Chapter 1 — Computing systems
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Parts of a system"]
N2["1.2 The course case"]
N3["1.3 Clients and servers"]
N4["1.4 Services"]
N5["1.5 What gets recorded"]
N6["1.6 Roles drive monitoring"]
N7["1.7 Small-business reality"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Parts of a system"]
N2["1.2 The course case"]
N3["1.3 Clients and servers"]
N4["1.4 Services"]
N5["1.5 What gets recorded"]
N6["1.6 Roles drive monitoring"]
N7["1.7 Small-business reality"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Parts of a system]
|
v
[1.2 The course case]
|
v
[1.3 Clients and servers]
|
v
[1.4 Services]
|
v
[1.5 What gets recorded]
|
v
[1.6 Roles drive monitoring]
|
v
[1.7 Small-business reality]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) describe the parts of a computer and how software runs on them; (2) explain clients, servers and services in a small business; (3) identify which parts produce security-relevant records; (4) relate system roles to monitoring needs.
1.1 Parts of a system
A computer has a processor, memory, storage and network connections. The operating system manages them and runs applications. Each layer can record what happens: the operating system logs logons, applications log their own actions, and network devices log connections.
Mei tests this layering on the clinic 2 server, which is itself a virtual machine. The processor and memory belong to a physical host run by the IT contractor, the operating system is Windows, and the practice database and file share are applications on top. A failed remote desktop logon therefore appears in the Windows security log, while the connection that carried it appears in the firewall log, two layers describing one event.
1.2 The course case
Mei Tanaka studies on the technologist programme at the fictional Harbourside Polytechnic and joins the fictional Copperleaf Managed Security, a small provider that monitors about forty small businesses. Her mentor is SOC lead Raj Patel. One client is BrightSmile Dental, a chain of three clinics.
Copperleaf watches its forty or so clients from one SIEM, so every analyst works across many small networks that look alike but belong to different owners. BrightSmile is a typical member of that client list: three clinics, no IT staff on site, an outside contractor for support and patient records on a server. Most of the course follows Mei through BrightSmile's onboarding, its May incident and the improvements that came after it.
1.3 Clients and servers
At each BrightSmile clinic, reception PCs (clients) use a practice-management server that stores appointments and patient records. A file share on the same server holds X-ray images and letters.
The client and server roles explain why the server matters most. If one reception PC fails, the other reception PCs can still book patients, but if the server is encrypted every PC loses appointments, records, X-ray images and letters at the same moment. Mei therefore treats each reception PC as a route towards the server and the server itself as the asset whose loss would stop a clinic working.
1.4 Services
The server runs several services: the database, file sharing, and remote desktop so the clinic's IT contractor can support it from outside. Every running service is something that could be misused and something that can be monitored.
For each service Mei asks two questions: who needs it, and from where. The database is needed by reception PCs inside the clinic; the file share by the same PCs and the X-ray workstation; remote desktop only by the contractor, who connects from outside. That last answer is the one that does not fit a closed clinic network, and it is the service that later gives the attacker a way in.
1.5 What gets recorded
Copperleaf installs an endpoint agent on servers and PCs that sends security events to its SIEM. The clinic's firewall sends connection logs. Together they show logons, new accounts, file changes and network connections.
Each source covers a different part of what happens at a clinic. The agent sees what happens on a machine, such as a logon to the server or a new local account, but not the traffic on the wire; the firewall sees connections in and out but not what a user did after logging on. Copperleaf joins both in the SIEM so that an analyst can follow one event from the network edge to the host.
1.6 Roles drive monitoring
A server holding patient records needs closer monitoring than a waiting-room tablet. Mei lists each device's role so alerts can be weighted.
Mei's role column has three values for BrightSmile: critical for each clinic server, standard for reception PCs and the X-ray workstation, and low for devices such as the waiting-room tablet. An alert from a critical host is shown first in the queue, and a new administrator account on CLINIC2-SRV is ranked above the same event on a tablet with no patient data.
1.7 Small-business reality
Small clients have no IT staff on site; an office manager is the contact. Copperleaf's advice must be simple to act on.
At BrightSmile the office manager can restart a PC, read an email and forward it to the contractor, but cannot change firewall rules. Copperleaf therefore writes each recommendation as a short action with an owner, such as asking the contractor to disable a port forward, rather than as a technical finding the manager would have to interpret and translate alone.
Worked example
Mei's inventory for clinic 2 lists: one server (practice database, file share, remote desktop enabled), four reception PCs, one X-ray workstation and a firewall. She marks the server as critical and notes that remote desktop is reachable from the internet, a fact Raj flags as the most important line on the sheet.
Synthetic case. Copperleaf, BrightSmile and all people are invented.
Errors and limits
Inventories made from documents miss forgotten devices; confirm with network scans authorised by the client.
Exercises
- EX001 — System layers. Which layers of a system can record security events? Rubric: 3 = OS, applications, network devices; 2 = two; 1 = one; 0 = none.
- EX002 — Server services. Name the services on clinic 2's server and why each matters. Rubric: 3 = database, file share, remote desktop: each can be misused and monitored; 2 = two; 1 = one; 0 = none.
- EX003 — Key inventory line. Why did Raj flag the remote desktop line? Rubric: 3 = reachable from internet: exposure for guessing attacks; 2 = partial; 1 = vague; 0 = none.
Synthesis
Knowing a system's parts, services and roles tells a SOC what to monitor and where risk is greatest.