Chapter 17 — Contained laboratory II

Chapter 17 — Contained laboratory II

Lesson map

Lesson 17 published. Map, example, EX065.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 The exercise"]
  N2["17.2 Responding"]
  N3["17.3 Incident note"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX065"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 The exercise"]
  N2["17.2 Responding"]
  N3["17.3 Incident note"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX065"]

[Learning outcomes]
    |
    v
[17.1 The exercise]
    |
    v
[17.2 Responding]
    |
    v
[17.3 Incident note]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX065]

Learning outcomes

You will (1) run a combined control exercise in a safe lab; (2) respond to an injected problem; (3) write a short incident note.

17.1 The exercise

In the second laboratory, Amina runs a combined exercise on the virtual branch. She performs a baseline check, verifies firewall rules, checks certificates and reconciles accounts. Midway, Ms. Bell injects a problem: a new firewall rule appears allowing file sharing from the guest Wi-Fi to the file server, and a test account becomes active again. Amina must notice and respond using her procedures. The injected problems match failure modes from her register: a rule added without approval and an account active after it should be off.

17.2 Responding

The firewall verification flags the new rule as unapproved. The account reconciliation flags the reactivated test account. Amina follows the procedures: she records the findings, reports to the instructor acting as IT lead, recommends removing the rule and disabling the account and waits for approval before acting. Once approved, she makes the changes and re-runs both checks, which now pass. Re-running the checks after the changes produces evidence that the fixes worked, not merely that they were attempted. Waiting for approval before acting keeps her within the authority limits she agreed at the start.

17.3 Incident note

Amina writes a short incident note: what was found, when, how it was detected, what actions were taken, by whom and with what approval, and what should prevent recurrence. She suggests that guest Wi-Fi be blocked from internal systems by default, so a single rule cannot open it. She learns that incident notes create a record for learning and accountability, and that writing them promptly keeps details accurate. Blocking guest Wi-Fi by default would turn a single risky rule into a deliberate exception that needs approval.

Worked example

Amina detects an injected firewall rule and reactivated account, responds with approval and writes an incident note with a preventive suggestion.

Synthetic case. The exercise is synthetic and isolated.

Errors and limits

Injected problems are known to be coming. Labs simplify.

Exercises

• EX065 — Injected problems. Which two problems were injected? Rubric: 3 = guest Wi-Fi file sharing rule and reactivated test account;; 2 = two;; 1 = vague;; 0 = none.
• EX066 — Approval step. What did Amina do before making changes? Rubric: 3 = waited for approval;; 2 = approval;; 1 = acted at once;; 0 = none.
• EX067 — Note contents. What does the incident note include? Rubric: 3 = finding, time, detection, actions, approval and prevention;; 2 = contents;; 1 = vague;; 0 = none.
• EX068 — Preventive idea. What preventive measure did Amina suggest? Rubric: 3 = block guest Wi-Fi from internal systems by default;; 2 = default deny;; 1 = vague;; 0 = none.

Synthesis

Combined exercises test detection, controlled response and clear incident records.

Continue studying — chapter 17 of 18

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →