Practice: network security scenarios

1. Asset: the POS server, which holds card transaction data. Properties at risk: confidentiality and integrity, and availability if ransomware gets in.
2. Weakness: an overly broad inbound rule from the internet to the most sensitive zone, left in place after its purpose ended. Remote-support tools exposed to the internet are common entry points for attackers.
3. Control: remove the rule. If the vendor needs ongoing access, replace it with a remote-access VPN or vendor portal that requires multi-factor sign-in, restricted to the vendor's known addresses and enabled only when needed.
4. Process: open a change ticket, record why the rule existed and when it was removed, and add an expiry date to any future temporary rules.
5. Check the firewall and POS server logs for connections from unknown addresses while the rule was open; if there are any, escalate to Keisha as a possible incident.

Answer: Remove the temporary rule, provide controlled vendor access if needed, check the logs for misuse, and record the change.

1. Asset: animal and owner records in the practice-management application. Properties: confidentiality first, then integrity.
2. Weaknesses: an unmanaged, shared home device that may carry malware; a sign-in that could be phished; data that could be left on the laptop.
3. Controls: provide a clinic-managed laptop or tablet with full-disk encryption; connect through a remote-access VPN or the vendor's secure portal with multi-factor sign-in; give her role-based access only to what she needs; and log access.
4. If a managed device is not possible, a web portal that keeps data on the server and blocks downloads is better than a full VPN from a shared laptop.
5. Write down the decision and any residual risk the clinic's manager accepts.

Answer: Yes, with a managed device or a portal that keeps data on the server, multi-factor sign-in, least privilege and logging.

1. This pattern is often called impossible travel and is a strong sign that the password has been stolen. Treat it as a probable account compromise, an incident.
2. Asset: a lawyer's mailbox and documents, with privileged client information. Property: confidentiality, with legal reporting duties.
3. Escalate immediately to Keisha, who leads incident handling; do not wait until Monday.
4. Containment steps she is likely to direct: disable sign-in or reset the password, end active sessions, check for new mailbox forwarding rules and enroll the user in MFA before restoring access.
5. Record times, addresses and actions. The firm may need to assess whether privacy law requires notifying clients; CSCO-122 covers incident handling from here.

Answer: Escalate at once as a probable incident, contain the account, preserve the records and complete MFA enrollment.

1. This is a rogue access point: an unauthorized wireless device connected to the internal network.
2. Weaknesses: the router probably has a default administrator password and weak wireless security, and it bridges anyone who joins it onto the network the wall port connects to, bypassing the guest zone.
3. Immediate step: with the manager's agreement, unplug it and record the port, the device and what was found.
4. Fix the cause, not just the symptom: the coaches needed better coverage. Add a managed access point broadcasting the existing staff or guest network in the gym.
5. Prevent recurrence: disable unused wall ports, consider 802.1X on switch ports, enable the access points' rogue detection, and remind staff that network devices go through Brightline.

Answer: Remove the rogue access point, fix the coverage gap properly, and add controls that detect or block unmanaged devices.

1. Packet A: guest to POS on TCP 443. Rule 1 matches any TCP traffic to port 443, so the packet is permitted. Rule 2 is never reached for it.
2. Packet B: guest to a staff PC on TCP 445. Rule 1 does not match because the port is 445. Rule 2 does not match because the destination is staff, not POS. Rule 3 does not match because the source is guest, not staff. The implicit deny drops the packet.
3. The problem is rule 1: it is too broad, and it shadows rule 2 for HTTPS traffic, letting guests reach the POS server.
4. Fix: move the guest-to-POS deny to the top, replace rule 1 with specific permits for what is needed, and rely on the implicit deny for the rest.

Answer: Guest to POS on 443 is permitted by the overly broad first rule; guest to staff on 445 is dropped by the implicit deny. Reorder and narrow the rules.

1. List the most likely threats from earlier lessons: phishing, password attacks, credential stuffing and remote access abuse. Most lead to a stolen account.
2. Compare candidate controls by how many of those threats they reduce: MFA reduces nearly all of them; segmentation reduces spread after compromise; training reduces clicks but not to zero.
3. Check cost: MFA is included in most cloud email and identity plans the clients already pay for, and the main cost is staff time to enroll users.
4. Propose MFA for every account at every client, with phishing-resistant methods for administrators, followed by segmentation and backups as next steps.

Answer: Multi-factor authentication everywhere gives the largest risk reduction for the cost; it addresses the most common way small organizations are breached.