. Name which pair is the password-only window.
  3. Leave the earlier wording in place while using the clocks.

11.1 Twelve belongs to revocation and MFA. Eleven belongs to reset and MFA.

The Monday log records five times. Leo approved at 10:05. BrightPath revoked Elaine's sessions at 10:08. The password was reset at 10:09. The rule was removed at 10:11. MFA was enabled at 10:20 after Elaine set up the authenticator on her phone. The playbook order stays sign out, reset, remove the rule, turn on MFA, then review sent items and rules. This chapter does not reorder those steps.

Subtraction is the mechanism. 10:08 - 10:05 is three minutes, the wait from approval to revocation. 10:20 - 10:08 is twelve minutes. During those twelve minutes the old sessions were gone and MFA was not on yet, so the new password was the only block. That is the password-only window. 10:20 - 10:09 is eleven minutes, and eleven counts only from the reset to MFA. 10:20 - 10:05 is fifteen minutes, from approval to MFA, which is the full sequence already stated and is not the password-only window.

Section 3.2 says "In the eleven minutes between revoking sessions and enabling MFA". Revocation is the 10:08 clock, and MFA is the 10:20 clock. Those two clocks differ by twelve, not by eleven. Eleven is the neighbouring pair, reset to MFA. This chapter does not edit that sentence. A reader who names the clocks can see which pair was subtracted. The app still takes a few minutes, which is why MFA sits at 10:20 rather than at 10:09. The rule still comes off at 10:11, before the sent-items review, so later replies are not forwarded while that review happens.

Lesson table; scroll horizontally to read all columns →

Pair Minutes Question it answers
10:05 to 10:08 3 Approval to revocation
10:08 to 10:20 12 Password-only window
10:09 to 10:20 11 Reset to MFA only
10:05 to 10:20 15 Approval to MFA

11.2 Worked example

Lesson table; scroll horizontally to read all columns →

Offered window Clocks used Decision
Twelve minutes 10:08 and 10:20 Keep, as the password-only window
Eleven minutes 10:09 and 10:20 Keep, labelled as reset-to-MFA
"Revocation to MFA was eleven." Those clocks differ by twelve Refuse
"Approval to MFA was the password-only window." That pair is fifteen Refuse

Synthetic case. The five log times stay the only Monday clocks.

Errors and limits

Do not rewrite section 3.2 in order to hide the mismatched pair.

Apply

  • EX057 — Four differences. What is 10:20 minus 10:08, what is 10:20 minus 10:09, and which difference is the password-only window?
    Show marking criteria
    Rubric: 3 = twelve minutes from revocation to MFA; eleven minutes from reset to MFA; the password-only window is the twelve; fifteen is approval to MFA;; 2 = twelve and eleven stay on the correct pairs;; 1 = one difference;; 0 = none.
Worked answers

EX057. 10:20 minus 10:08 is twelve minutes, and that pair is the password-only window. 10:20 minus 10:09 is eleven minutes, from the reset to MFA. Approval to MFA is fifteen minutes.