Case file: insider data leak at Veloxa Pay
At the fictional fintech Veloxa Pay you verify a claim that customer data left the company using traffic, flow and Zeek logs, and prove whether it was internal or external.
Level 401 · 13 lessons · 12 practice labs
Lessons
The claim and the scope
- The briefing: a customer list was posted on a forum
- Data inventory and the incident time window
- Legal and privacy limits when examining employee traffic
- Short task: list which systems hold customer data and who accessed them
Following the trail
- An unusual bulk query in database traffic
- Traces of an encrypted upload to a personal storage service
- Network or removable media: comparing the evidence
- Ruling out an external attacker: sessions and source IPs
- Short task: prove at what time and with which account the data left
Conclusion
- Preparing the evidence package: PCAP extracts, hashes, timeline
- Data loss prevention and monitoring recommendations
- Lessons learned: monitoring and access policy changes
- Capstone: present the Veloxa Pay incident report to the legal team
Practice labs
- Set the incident's time window: From the report date and the leaked list's contents write the time range to examine with reasons.
- Where the customer data is and who reaches it: From the Veloxa Pay network map and logs list the systems holding customer data and the accounts reaching them.
- Write the limits of the examination: Define on one page what data will and will not be examined in employee traffic, with legal and privacy reasoning.
- Count the database queries: Derive queries per client and volume of rows returned from database traffic.
- Find the unusual bulk query: Identify the query, account and time that returned a large result set outside the normal working pattern.
- Rule out an outside attacker: Prove from sessions and source addresses whether the access came from inside or outside.
- Find the large encrypted upload: Identify the TLS session sending the most data outward in the incident window by server name.
- At what time and under which account it left: Tie the bulk query to the outbound upload through time and host and prove the responsible account.
- Network or removable device: Compare network evidence and endpoint logs to weigh the two possibilities for how the data left.
- Seal a PCAP excerpt with a hash: Cut the evidence session into its own file, hash it and note its origin.
- Prepare the evidence package: Index the PCAP excerpts, hashes and timeline in one directory and write a contents list.
- An incident report for the legal team: Report the Veloxa Pay incident in two pages with findings, confidence level, uncertainties and monitoring recommendations.
About this course
At the fictional fintech Veloxa Pay you verify a claim that customer data left the company using traffic, flow and Zeek logs, and prove whether it was internal or external.
What you will learn
- The claim and the scope
- Following the trail
- Conclusion
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.