OpenCyber Academy
Technologist · Chapter 18 · English
Course code: OCA-084Chapter 18: OCA-084-C018

Chapter 18 — Security operations and blue team: controls

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 From detection to prevention"]
  N2["18.2 Prioritising"]
  N3["18.3 Client decisions"]
  N4["18.4 Verifying"]
  N5["18.5 Tracking adoption"]
  N6["18.6 Controls across clients"]
  N7["18.7 Defensive technique names"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 From detection to prevention"]
  N2["18.2 Prioritising"]
  N3["18.3 Client decisions"]
  N4["18.4 Verifying"]
  N5["18.5 Tracking adoption"]
  N6["18.6 Controls across clients"]
  N7["18.7 Defensive technique names"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 From detection to prevention]
    |
    v
[18.2 Prioritising]
    |
    v
[18.3 Client decisions]
    |
    v
[18.4 Verifying]
    |
    v
[18.5 Tracking adoption]
    |
    v
[18.6 Controls across clients]
    |
    v
[18.7 Defensive technique names]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) recommend preventive controls after detections; (2) prioritise controls by risk reduction and cost; (3) verify controls after implementation; (4) track client adoption of advice.

18.1 From detection to prevention

Each incident shows which preventive control would have stopped it earlier. At BrightSmile: VPN with MFA for remote access, removal of admin rights from reception, personal accounts and offline backups.

Mei lists each control against the step it would have broken: VPN with MFA against the guessing and the 01:19 logon, removing admin rights from reception against creating support2, personal accounts against the untraceable shared logon, and offline backups against the encryption. The list turns the incident timeline into a plan for prevention.

18.2 Prioritising

Copperleaf ranks recommendations by risk reduction and effort. VPN with MFA is top: it removes the main entry route for little cost.

Ranking by risk reduction and effort puts VPN with MFA first because it removes the route that produced 41,000 attempts a week, at the price of a VPN licence and about a day of contractor time. Removing admin rights from reception is also cheap, while personal accounts need more setup time and staff training, so they come later in the plan. Offline backups are ranked high too, because they limit the impact of any attack that gets past the other controls despite the first two changes.

18.3 Client decisions

Clients decide and pay; Copperleaf advises. Clear explanations and cost estimates help clients act.

BrightSmile's office manager decides how much to spend and when the clinic can tolerate a change, because only she knows the clinics' budget and patient schedule. Copperleaf's job is to make the choice clear, which is why Mei's one-page estimate puts the cost of the VPN next to the cost of a closed clinic. When a client chooses not to act, Copperleaf records the decision and the reason, so the remaining risk is visible at the next review.

18.4 Verifying

After the client says a control is in place, Copperleaf checks: an external scan (authorised in the agreement) confirms port 3389 is closed; a test logon confirms MFA on the VPN.

The scan and the test logon check what the client reported rather than relying on it. A forwarding rule left behind for an old purpose, or MFA enabled for some users only, would look fine in a status update but fail these checks. Mei records the date and result of each check on the client's recommendation list.

18.5 Tracking adoption

A dashboard shows each client's open recommendations and age. Raj reviews it monthly with account managers.

Age matters because a recommendation that has been open for months usually means the client is stuck, not that the risk has gone away. In Raj's monthly review, old items get a call from the account manager to find out what is blocking them, such as cost, contractor time or a vendor restriction. The dashboard also shows closed items with their verification date, so Raj can see that a control was checked rather than only reported as done.

18.6 Controls across clients

When one client's incident reveals a common weakness, Copperleaf checks all clients. Six other clients also exposed remote desktop.

The check uses data Copperleaf already holds: firewall logs showing accepted inbound connections on 3389. Finding six exposed clients turns one incident into protection for others before they are attacked. It also shows clients that the service learns from incidents across its whole client base, not only at the client that was hit. The five clients that moved to VPN within a month were then checked in the same way as BrightSmile, with an external scan and a test logon.

18.7 Defensive technique names

Recommendations are tagged with D3FEND technique names to keep wording consistent across clients.

D3FEND is published by MITRE as a vocabulary of defensive techniques, so the same control, for example multi-factor authentication, is named identically in every client's list. Consistent names let Copperleaf count how many clients have adopted each control and compare progress without reading every recommendation by hand. The tags are added beside the plain wording, so the office manager still reads "add MFA to the VPN" while Copperleaf's records hold the standard technique name. Mei checks each tag against the published D3FEND list rather than writing it from memory.

Explaining cost

Mei prepares a one-page estimate for BrightSmile: VPN licence, a day of contractor time and staff training. Set beside the cost of the clinic being closed for a day and patients' records at risk, the decision is quick. Clients act faster when the trade-off is in their own terms.

Worked example

After the incident, Mei checks all forty clients' firewall logs for inbound 3389 traffic accepted. Six clients expose remote desktop. Within a month, five have moved to VPN; the sixth, a small accountancy, has a planned date and a temporary IP allow-list.

Synthetic case. Clients and results are invented.

Errors and limits

Advice that clients do not act on reduces no risk; follow up persistently.

Exercises

Synthesis

Turn detections into prioritised, verified preventive controls and check every client for the same weakness.

Continue studying — chapter 18 of 30

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →

Worked answers

EX052. VPN with MFA, removing admin rights from reception, personal accounts and offline backups.

EX053. An authorised external scan confirmed port 3389 closed, and a test logon confirmed MFA on the VPN.

EX054. Six clients exposed remote desktop; five moved to VPN within a month and one had a plan with a temporary allow-list.