◇ OpenCyber Academy
Technologist · Chapter 5 · English

Chapter 5 — Security literacy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Small-business threats"]
  N2["5.2 Ransomware"]
  N3["5.3 Exposed remote access"]
  N4["5.4 Helpful behaviours"]
  N5["5.5 Health data"]
  N6["5.6 The defender's view"]
  N7["5.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Small-business threats"]
  N2["5.2 Ransomware"]
  N3["5.3 Exposed remote access"]
  N4["5.4 Helpful behaviours"]
  N5["5.5 Health data"]
  N6["5.6 The defender's view"]
  N7["5.7 Case"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Small-business threats]
    |
    v
[5.2 Ransomware]
    |
    v
[5.3 Exposed remote access]
    |
    v
[5.4 Helpful behaviours]
    |
    v
[5.5 Health data]
    |
    v
[5.6 The defender's view]
    |
    v
[5.7 Case]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain common threats to small businesses; (2) describe ransomware from the defender's view; (3) explain why exposed remote access and weak passwords matter; (4) recognise behaviours that help defenders.

5.1 Small-business threats

Small businesses face phishing, account compromise, invoice fraud and ransomware. They are attacked not because they are important but because they are numerous and often lightly defended.

BrightSmile fits the description: three clinics, an office manager instead of an IT team, and a server reachable from the internet. Nobody chose BrightSmile in particular; automated tools found an open remote desktop port among thousands of addresses, and the weak reception password did the rest. Defending such clients means closing the common openings rather than predicting a specific attacker.

5.2 Ransomware

Ransomware encrypts files and demands payment. Before encryption, attackers usually gain access (for example through exposed remote desktop), create or abuse administrator accounts, and disable protections. Each step leaves traces defenders can detect.

The lab events show the first two of those steps on CLINIC2-SRV: access after failed guesses, then a new account added to Administrators. Disabling protections and mass file changes would come next in the usual sequence. Because each step produces its own record, a SOC that sees the early ones has a chance to stop the sequence before files are touched.

5.3 Exposed remote access

Remote desktop open to the internet attracts automated password guessing. Weak or reused passwords make guessing succeed.

Clinic 2's firewall log shows how much guessing an exposed port attracts: 41,000 attempts from 2,300 addresses in seven days. With that volume, a password such as the shared reception one, known to several staff and never changed, does not need to be guessed quickly; it only needs to be on a list the tools try eventually. Exposure and weak passwords multiply each other, which is why Copperleaf recommends closing the port rather than only asking staff to choose better passwords.

5.4 Helpful behaviours

Strong unique passwords, MFA on remote access, prompt updates and offline backups make attacks harder and recovery easier.

Each of these behaviours breaks a different step of the attack. Unique passwords and MFA make the guessing fail, updates remove known weaknesses an attacker could use after access, and offline backups mean encryption no longer forces the client to pay. BrightSmile's later changes, personal accounts and MFA on the VPN, apply the first two directly to the route used in May. None of these behaviours needs specialist staff on site, which matters for a client whose only local contact is an office manager.

5.5 Health data

Dental records are sensitive personal data. A breach affects patients and brings legal duties to notify.

For BrightSmile, the server holds appointments, patient records and X-ray images, so any intrusion has to be treated as a possible exposure of patient data, not only as an outage. That is why the client needs a clear account of what the attacker could reach, which depends on the logs Copperleaf collects from the server. Patients cannot change their dental history the way a user changes a password, so data taken from the server stays sensitive for years afterwards.

5.6 The defender's view

Defenders focus on the observable steps: access, privilege, defence changes, file activity. Detecting early steps gives time to act before encryption.

This is why Copperleaf's rules watch for new administrator accounts, protection changes and bursts of file renames rather than trying to recognise each ransomware family. A family name changes often; the need to gain access, gain privilege and touch many files does not. Detecting at the access or privilege step leaves the most time for a response. Raj's point in the worked example follows from this: the support2 account was an early step, and the minutes after it were the defender's best opportunity.

5.7 Case

The events from chapter 3 match the early steps: guessing, access as a weak account, a new administrator.

In the parsed lines, the three failures from 203.0.113.45 are the guessing, the 01:19 success as reception is the access, and the support2 account added to Administrators at 01:22 is the new privilege. Nothing in those lines shows protections being disabled or files changing yet, which means the sequence was caught at its early steps. Mei maps each parsed line to a step in a short table, which later becomes the opening of the incident timeline she writes for the client.

Backups as defence

Ransomware's power depends on the victim lacking usable backups. BrightSmile keeps nightly backups on a device in the server room, connected to the network; Raj notes that an attacker with administrator rights could encrypt or delete them too, and recommends an offline or immutable copy.

Worked example

Raj explains to Mei that the "support2" account appeared three minutes after access. If the SOC acts within the next few minutes — disabling the account and isolating the server — encryption may be prevented. Speed at this stage matters more than complete understanding.

Synthetic case. The scenario is invented.

Errors and limits

Not every intrusion leads to ransomware; early steps can lead to theft or fraud instead.

Exercises

Synthesis

Understanding attacks as observable steps shows defenders where early detection prevents the worst harm.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →