◇ OpenCyber Academy
Technical · Chapter 3 · English

Chapter 3 — Operating systems and identities

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Operating systems and identities

Lesson map

Lesson 03 published. Map, example, EX009.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Accounts"]
  N2["3.2 Sign-in records"]
  N3["3.3 Privileged accounts"]
  N4["3.4 Processes"]
  N5["3.5 Credential notices"]
  N6["3.6 Student privacy"]
  N7["3.7 Lockout and spraying"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX009"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Accounts"]
  N2["3.2 Sign-in records"]
  N3["3.3 Privileged accounts"]
  N4["3.4 Processes"]
  N5["3.5 Credential notices"]
  N6["3.6 Student privacy"]
  N7["3.7 Lockout and spraying"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX009"]

[Learning outcomes]
    |
    v
[3.1 Accounts]
    |
    v
[3.2 Sign-in records]
    |
    v
[3.3 Privileged accounts]
    |
    v
[3.4 Processes]
    |
    v
[3.5 Credential notices]
    |
    v
[3.6 Student privacy]
    |
    v
[3.7 Lockout and spraying]
    |
    v
[Worked example] --> [Exercise EX009]

Learning outcomes

You will (1) relate account and process activity to ATT&CK; (2) search sign-in records for intelligence matches; (3) explain privileged-account risk; (4) handle credential notices correctly.

3.1 Accounts

Students, staff, contractors and service accounts all authenticate through the directory. Valid Accounts (T1078) — attackers using real credentials — is common in education because student passwords are often reused.

For CTI, this means credential leaks and spraying reports are among the most relevant items ESX shares with the college. A student password stolen from another website can unlock the learning platform and email through the directory. Contractor and service accounts deserve the same attention, because they are reviewed less often and their owners may have left.

3.2 Sign-in records

The directory logs user, time, source address, application and result. Tomás searches for successful sign-ins from addresses shared by ESX as attack sources.

A failed attempt from an ESX attack address confirms that Ashgrove was targeted, but a successful sign-in is what needs action. Tomás searches by the shared addresses and the time window in the advisory, not by browsing individual users. In the spraying case this search found 300 failed and two successful sign-ins, which he handed to the identity team.

3.3 Privileged accounts

IT administrators hold accounts that can change any system. Intelligence about attackers targeting administrators justifies separate admin accounts, stronger authentication and no email on admin accounts.

Intelligence about attackers seeking administrator access gives the IT team concrete reasons to keep these controls in place when they are inconvenient. An administrator who reads email on the same account can be phished into handing over control of every system. Tomás passes such advisories to the IT manager with the specific controls they support at Ashgrove.

3.4 Processes

On staff machines, endpoint agents log process starts. Reports about attackers running scripts (T1059) are checked against these logs by the endpoint team.

Tomás cannot search endpoint logs himself; he sends the endpoint team the script names, paths or hashes from the report. Their search covers only college-managed staff machines, so a negative result says nothing about student devices. He records that coverage beside the answer, as he does for every source, so the negative result is not read too widely.

3.5 Credential notices

When ESX reports Ashgrove addresses in a password dump, Tomás never tries the passwords. He sends the list to the identity team in a restricted ticket; they reset and notify users.

Trying a leaked password, even to check whether it still works, would be unauthorised access to the user's account. The restricted ticket limits who can read the list, and Tomás does not paste the passwords into ordinary email. Only the identity team can reset accounts and contact the students and staff affected, so his role ends at a clear handover.

3.6 Student privacy

Sign-in data about students is personal data. Searches are tied to a specific intelligence item and recorded; no browsing of individual students' activity.

Each search is logged against the ESX item or ticket that justified it, so a reviewer can see why a student's sign-ins were looked at. Tomás searches by indicator, such as an attack address, rather than by student name. Results are shared only with the team that must act on them, and extracts leave out unrelated fields.

3.7 Lockout and spraying

Password spraying tries a few common passwords across many accounts. Lockout settings and multi-factor authentication blunt it; intelligence about spraying against colleges supports tighter settings.

Spraying shows up in sign-in logs as one source trying many different accounts with only a few attempts each. The spraying case at Ashgrove matched this pattern: 300 failures from four ESX addresses and two successful logins. Because both successful accounts belonged to students, the case supported moving multi-factor authentication for students earlier in the college plan.

Contractor accounts

Contractors maintaining campus systems often keep accounts long after their work ends. A quarterly review with each contract manager disables accounts no longer needed and shortens the list of credentials attackers could use.

Worked example

ESX shares four addresses used in spraying against colleges. Tomás finds 300 failed and two successful sign-ins at Ashgrove, both student accounts. The identity team resets both, revokes sessions and checks what was accessed: course materials only. Multi-factor authentication for students is moved up the plan.

Synthetic case. The addresses and accounts are invented.

Errors and limits

Address-based searches miss attackers using residential proxies.

Exercises

Synthesis

Accounts are the main target; search sign-ins purposefully, protect admins, handle credential notices properly and respect student privacy.

Continue studying — chapter 03 of 18

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →