◇ OpenCyber Academy
Technical · Chapter 3 · English

Chapter 3 — Operating systems and identities

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Operating systems and identities

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Identity layers"]
  N2["3.2 Test accounts"]
  N3["3.3 Service accounts"]
  N4["3.4 Credential handling"]
  N5["3.5 Admin workstations"]
  N6["3.6 ATT&CK link"]
  N7["3.7 Revocation day"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Identity layers"]
  N2["3.2 Test accounts"]
  N3["3.3 Service accounts"]
  N4["3.4 Credential handling"]
  N5["3.5 Admin workstations"]
  N6["3.6 ATT&CK link"]
  N7["3.7 Revocation day"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 Identity layers]
    |
    v
[3.2 Test accounts]
    |
    v
[3.3 Service accounts]
    |
    v
[3.4 Credential handling]
    |
    v
[3.5 Admin workstations]
    |
    v
[3.6 ATT&CK link]
    |
    v
[3.7 Revocation day]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) separate local, domain and application identities; (2) explain least privilege for test accounts; (3) handle shared accounts as findings; (4) protect test credentials.

3.1 Identity layers

Workstations have local accounts; staff use AD domain accounts; the journey planner has application users. A finding may involve any layer. At NMT the layers include rider-facing accounts, staff AD accounts, VPN certificates and service accounts for the journey planner. Sam's test identity tst-sam-web sits only on the staff/staging layer and is barred from fare-network AD groups by construction. Sam verifies its group membership at kickoff, before vault checkout, so identity layers stay separated under pressure. A membership change found at kickoff is fixed by identity before the window opens, never worked around.

3.2 Test accounts

Authorized tests use named test accounts with the least privilege needed, issued for the window and revoked after. Shared pentest god accounts are themselves a finding. Test account tst-sam-web has read access to staging only, is vaulted for ENG-512, and auto-expires Sunday night. Sam will not share that password in chat; vault checkout is the only path, and the vault checkout logs are kept with the ENG-512 pack. Sunday expiry is proven by a Monday login attempt that must fail; success would be a finding.

3.3 Service accounts

API and automation accounts often have broad rights and weak monitoring. They are high-value review targets when in scope. Service accounts for the API are out of Sam's ordinary test set unless the ROE names them. Using a shared service password because it was pasted in an old ticket breaks credential handling rules and muddies ATT&CK T1078 notes for the SOC. Service account passwords found in wikis are rotated through identity, not borrowed for testing. Sam files the exposure and uses only vaulted test identities.

3.4 Credential handling

Test passwords live in the vault, not in chat, screenshots or scripts committed to git. Sam redacts tokens from evidence before hashing; a token in a PNG fails the two-person evidence rule even if the finding is real. Evidence PNGs are therefore cropped on the jump host before lab_hash runs. Hashing a secret-bearing image and deleting it later still leaves the secret in backup history that outlives the engagement. If a secret does reach an evidence file, Sam reports it, identity rotates the credential, and the clean crop replaces the original in the evidence index.

3.5 Admin workstations

Jump hosts should be the only path to admin tasks; tests that find direct admin RDP from email VLANs matter. The admin workstations Sam uses for testing are NMT-issued jump hosts. Personal laptops are not evidence stores, and Sam copies nothing from the jump host to a phone or home drive during ENG-512; NMT jump policy blocks personal cloud sync clients. His cleanup checklist confirms that no ENG files remain in the jump host's Downloads folder after the window, and the check is ticked in the ENG-512 pack before it closes.

3.6 ATT&CK link

Abuse of legitimate accounts maps to T1078 Valid Accounts, which is useful when writing detection recommendations. Sam adds that label when a finding is about stolen or reused staff credentials, so the SOC can search with a shared name; the label does not prove an external attacker. When auth findings ship, the SOC ticket subject includes T1078 and the time window. Rider identifiers are never pasted into that subject line, because SOC ticket subjects are copied into dashboards and e-mail digests that many readers see. The details stay in the restricted evidence pack, where access is logged.

3.7 Revocation day

On Sunday night Sam verifies tst-sam-web is disabled. Leftover test accounts are among the most common findings he writes about other teams, and he will not become one. If ENG-512 overruns into Monday, Sam requests a fresh time-boxed account rather than asking someone to extend the old one quietly. If Monday jobs still authenticate as tst-sam-web, he opens a severity ticket before any other work that day. Revocation day is a control, not a suggestion, and its result is recorded in the ENG-512 pack like any other check.

3.8 MFA on test accounts

Where NMT enforces MFA, test accounts get MFA too. Skipping MFA "because it is staging" trains bad habits and weakens staging as a proving ground. MFA on test accounts is required the same as on staff VPN. A test account without MFA is itself a finding; Sam will not argue for an MFA exception to make scripting easier. A live MFA challenge at kickoff is mandatory, and a test account with MFA enrolled but SMS or app delivery failing stops ENG-512 until identity repairs it.

3.9 Field discipline

When Sam receives a new test account he walks a four-step checklist: confirm the account is named to him, confirm its groups match the ROE, store the secret in the vault under the engagement id, and set a calendar reminder for revocation day. Skipping any step has bitten NMT before: a shared account was left in Domain Admins after a contractor left. Field discipline for identity therefore comes down to vaulted test accounts, Sunday expiry, MFA on, and no fare-network groups on tst-sam-web. Before the window peers check those four points as a short quiz, and wrong answers delay the window. Sam treats account hygiene as part of testing craft, not as paperwork for someone else.

Worked example (synthetic NMT)

Sam receives account tst-sam-web with read access to staging only, vaulted for ENG-512, auto-expires Sunday night.

Synthetic case — Northline Municipal Transit (NMT). The transit agency, Sam Park and all figures are invented for teaching.

Errors and limits

Live transit systems and fare equipment are never tested without a separate, specialised authorization. This book uses synthetic data only and grants no authority to test real systems.

Exercises

Synthesis

Named, least-privilege, vaulted, time-bounded accounts make testing accountable.

Continue studying — chapter 03 of 18

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →