Case file: an inside job at Tidewater Savings
At the fictional Tidewater Savings you establish the employee and the method behind suspicious transfers using workstation, email, application logs and physical access data, in a way that respects the law and personal rights.
Level 401 · 12 lessons · 12 practice labs
Lessons
Opening the case
- Case briefing: the fraud alert and the mandate
- Insider investigations: confidentiality, HR and legal
- Finding suspicious transactions in application logs
- Short task: list the sessions behind the suspicious transfers
Finding the person and method
- Execution and document traces on the employee’s workstation
- Shared account or stolen account
- Matching badge records against session times
- Emails with an outside accomplice
- Short task: tabulate who acted, where and when
A court-ready result
- Ruling out alternative explanations
- The expert report: findings, method and limitations
- Capstone: hand over the Tidewater Savings investigation with its evidence file
Practice labs
- Summarise the authorisation frame: Extract the systems, people and limits that may be examined from the case briefing.
- The sessions making the suspicious transfers: List the suspicious transactions and the sessions that made them from application logs.
- Write a covert examination plan: Write an examination plan aligned with HR and legal that collects evidence without alerting the employee.
- Execution traces on the workstation: List the programs run on the employee's computer at the transaction times.
- Opened documents and correspondence with an outside partner: Extract the recently opened documents and the mailbox correspondence with the outside partner in time order.
- Shared account or stolen account: Justify from session sources, device traces and usage pattern whether the account was shared or stolen.
- Read the door badge records: Extract the employee's building entry and exit times from the badge log.
- Match badge records to sessions: Match the session time of each suspicious transaction to the badge log and mark the mismatch.
- The who, where, when table: Combine all sources to tabulate every transaction by person, place and time and write the confidence level.
- Write a finding with method and limitation: Write one finding together with how it was obtained and what it does not prove.
- Rule out the alternative explanations: Test three alternative explanations against the evidence and state which are and are not ruled out.
- An expert report with an evidence file: Deliver the Tidewater Savings investigation as an expert report with findings, method, limitations and evidence annexes.
About this course
At the fictional Tidewater Savings you establish the employee and the method behind suspicious transfers using workstation, email, application logs and physical access data, in a way that respects the law and personal rights.
What you will learn
- Opening the case
- Finding the person and method
- A court-ready result
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.