Chapter 1 — Computing systems
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 A city's estate"]
N2["1.2 Public-facing systems"]
N3["1.3 Library computers"]
N4["1.4 Evidence holders"]
N5["1.5 The asset list"]
N6["1.6 Keeping it current"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 A city's estate"]
N2["1.2 Public-facing systems"]
N3["1.3 Library computers"]
N4["1.4 Evidence holders"]
N5["1.5 The asset list"]
N6["1.6 Keeping it current"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 A city's estate]
|
v
[1.2 Public-facing systems]
|
v
[1.3 Library computers]
|
v
[1.4 Evidence holders]
|
v
[1.5 The asset list]
|
v
[1.6 Keeping it current]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) map the computing estate of a municipal IT service; (2) identify which systems hold evidence useful to CTI; (3) explain why public-facing services attract attackers; (4) keep an asset list good enough for intelligence matching.
1.1 A city's estate
Corvale Municipal Services runs desktops for council staff, library public-access computers, a permits portal, a payments portal, email, a directory, file servers and a backup system. Each serves residents or staff and each can be the target or the evidence source in an intrusion.
Lena groups these systems by who uses them, because that decides which intelligence matters. Staff use desktops, email, the directory and file servers; residents use the permits and payments portals and the library computers; the backup system serves everything behind the scenes. An advisory about one of these groups rarely matters to all of them, so the grouping speeds up her first question about relevance.
1.2 Public-facing systems
The permits and payments portals are reachable from the internet. Exploit Public-Facing Application (T1190) in MITRE ATT&CK describes attackers abusing weaknesses in such services. Intelligence about vulnerabilities in the portal software therefore has direct value to CMS.
Being reachable from the internet means anyone can try the portals at any time, without first getting inside the council network. A flaw in the payments portal software could be found by an attacker scanning widely, not just by someone targeting Corvale. That is why Lena reads advisories about portal software first, and why the exposure column on her asset list matters so much.
1.3 Library computers
Public-access machines are used by anyone. They are reset daily, have no staff accounts and sit on a separate network. Intelligence about malware spreading by USB matters here; intelligence about executive phishing does not.
The daily reset and separate network limit what an infection on a library machine can reach: it cannot spread to staff systems and is wiped by the next morning. USB malware still matters, because a resident's infected stick can carry it in and another resident can carry it out on the same day. Lena therefore files intelligence by whether it fits these machines' real use.
1.4 Evidence holders
Email gateway, web proxy, DNS resolver, directory and endpoint agents keep logs. Lena lists each, its retention period and who can query it, because an indicator nobody can search for is useless.
For each log source Lena records how long entries are kept, because an indicator shared today about activity three weeks ago is useful only if the logs still reach back that far. She also records who can run queries, since a source she cannot search herself means waiting for its owner. Both facts decide how fast an indicator can be checked.
1.5 The asset list
A spreadsheet of product, version, owner and exposure (internet, internal, public-access) is enough to start. When MCX shares an advisory, Lena checks the product column first.
A spreadsheet is enough because the question Lena asks most often is simple: does CMS run this product, and where. Owner tells her who to send an advisory to, version tells her whether the flaw applies, and exposure tells her how urgent it is. The worked example below shows all three columns used together for one advisory.
1.6 Keeping it current
Every change ticket that adds or removes a system updates the list. Lena checks the list against the network team's scan results each quarter and flags differences to owners.
The quarterly comparison catches systems that were added without a change ticket. A difference between the list and the scan is either a system missing from the list or one on the list that no longer exists; either way the owner is asked to confirm. Without this check, an advisory about a forgotten system would be matched against nothing.
Worked example
MCX warns about a flaw in a document-management product. Lena searches the asset list: CMS runs it internally for planning records, version 7.2, not internet-facing. She sends the advisory to the owner marked "internal exposure, patch in normal cycle unless exploitation is reported", rather than raising an emergency.
Synthetic case. CMS, the product and the advisory are invented.
Errors and limits
Shadow IT — systems departments bought without telling IT — will be missing from the list. Ask departments directly.
Exercises
- EX001 — Portal technique. Which ATT&CK technique describes abuse of the payments portal's software flaws? Rubric: 3 = T1190 Exploit Public-Facing Application with reason; 2 = name; 1 = T1566; 0 = none.
- EX002 — Library relevance. Why is executive-phishing intelligence low priority for library computers? Rubric: 3 = no staff accounts/email, reset daily, separate network; 2 = one; 1 = high priority; 0 = none.
- EX003 — Exposure call. How did exposure change Lena's handling of the document-management advisory? Rubric: 3 = internal-only → normal patch cycle unless exploited; 2 = partial; 1 = emergency; 0 = none.
Synthesis
Know the estate, its exposure and its logs; keep a simple, current asset list so intelligence can be matched quickly.