◇ OpenCyber Academy
Technical · Chapter 12 · English

Chapter 12 — Contained laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Contained laboratory I

Lesson map

Lesson 12 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Notebook"]
  N2["12.2 Peer check"]
  N3["12.3 Planted fault"]
  N4["12.4 Time box"]
  N5["12.5 No production"]
  N6["12.6 Sign-off"]
  N7["12.7 Notebook integrity"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Notebook"]
  N2["12.2 Peer check"]
  N3["12.3 Planted fault"]
  N4["12.4 Time box"]
  N5["12.5 No production"]
  N6["12.6 Sign-off"]
  N7["12.7 Notebook integrity"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX045"]

[Learning outcomes]
    |
    v
[12.1 Notebook]
    |
    v
[12.2 Peer check]
    |
    v
[12.3 Planted fault]
    |
    v
[12.4 Time box]
    |
    v
[12.5 No production]
    |
    v
[12.6 Sign-off]
    |
    v
[12.7 Notebook integrity]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) run labs 2, 5 and 11 under supervision; (2) assemble a lab notebook; (3) peer-check a classmate's port classifications; (4) stop on a planted fault.

12.1 Notebook

Paste outputs of lab_ports, lab_hash, lab_retest with timestamps and your initials.

The Lab I notebook holds the inventory, the method cards used, the hashes and every stop message. It is kept in ink or in an append-only digital file, so a paused minute stays visible when stop discipline is graded later. Erasing an awkward entry fails the integrity review, because a real evidence pack would lose exactly the record an examiner most wants to see. Corrections are added as new dated lines that point back to the entry they correct.

12.2 Peer check

Exchange port lists; score agreement with the approved map.

Peer check scores notebook completeness before sign-off. Missing emergency contact or fare exclusion fails the peer gate. Those two fields are checked first because either gap would have stopped a real ENG-512 window at kickoff. Completeness beats neat handwriting.

The peers then compare the port list in each notebook against the approved map line by line, and every listener that is missing or not approved is marked on the score sheet. A notebook that lists a port the map never approved fails that line, even if the port really answered on staging.

12.3 Planted fault

Supervisor plants a MISMATCH file; learner must refuse to attach it.

The supervisor also adds a 3389/rdp listener to the lab inventory without telling Sam, so only the lab_ports output reveals it as NOT APPROVED. Sam's report must list the planted listener, or the lab fails, and it must also say what Sam would do next: stop, notify the owner and log the listener. The planted MISMATCH file tests the evidence habit in the same way: attaching it would mean a finding rests on an artefact whose digest no longer matches.

12.4 Time box

Ninety minutes, hard stop.

The ninety minutes match the length of a short ENG-512 window on a Saturday. When the clock stops, Sam vaults the artefacts and takes his hands off the keyboard, and the supervisor scores that moment. Typing after the bell counts as silent overtime, a window-discipline failure, because on a real engagement work past the agreed end would be outside the authorisation. Learning to stop mid-task, with a note of what was left undone, is harder than learning to work fast, which is why the bell is scored separately from the findings.

12.5 No production

Any attempt to scan NMT production fails the lab.

Lab I uses synthetic inventories only, and rider exports are a hard zero even as illustrations or screenshots. Keeping production data out of the classroom pack means no rider's personal data can leak from a learner's laptop or a shared forum. The rule also keeps the exercise honest about what it can teach: decision habits, not facts about NMT's live estate. A learner who needs a realistic-looking record builds one from the synthetic inventory instead.

12.6 Sign-off

Supervisor signs the notebook if peer check and planted fault were handled correctly.

Without that signature the lab stays practice and does not enter Sam's examined portfolio folder. The peer check comes first, so the supervisor signs work that another learner has already checked for the emergency contact and fare exclusion. Requiring both steps mirrors a real engagement, where evidence is reviewed by a peer before anyone signs it off. The supervisor also confirms that the planted fault was found before signing.

12.7 Notebook integrity

Altering lab outputs to look better fails the course. Supervisors may re-run the labs and compare hashes.

Integrity also covers the notebook itself: pages are dated, and the final export is hashed. Peers verify that hash and date after sign-off, and any edit made later restarts the review cycle. A supervisor who reruns a lab and finds a different digest knows the output was changed, whatever the reason given. The learner then explains the change in a new review cycle rather than in a quiet correction.

12.8 Quiet channel

During the lab, only ROE and stop messages go to the shared channel — no spoilers for peers still working.

Lab questions go to the course forum rather than personal SMS. Sam never pastes the tst-sam-web credentials into any chat, because they belong only on the vault path. Keeping questions in one channel also gives the supervisor a record of what was asked, which helps when grading whether learners stayed within the ROE. Answers posted there also help peers who hit the same question later in the session.

12.9 Field discipline

Laboratory I is graded on discipline, not on finding exotic issues. Learners who race ahead to invent attacks on the synthetic data but skip hashing fail. Learners who are slow but refuse the planted mismatch and classify ports correctly pass. Sam reminds peers of that grading bar at the start so competition does not push people toward unsafe habits.

The five field-discipline gates for portfolio entry are the notebook, the peer check, finding the planted fault, keeping to the time box and using synthetic data only. Each gate is marked pass or fail with no partial credit. A learner who meets all five but finds nothing unusual has done exactly what the lab asks.

12.10 Closing note

Learners submit the notebook as a single PDF or markdown bundle with a table of contents. Missing initials or timestamps cost points because real evidence packs need attribution.

Lab I exists so that ENG-512 habits form before any real rider is affected by a mistake. Sam treats the planted 3389 line as seriously as a live finding, writing it up with the same fields and evidence. The retest part of the lab teaches the same honesty with pinned tools and identical method cards: two fixed, one open.

Worked example (synthetic NMT)

Sam refuses the planted mismatched screenshot, fixes his peer's misclassification of 8080, and finishes with three minutes to spare.

Synthetic case — Northline Municipal Transit (NMT). The transit agency, Sam Park and all figures are invented for teaching.

Errors and limits

Live transit systems and fare equipment are never tested without a separate, specialised authorization. This book uses synthetic data only and grants no authority to test real systems.

Exercises

Synthesis

Laboratory I proves port discipline, evidence integrity and retest honesty under a hard stop.

Continue studying — chapter 12 of 18

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →