Chapter 19 — Sign-in monitoring lab
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 The summary"]
N2["Lab — Failed sign-in summary"]
N3["19.2 Interpreting alerts"]
N4["19.3 Proportionate response"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 The summary"]
N2["Lab — Failed sign-in summary"]
N3["19.2 Interpreting alerts"]
N4["19.3 Proportionate response"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 The summary]
|
v
[Lab — Failed sign-in summary]
|
v
[19.2 Interpreting alerts]
|
v
[19.3 Proportionate response]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) run a failed sign-in summary on synthetic data; (2) interpret alerts; (3) respond proportionately.
19.1 The summary
Kai writes a standard-library script that reads a synthetic export of Fernhill's sign-in records, counts failed sign-ins per account over a day and flags accounts with failures at or above a threshold. It only reads Fernhill's own synthetic log data and produces a summary for a person to review. The threshold of five is chosen because staff occasionally mistype passwords, while repeated failures deserve a look by someone who knows the staff. He tests the script on a file with known counts first. The result is reviewed each morning by IT.
Lab — Failed sign-in summary
"""Count failed sign-ins per account in a synthetic hour and apply an alert threshold (stdlib only)."""
from collections import Counter
fails = ["reception-n1"]*3 + ["vet04"]*1 + ["mshah"]*2 + ["pl0we"]*14 + ["admin-kt"]*6 + ["vet09"]*2 + ["reception-s2"]*4
c = Counter(fails); threshold = 5
for a, n in c.most_common(): print(f"{a:13} fails={n}{' ALERT' if n >= threshold else ''}")
print(f"accounts={len(c)} alerts={sum(n >= threshold for n in c.values())}")
Run with python3 lab_signin.py. Verified output:
pl0we fails=14 ALERT
admin-kt fails=6 ALERT
reception-s2 fails=4
reception-n1 fails=3
mshah fails=2
vet09 fails=2
vet04 fails=1
accounts=7 alerts=2
19.2 Interpreting alerts
The run covers 7 accounts and flags two at threshold 5: pl0we with 14 failures and admin-kt with 6. Kai checks pl0we first: it is a misspelt version of a real staff member's username, p.lowe, so failures there suggest someone guessing names, or a device with a mistyped saved username. admin-kt is Kai's own admin account; he recalls changing his passkey that morning, which explains the failures, but he still records it. Recording his own alert matters, because the rule applies to everyone. Kai explains this to Ruth when she asks why.
19.3 Proportionate response
For pl0we, the account does not exist, so nothing can be accessed, but Kai checks the sources and finds they come from a reception tablet with a mistyped saved username, which he corrects. For admin-kt, he confirms the timing matches his passkey change and notes it in the admin review. Responses are proportionate: explanation first, escalation if no explanation is found. Recording both results helps tune the threshold over time. He notes how long each check took, which helps plan staff time. Both results go into the monthly summary.
Worked example
The summary flags pl0we (14) and admin-kt (6); both have innocent explanations, a mistyped tablet username and a passkey change.
Synthetic case. Accounts and records are synthetic.
Errors and limits
Treating every alert as an attack wastes time; ignoring them misses real problems.
Exercises
- EX055 — Flagged accounts. Which accounts were flagged? Rubric: 3 = pl0we (14) and admin-kt (6);; 2 = two;; 1 = p.lowe;; 0 = none.
- EX056 — pl0we cause. What caused the pl0we failures? Rubric: 3 = reception tablet with mistyped saved username;; 2 = tablet;; 1 = attacker;; 0 = none.
- EX057 — Threshold reason. Why a threshold of five? Rubric: 3 = occasional mistyping is normal;; 2 = mistyping;; 1 = random;; 0 = none.
Synthesis
Simple threshold summaries, checked with local knowledge, find problems and their causes.
Continue studying — chapter 19 of 30
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →