◇ OpenCyber Academy
Technical · Chapter 12 · English

Chapter 12 — Contained laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 12 — Contained laboratory I

Lesson map

Lesson 12 published. Map, example, EX045.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Building the lab"]
  N2["Lab — Simulated spread on flat and segmented network"]
  N3["12.2 Running the simulation"]
  N4["12.3 Interpreting"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX045"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Building the lab"]
  N2["Lab — Simulated spread on flat and segmented network"]
  N3["12.2 Running the simulation"]
  N4["12.3 Interpreting"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]

[Learning outcomes]
    |
    v
[12.1 Building the lab]
    |
    v
[Lab — Simulated spread on flat and segmented network]
    |
    v
[12.2 Running the simulation]
    |
    v
[12.3 Interpreting]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX045]

Learning outcomes

You will (1) build a contained lab of a practice network; (2) simulate a ransomware spread; (3) compare flat and segmented outcomes.

12.1 Building the lab

At college, Daniel sets up a contained lab with virtual machines: three reception PCs, three surgery PCs, an imaging server and a backup server, all on an isolated network with no internet. Nadia's task is to compare how far a simulated infection spreads on a flat network and on her segmented design. The simulation uses a harmless script that only records which machines it could reach. Daniel stresses that real malware never enters the lab and that the lab network stays isolated.

Lab — Simulated spread on flat and segmented networks

# Simulated reachability spread from one reception PC (no malware; graph only).
machines = ["rec1", "rec2", "rec3", "sur1", "sur2", "sur3", "imaging", "backup"]
def spread(edges, start):
    seen, todo = {start}, [start]
    while todo:
        m = todo.pop()
        for a, b in edges:
            if a == m and b not in seen: seen.add(b); todo.append(b)
    return sorted(seen)
flat = [(a, b) for a in machines for b in machines if a != b]
rec = ["rec1", "rec2", "rec3"]; sur = ["sur1", "sur2", "sur3"]
seg = [(a, b) for a in rec for b in rec if a != b] + [(a, b) for a in sur for b in sur if a != b] + \
      [(s, "imaging") for s in sur] + [("imaging", "backup")]
for name, edges in (("flat", flat), ("segmented", seg)):
    r = spread(edges, "rec1"); print(f"{name}: {len(r)} machines reached {r}")

Run with python3 lab_spread.py. Verified output:

flat: 8 machines reached ['backup', 'imaging', 'rec1', 'rec2', 'rec3', 'sur1', 'sur2', 'sur3']
segmented: 3 machines reached ['rec1', 'rec2', 'rec3']

12.2 Running the simulation

Nadia models reachability for both designs and starts the simulated infection on one reception PC. On the flat network, it reaches every machine, including the imaging server and the backup server. On the segmented design, it reaches only the other reception PCs, because reception cannot reach the imaging server and the backup server accepts connections only from the imaging server. The lab prints the reachable machines for each case, giving a clear picture of what segmentation limits. She saves both outputs for her lab report.

12.3 Interpreting

Nadia notes the simulation's limits: real ransomware may use stolen credentials or the cloud system, and a compromised surgery PC would still reach the imaging server. She adds that the backup server's restriction is the most valuable result, because it keeps recovery possible. She recommends offline copies as a second layer. Daniel asks the class to compare results; most find similar patterns. The exercise shows why segmentation and protected backups belong together. She records these limits in her lab report so readers do not overstate the result, and she suggests extending the simulation to credential-based spread in a later exercise.

Worked example

Nadia simulates infection spread in a contained lab, finding all eight machines reached on a flat network and three on the segmented design.

Synthetic case. The lab is synthetic and isolated.

Errors and limits

Simulations simplify attacker behaviour. Surgery PCs remain a path to imaging.

Exercises

Synthesis

Contained simulations show how segmentation and protected backups limit the spread of an infection.

Continue studying — chapter 12 of 18

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →