OpenCyber AcademyLearning outcomes
You will (1) describe how a hospital's IT services fit together; (2) identify where evidence is produced in each service; (3) understand the special constraints of clinical systems; (4) know the operator's first-response duties.
1.1 Setting
Sana Mirza is studying an 18-month technical course at the fictional Harbour Technical College while working as an IT operator at the fictional Westbrook Community Hospital. Her mentor is the hospital's IT security lead, Owen Price.
Her course alternates college weeks with work at the hospital, so the Ward 4 incident in this book becomes both her job and her supervised project. Owen decides what she may collect and when, and he countersigns her logs. Sana's role is that of an operator: she collects, preserves and verifies evidence, while the analysis of malware itself goes to an external provider.
1.2 Services
Ward PCs, the patient administration system, pharmacy systems, email, file shares, identity services, a web proxy and an endpoint detection and response (EDR) agent on every PC. Each produces logs: EDR records process and file activity; the proxy records web traffic; identity services record logons.
For Sana, the useful question about each service is what it records and where that record is kept. The EDR console and the proxy keep their records centrally, while ward PCs hold some evidence only locally. On 14 September the proxy and EDR records are what tie the pop-up on WARD4-PC2 to a contact with update-cdn.example.net.
1.3 Clinical constraints
Ward PCs support patient care. Shutting one down without warning can delay medication records. Response actions are agreed with ward managers, and isolation uses EDR network containment where possible, which keeps the PC usable locally while cutting it off from the network.
On Ward 4, WARD4-PC2 is used for medication records and the staff rota, so any action on it is agreed with the ward manager first. Network containment was chosen over shutdown because it stops outside contact while keeping the PC's memory and running state available. When Ward 4 lost access to the medication chart viewer, the ward used a spare PC.
1.4 Evidence in services
Central services (EDR console, proxy, identity) keep evidence even if a PC is reimaged. Local evidence — memory, unsent logs — exists only on the PC.
This difference drives the order of work: local evidence is collected before anyone considers a reimage, while central records can wait a few hours. For WARD4-PC2, the memory capture and triage collection had to happen before the helpdesk's reimage. The proxy and DHCP records were safe only as long as their retention allowed, which later proved shorter than policy required.
1.5 Operator duties
On suspicion of an incident: note the time and what you saw, inform Owen, follow the containment runbook, and do not reboot, scan or clean the PC unless instructed. RFC 3227 reminds responders that volatile evidence is lost first.
Rebooting would lose memory, scanning could change file times, and cleaning could delete the very files the analyst needs. Sana's first actions on 14 September follow this list exactly: she logs the nurse's report, calls Owen, and applies containment at 10:09 with the ward manager's agreement. She leaves WARD4-PC2 running throughout, exactly as the containment runbook requires.
1.6 Documentation
Every action goes in the ticket with time and name.
An entry such as '10:09 S. Mirza applied EDR network containment to WARD4-PC2, ward manager agreed' tells a later reader exactly what changed and who decided. Entries are written when the action happens rather than reconstructed afterwards, because times recalled later are often wrong by minutes. The ticket becomes the backbone of the case file Sana submits for her project. The ticket for the Ward 4 incident opens with the nurse's report at 10:04 and ends with the reimage at 14:30 on day two.
Worked example
At 10:04 on 14 September, a nurse on Ward 4 reports a pop-up after opening the staff rota from a USB stick on WARD4-PC2. Sana logs the report, calls Owen, and with the ward manager's agreement uses EDR to contain the PC's network access at 10:09, leaving it running.
Synthetic case. Sana, Westbrook and WARD4-PC2 are invented.
Errors and limits
Containment changes the PC's state; record when it was applied.
Exercises
- EX001 — Clinical constraint. Why can't a ward PC simply be shut down?
Show marking criteria
Rubric: 3 = supports patient care; agree with ward; 2 = partial; 1 = no reason; 0 = none. - EX002 — EDR containment. What does EDR containment do?
Show marking criteria
Rubric: 3 = cuts network, keeps PC running/usable locally; 2 = partial; 1 = shuts down; 0 = none. - EX003 — Operator duties. List the operator's first-response duties.
Show marking criteria
Rubric: 3 = note time/observation, inform lead, follow runbook, no reboot/scan/clean; 2 = three; 1 = one; 0 = none. - EX004 — Central evidence. Which evidence survives a reimage?
Show marking criteria
Rubric: 3 = central EDR, proxy, identity logs; 2 = partial; 1 = memory; 0 = none.
Synthesis
Know the services, their evidence and the clinical constraints before acting; contain carefully and record everything.