◇ OpenCyber Academy
Technologist · Chapter 5 · English

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Common attacks on councils and cities"]
  N2["5.2 Password guessing"]
  N3["5.3 Malware categories"]
  N4["5.4 Persistence"]
  N5["5.5 Reporting"]
  N6["5.6 Defensive only"]
  N7["5.7 Users as sensors"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Common attacks on councils and cities"]
  N2["5.2 Password guessing"]
  N3["5.3 Malware categories"]
  N4["5.4 Persistence"]
  N5["5.5 Reporting"]
  N6["5.6 Defensive only"]
  N7["5.7 Users as sensors"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Common attacks on councils and cities]
    |
    v
[5.2 Password guessing]
    |
    v
[5.3 Malware categories]
    |
    v
[5.4 Persistence]
    |
    v
[5.5 Reporting]
    |
    v
[5.6 Defensive only]
    |
    v
[5.7 Users as sensors]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain common attacks on small organisations; (2) relate each to the evidence it leaves; (3) understand malware categories at a conceptual level; (4) report incidents correctly.

5.1 Common attacks on councils and cities

Phishing, password guessing against exposed services, exploitation of unpatched systems, and ransomware. MITRE ATT&CK catalogues these behaviours and the data sources that can show them.

These attacks are common because they are cheap: phishing needs only email addresses, guessing needs an exposed logon service, and unpatched systems are listed publicly. A city with hundreds of staff and many public-facing services is an attractive target even without anything unusual to steal. Ransomware attacks on local governments have disrupted permits, payments and records for weeks, which is why readiness matters here.

5.2 Password guessing

Repeated failed logons, often against common account names like "admin", followed by success if a weak password exists. Evidence: authentication logs on the target and network logs showing the source.

The CLERK-03 events fit the pattern: three failures for admin within seconds, then a success. Speed is a useful clue, because people mistype at human pace while automated guessing is fast and regular. Jonah also looks at the account name; a generic admin account that nobody uses day to day is a more likely target than a named user.

5.3 Malware categories

Droppers install other programs; remote-access tools give control; ransomware encrypts; information stealers collect credentials. Sikorski and Honig (2012) explain how analysts identify these behaviours safely. Technologists need to recognise categories, not build or run samples.

For a technologist the practical question is what evidence each category might leave: a dropper leaves new files, a remote-access tool leaves outbound connections, ransomware leaves renamed or unreadable files, a stealer may leave little beyond outbound traffic. The new helper.exe on CLERK-03 is described by its behaviour and location, not guessed into a category before an analyst has examined it.

5.4 Persistence

Malware often survives reboots by installing services, scheduled tasks or startup entries. The service installation on CLERK-03 fits this pattern.

Persistence mechanisms also give investigators somewhere to look. A service or scheduled task has a name, a path, an account and a creation time, and those records outlast the program's activity. On CLERK-03 the service was installed at 08:05:03 under the admin account, so the service list and the system log both deserve preservation before anyone removes the service. Removing it too early also alerts whoever installed it.

5.5 Reporting

Staff report suspected incidents to the service desk using the security category; they do not forward suspicious files by email or try to "test" them.

A report should say what was seen, when, on which machine, and what the reporter has done so far. The clerk who reported CLERK-03 described slowness and pop-up windows and the time they started, which was enough for the service desk to route the ticket to Renata. Forwarding a suspicious attachment spreads it and can alter its metadata.

5.6 Defensive only

The course teaches recognition and investigation; it includes no attack instructions.

In practice this means the course describes malware by what it does and what it leaves, shows synthetic samples only by their names and hashes, and never provides code that exploits or evades anything. Jonah's work is on the defensive side: preserve, collect, hand over and help the city close the gaps that allowed the intrusion. Where a lab needs a suspicious file, it uses invented names and short invented hashes, as in the comparison of directory listings.

5.7 Users as sensors

Clerks who report odd behaviour early, like the CLERK-03 user, are valuable; reports should be welcomed.

At Alder Falls the clerk's early report gave Renata the chance to capture memory before a reboot. A culture that blames reporters for clicking a link discourages exactly these calls. Renata thanks every reporter, even when the cause turns out to be harmless, and records how quickly each report arrived, because early reports shorten investigations. Users also notice things no tool measures, such as a window that appears and closes before any alert fires.

Exposed services

Password guessing works only against services that accept logons. Jonah checks which city systems accept remote logons from where: CLERK-03 allowed remote desktop from the whole office network, a setting nobody remembered enabling. Reducing exposure is often the simplest defence.

Worked example

Jonah maps the CLERK-03 events to categories: password guessing (failed logons), valid account use (successful admin logon), persistence (service installation). He lists the data source for each and notes that the service's purpose is not yet known.

Synthetic case. The mapping is invented.

Errors and limits

Categories are simplifications; real tools combine functions, so confirm behaviour from evidence.

Exercises

Synthesis

Recognise attacks by the evidence they leave and report them through proper channels.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →