Scenario: your first week at Ardic Logistics
You start as the only security person at a small logistics company; over five days you build an inventory, close holes, switch on logging and respond to your first incident at the end of the week.
Level 201 · 15 lessons · 12 practice labs
Lessons
Monday and Tuesday: getting to know the place
- Monday: asset inventory and network map
- Monday: accounts and who can access what
- Tuesday: services exposed to the internet
- Tuesday: the quick wins list
- Short task: write a one-page first findings note for management
Wednesday and Thursday: fixing things
- Wednesday: critical patches
- Wednesday: tidying the firewall rules
- Thursday: switching on central logging
- Thursday: checking the backups
- Short task: record your changes in the change log
Friday: the first incident
- Friday: the strange email from accounting
- Friday: was the account really compromised
- Friday: containment and talking to the user
- Friday: lessons from the incident
- Capstone: the weekly report and the plan for the next 90 days
Practice labs
- Take an inventory of the assets on the company network: Scan your own lab network and tabulate the web, file and mail servers with operating system and owner.
- Work out who can access what from accounts and groups: Review users, sudo rights and share permissions across the servers and find two accounts belonging to people who have left.
- Find the internet-facing services and write the first findings note: Identify services visible from the external interface, flag two that should not be there and write management a one-page note ordered by risk.
- Rank the quick wins list by impact and effort: Place twelve findings on an impact and effort grid and choose five jobs for this week.
- Apply the critical patches and confirm services still run: Install the security updates on the web and mail servers, schedule those needing a restart and check service health.
- Tidy the firewall rules and record the change: Find unused, shadowed and open-to-all rules, simplify the ruleset, test access and write the change record with a rollback step.
- Check that backups are really being taken: Find the backup job’s last run time, size and error log, and restore one file as a test.
- Forward the servers’ logs to a central server: Set up rsyslog forwarding on three servers, write to a per-host file on the central server and show a test record arriving.
- Catch a silent log source and a broken backup on the same day: Find that one server has sent no logs for two days and the backup produces an empty archive, fix both and add a check that warns if it recurs.
- Examine the headers of the strange email from accounting: Extract the true sending server, the reply address and the authentication results, and state whether it came from an internal account.
- Prove whether the account was really compromised: Find the login from an unusual address, the added forwarding rule and the messages sent in the mail and logon records.
- Contain the incident, talk to the user and write the weekly report: Reset the password, remove sessions and the forwarding rule, write the user a blame-free explanation and tie the lessons to the 90-day plan.
About this course
You start as the only security person at a small logistics company; over five days you build an inventory, close holes, switch on logging and respond to your first incident at the end of the week.
What you will learn
- Monday and Tuesday: getting to know the place
- Wednesday and Thursday: fixing things
- Friday: the first incident
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.