Case file: patient data access at Orchard Clinic
At the fictional Orchard Clinic you follow the evidence from an oddity on a reception PC to the server where patient data was accessed, and determine the scope and the duty to notify.
Level 401 · 13 lessons · 12 practice labs
Lessons
Alert and first look
- Case briefing: the clinic, its systems and the first alert
- Triage of the reception workstation
- The email and attachment that started it
- Short task: pin down patient zero’s first malicious process time
Moving inside
- Stolen credentials and tools in memory
- The path from reception to the records server
- Disk and log examination of the records server
- Short task: list the accounts the attacker used
Scope and outcome
- Which patient records were accessed: query and file traces
- Did data leave: network logs and PCAP
- Notification for health-data breaches: rules in different countries
- Root cause and remediation advice
- Capstone: write Orchard Clinic’s executive summary and technical report
Practice labs
- Know the case data: List the Orchard Clinic case's image, dump, logs and network captures with the time they cover.
- Find the email and attachment that began it: Find the email, the attachment and the moment it was opened on the reception computer.
- Determine the time of the first harmful process: Prove the time of the first harmful process on patient zero from two sources using execution traces and event log.
- List the suspicious processes in memory: Extract the unusual processes and their connections from the reception dump.
- Produce the list of accounts used: List the accounts used during the incident with first-use time from logon events.
- The path from reception to the records server: Show the move from the reception computer to the records server step by step with logon, service and network evidence.
- Changed files on the records server: List the files created and changed on the server in the incident window.
- Which patient records were accessed: Determine the range and number of records accessed from query logs and file traces.
- Did the data leave: Prove data egress with size and destination from network logs and PCAP, or rule it out stating the confidence level.
- Write the root cause in one sentence: Write the technical and process causes that made the incident possible in one sentence each.
- Assess the notification duty: Tabulate what must be done under the notification rules of different countries for a health data breach.
- Executive summary and technical report: Write a one-page executive summary and an evidence-referenced technical report for Orchard Clinic.
About this course
At the fictional Orchard Clinic you follow the evidence from an oddity on a reception PC to the server where patient data was accessed, and determine the scope and the duty to notify.
What you will learn
- Alert and first look
- Moving inside
- Scope and outcome
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.