Chapter 17 — Contained laboratory II
Lesson map
Lesson 17 published. Map, example, EX065.
flowchart TD
N0["Learning outcomes"]
N1["17.1 Lab rules"]
N2["Lab — two summaries"]
N3["17.2 Reading the result"]
N4["17.3 Mentioning withheld items"]
N5["17.4 Checking before release"]
N6["17.5 Internal value"]
N7["17.6 Format"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX065"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 Lab rules"]
N2["Lab — two summaries"]
N3["17.2 Reading the result"]
N4["17.3 Mentioning withheld items"]
N5["17.4 Checking before release"]
N6["17.5 Internal value"]
N7["17.6 Format"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX065"]
[Learning outcomes]
|
v
[17.1 Lab rules]
|
v
[Lab — two summaries]
|
v
[17.2 Reading the result]
|
v
[17.3 Mentioning withheld items]
|
v
[17.4 Checking before release]
|
v
[17.5 Internal value]
|
v
[17.6 Format]
|
v
[Worked example] --> [Exercise EX065]
Learning outcomes
You will (1) produce an internal and a community weekly summary from the same data; (2) filter by TLP correctly; (3) explain withheld items without revealing them; (4) check summaries before release.
17.1 Lab rules
Offline, synthetic, standard library. Students work in pairs and submit both summaries and a short check record.
Pairs mirror the partner check that every community product must pass before release. The check record lists what the partner looked at and what they found. Submitting both summaries together lets the tutor confirm that they come from the same dataset and differ only where labels require. The lab script is the same for every pair, so tutors can compare summaries directly. Pairs keep the check record on the template provided, signed by both students.
Lab — two summaries
"""Lab (ch 17): weekly summary by technique with a TLP filter for the community version (synthetic)."""
from collections import Counter
items = [("T1566", "TLP:GREEN"), ("T1566", "TLP:CLEAR"), ("T1078", "TLP:AMBER"), ("T1566", "TLP:AMBER"),
("T1190", "TLP:GREEN"), ("T1078", "TLP:GREEN"), ("T1486", "TLP:RED")]
internal = Counter(t for t, _ in items)
community = Counter(t for t, l in items if l in ("TLP:CLEAR", "TLP:GREEN"))
print("internal", dict(sorted(internal.items())))
print("community", dict(sorted(community.items())))
print("withheld from community:", len(items) - sum(community.values()))
Run with python3 lab_weekly.py. Verified output:
internal {'T1078': 2, 'T1190': 1, 'T1486': 1, 'T1566': 3}
community {'T1078': 1, 'T1190': 1, 'T1566': 2}
withheld from community: 3
17.2 Reading the result
The internal summary counts all seven items: Phishing (T1566) 3, Valid Accounts (T1078) 2, Exploit Public-Facing Application (T1190) 1, Data Encrypted for Impact (T1486) 1. The community version counts only CLEAR and GREEN items: T1566 2, T1078 1, T1190 1. Three items are withheld — two AMBER and one RED.
The community counts are lower for T1566 and T1078 because their AMBER items are removed. T1486 disappears entirely from the community version, since its only item is RED. A reader of the community summary therefore cannot learn that a ransomware-related item exists, which is the purpose of the filter.
17.3 Mentioning withheld items
The community summary may say "some items were withheld under their handling labels" but must not describe them. Even "a ransomware item was received under RED" could reveal too much.
Mentioning that items were withheld tells community readers the summary is not complete. Describing them, even by topic, would share part of their content with people outside the label's audience. The approved sentence is kept in the summary template, so nobody has to improvise wording under time pressure. The template sentence is reviewed by the supervisor once a year.
17.4 Checking before release
The partner student checks: every included item is CLEAR or GREEN; no personal data; counts match the script; wording reveals nothing about withheld items.
Each check addresses a different way the community version could leak. Label checks catch AMBER items that slipped through, and the personal-data check catches names in sample subject lines. Matching counts with the script output shows nothing was added by hand, and the wording check catches hints such as the RED phrase. The partner signs the check record only when all four checks pass.
17.5 Internal value
The internal summary helps management see that phishing dominates and that one ransomware-related item arrived.
Management readers need to know what to act on, not only what arrived. The ransomware-related item prompts a check that backups can be restored, which is an internal action. The internal summary can say this because it stays within Ashgrove under the labels of its items. The internal summary also shows that valid-account abuse appears twice, supporting the multi-factor plan for students. Management reads the internal summary together in the monthly meeting.
17.6 Format
Each summary: period, counts by technique, top actions taken, requests to readers.
The same four headings in both versions make them easy to compare during the partner check. Counts by technique come straight from the lab script's output, never typed by hand. Requests to readers ask for specific help, such as reporting a scam theme to the help desk, so the summary leads to action. Each summary covers one calendar week, from Monday to Sunday inclusive. Top actions taken are listed with their owners, such as the email team blocking a domain. The community version lists only actions safe to share under GREEN.
17.7 Common mistakes
Forgetting AMBER+STRICT; including technique counts that could only come from a RED item; copying internal notes into the community version.
AMBER+STRICT items must stay inside Ashgrove, so they belong in neither the community nor a client version. A technique count that appears only because of a RED item reveals that item exists. Copying internal notes is the commonest cause, because notes are written for colleagues and may name systems or people. Tomás's own first draft showed the second mistake, through the phrase about an encryption-related item.
17.8 Reflection
Students note how the two audiences changed what they wrote.
Tomás noted that the internal summary could explain the backup check, while the community summary could only give counts. Writing for ESX members made him think about what another college could act on. These reflections go into the lab report beside both summaries and the check record. The reflection also asks what the partner check caught that the writer missed. Tomás's answer named the RED phrase and his assumption that one vague word was harmless. Students compare reflections with another pair in the next session.
Time for checking
Allow at least fifteen minutes for the partner check; rushing it is how leaks happen.
Worked example
Tomás's first community draft includes the phrase "plus one encryption-related item under RED". His partner flags it. He removes it; the summary now says only "items under restricted labels were not included".
Synthetic case. The lab data is invented teaching material.
Errors and limits
Filtering by label assumes labels are right; check suspicious labels with the source.
Exercises
- EX065 — Lab counts. Give the internal and community counts for T1566. Rubric: 3 = internal 3, community 2; 2 = one; 1 = wrong; 0 = none.
- EX066 — Withheld count. How many items were withheld and why? Rubric: 3 = 3: two AMBER, one RED; 2 = number; 1 = wrong; 0 = none.
- EX067 — Leaky phrase. Why was "one encryption-related item under RED" removed? Rubric: 3 = reveals RED content; 2 = partial; 1 = harmless; 0 = none.
- EX068 — Release checks. List four checks before releasing the community summary. Rubric: 3 = labels, no personal data, counts match, nothing about withheld; 2 = three; 1 = one; 0 = none.
Synthesis
Build both summaries from one dataset, filter strictly, reveal nothing about withheld items and check before release.
Continue studying — chapter 17 of 18
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →