Briefing: Week 3 Case File

Unit 3 — Securing Networks, Topics 3.1–3.3

This week the investigation moves from buildings to networks. You'll map an organization's attack surface, evaluate wireless security and the managerial policies behind it, and redesign a flat network using segmentation to stop an attacker from moving freely once they get in. All three days follow Riverbend Bakery & Café — the same organization from Week 2 — as its network gets put under a microscope.

CASE 3027-1A

Attack Surface Review

Mapping the Attack Surface

Task: Inventory Every Exposed Service

An IT intern is asked to inventory Riverbend Bakery & Café's small office network before a scheduled security review. Every device on the network exposes at least one service to the outside — the question is how much risk each one represents.

Evidence: Device & Open Service Inventory

Device	Open Ports / Services	Notes
POS Terminal (Front Register)	3389 (RDP)	Remote desktop open directly to the internet, no VPN required
Back-Office File Server	445 (SMB), 3306 (MySQL)	Reachable from any device on the network, no login required for shared folders
Wireless Access Point	23 (Telnet)	Admin interface still using the factory-default password
Manager's Laptop	22 (SSH)	Enabled but never used, no firewall rule restricting who can connect

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.Which device here has the largest attack surface, and why?

2.Pick one open port or service above and explain specifically how an attacker could exploit it.

3.How would applying least privilege reduce the risk on at least one of these devices?

CASE 3027-1B

Flag: Review

Recon Before the Storm

Detection: Firewall Log Analysis

Two days before an intrusion attempt, Riverbend Bakery's firewall logs show something unusual: a sweep of increasing port numbers hitting the bakery's public-facing IP address, all within just a few minutes.

Evidence: Firewall Log

Timestamp	Source IP	Destination Port	Result
02:11:03	203.0.113.44	21	Closed
02:11:04	203.0.113.44	22	Closed
02:11:05	203.0.113.44	23	Open
02:11:06	203.0.113.44	80	Open
02:11:08	203.0.113.44	3389	Open

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.What is happening in this log, and what is the technical term for this activity?

2.Why do attackers perform reconnaissance before attempting to exploit a network?

3.Based on this scan, which two ports would you prioritize closing or restricting first, and why?

DAY 1 EXIT TICKET

Reflection

Day 1 Exit Ticket

Topic 3.1 — Network Vulnerabilities and Attacks

1.What is a network vulnerability?

2.What is an open port?

3.Define attack surface.

4.Why do attackers perform reconnaissance?

5.What principle limits user access to only what is needed?

CASE 3027-2A

Wireless Audit

Two Networks, One Choice

Task: Prioritize Wireless Fixes

Riverbend Bakery runs its customer guest Wi-Fi and its point-of-sale terminals off the same wireless router. A visiting security consultant flagged four settings as weak. For each one, choose how urgently it should be fixed and watch the priority update.

Evidence: Wireless Configuration Findings

Setting	Current Configuration	Why It's a Concern	Priority
SSID	Broadcasts as "Free_Public_WiFi"	Guest devices and payment terminals share the same wireless network	Pending
Encryption	WEP (retired since 2004)	WEP can be cracked in minutes with free, widely available tools	Pending
Passphrase	"bakery123", written on a chalkboard by the register	Weak, guessable, and visible to every customer in the building	Pending
POS Network	Hidden SSID, but uses the same passphrase as guest Wi-Fi	Any guest who reads the chalkboard can also reach the payment network	Pending

1.Explain the specific risk created by combining the guest and POS networks on one SSID and passphrase.

2.What is WPA3, and how would upgrading to it address one of the weaknesses above?

3.Rewrite the passphrase policy in one sentence that would fix the issue described for the "bakery123" passphrase.

CASE 3027-2B

Flag: Policy Gap

The Missing Policy

Task: Identify the Managerial Control Gap

When asked for a written wireless security policy, the bakery's manager admits there isn't one — the network was configured years ago by a relative "who was good with computers," and nobody has touched it since.

Evidence: Policy Audit Findings

Finding	Review
No documented wireless security policy exists anywhere in the business
The Wi-Fi passphrase has not been changed in more than three years
No one is currently designated as responsible for network configuration
New employees are never told which network their devices should connect to

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.What is a managerial control, and how would a written security policy function as one here?

2.Give one specific rule you would add to Riverbend Bakery's first wireless security policy.

3.Why can strong technical settings, like WPA3, still fail without a managerial control behind them?

DAY 2 EXIT TICKET

Reflection

Day 2 Exit Ticket

Topic 3.2 — Managerial Controls and Wireless Security

1.What is WPA3?

2.What is an SSID?

3.Why are strong passphrases important?

4.Define network segmentation.

5.Give one example of a managerial control.

CASE 3027-3A

Flag: Review

One Network, No Walls

Incident Type: Lateral Movement

Riverbend Bakery's new security camera system was installed on the same flat network as everything else. A cheap IoT camera is compromised through a known firmware vulnerability — and the attacker uses it as a foothold to reach the back-office file server, all without ever touching the internet-facing firewall again.

Evidence: Incident Timeline

Time	Device	Action
1:02 AM	Security Camera	Compromised via known firmware exploit
1:05 AM	Security Camera	Attacker scans the local network from the camera
1:11 AM	Back-Office File Server	Attacker connects using credentials discovered during the scan
1:19 AM	Back-Office File Server	Customer payment records accessed

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.Define lateral movement using this incident as your example.

2.What is a broadcast domain, and why did the flat network design make this attack easier?

3.If the camera had been isolated on its own network segment, how would this incident likely have played out differently?

CASE 3027-3B

Design the VLANs

Designing the VLANs

Task: Assign Each Device to a Segment

After the incident, Riverbend Bakery hires you to redesign the network using VLANs. Click a device on the diagram, then assign it to the correct VLAN in the table below.

Evidence: Network Topology

Assign VLANs

Device	Assign VLAN
Guest Laptop
Security Camera
POS Terminal
Back-Office Server
Manager's Laptop

Clicking a device on the diagram jumps to and focuses its VLAN dropdown below.

1.Explain your VLAN assignment for the security camera and why it can't share a VLAN with the back-office server.

2.What is an Access Control List (ACL), and how would you use one to control traffic between your VLANs?

3.Explain one specific benefit of segmentation using this redesign as your example.

DAY 3 EXIT TICKET

Reflection

Day 3 Exit Ticket

Topic 3.3 — Network Segmentation

1.What is network segmentation?

2.Define VLAN.

3.What is lateral movement?

4.What is the purpose of an ACL?

5.Explain one benefit of segmentation.

CAPSTONE

Synthesis

Week 3 Synthesis: Securing Riverbend Bakery's Network

Task: Match Each Weakness to the Principle That Fixes It

You've spent the week reducing attack surface, hardening wireless security, and redesigning the network with segmentation. For each remaining weakness, select the security principle that best addresses it, then answer the synthesis questions below.

Evidence: Remaining Weaknesses

Weakness	Select Guiding Principle
POS terminal has RDP open directly to the internet
Guest Wi-Fi and POS network share one SSID and passphrase
No written wireless security policy exists
Cameras, POS terminals, and servers all sit on one flat network

1.Explain defense in depth using at least three different layers from this week.

2.Which single change would most reduce Riverbend Bakery's attack surface, and why?

3.Why is technical segmentation alone not enough without a managerial control backing it up?

Briefing: Week 3 Case File

Topic 3.1 — Network Vulnerabilities and Attacks

Mapping the Attack Surface

Recon Before the Storm

Day 1 Exit Ticket

Topic 3.2 — Managerial Controls and Wireless Security

Two Networks, One Choice

The Missing Policy

Day 2 Exit Ticket

Topic 3.3 — Network Segmentation

One Network, No Walls

Designing the VLANs

Day 3 Exit Ticket

Week 3 Synthesis: Securing Riverbend Bakery's Network

Week 3 Case File — Securing Networks — Submission