Chapter 2 — Networks and internet services | Technologist Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and internet services

Lesson map

Lesson 02 published. Map, example, EX004.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Clinic connections"]
  N2["2.2 Exploiting services"]
  N3["2.3 Helpful cues"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX004"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Clinic connections"]
  N2["2.2 Exploiting services"]
  N3["2.3 Helpful cues"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX004"]

[Learning outcomes]
    |
    v
[2.1 Clinic connections]
    |
    v
[2.2 Exploiting services]
    |
    v
[2.3 Helpful cues]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX004]

Learning outcomes

You will (1) explain how clinics connect to email, booking and cloud services; (2) describe how attackers exploit internet services to deceive staff; (3) identify simple technical cues that help staff.

2.1 Clinic connections

Each Brightwell clinic connects to the internet through a router and uses cloud email, an online booking service and the practice management system hosted by a vendor. Lucas draws a simple network diagram. He learns that staff see these services mainly through web browsers and email. Patients book online and receive reminders by text and email. Because so much communication is online, messages that imitate these services, such as fake booking notifications or vendor support emails, can easily reach staff and patients.

2.2 Exploiting services

Attackers send emails that look like messages from the booking service asking staff to log in to resolve an issue, leading to a fake login page. They also register domains similar to Brightwell's to send messages that look internal. Lucas learns that email authentication helps reject forged messages from Brightwell's own domain, but lookalike domains pass these checks. He notes that staff therefore cannot rely on technology alone, and that visual cues and easy reporting are needed to catch what passes through.

2.3 Helpful cues

Lucas suggests three cues. First, an external email tag on messages from outside Brightwell. Second, a warning when an external sender uses a display name matching a staff member. Third, bookmarks for official service login pages so staff never need to follow email links to log in. He tests the bookmark idea with two receptionists, who find it quicker than searching emails. Cues that save time are more likely to be adopted than cues that add steps. The practice manager approves all three cues for a trial.

Worked example

Lucas maps clinic connections, explains lookalike domains and fake login pages and suggests external tags, name warnings and bookmarks.

Synthetic case. The network is synthetic.

Errors and limits

Tags lose effect if overused. Bookmarks must be maintained.

Exercises

EX004 — Lookalike limit. Why do lookalike domains pass authentication checks? Rubric: 3 = they are genuine domains owned by attackers;; 2 = own domain;; 1 = vague;; 0 = none.
EX005 — Bookmark benefit. Why are bookmarks helpful? Rubric: 3 = staff never follow email links to log in;; 2 = avoid links;; 1 = vague;; 0 = none.
EX006 — Adoption factor. Which cues are most likely to be adopted? Rubric: 3 = those that save time;; 2 = time;; 1 = vague;; 0 = none.

Synthesis

Internet services create openings for deception, and simple cues help staff.

Continue studying — chapter 02 of 30

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →