Practice assessment: Lavinya Clinics
You assess the fictional Lavinya Clinics, which handle patient data, under extra rules: you audit the external surface, the patient portal, segmentation, the database and legacy devices, and write a healthcare-aware risk report.
Level 301 · 18 lessons · 15 practice labs
Lessons
Brief and special conditions
- The brief: assessing an organisation that handles patient data
- When you meet health data: rules and notification
- Not touching critical systems: safe testing windows
- Short task: write the extra rules of engagement for the clinic
External surface and DMZ
- The clinic’s external surface: domains and exposed services
- Security headers and TLS review on the patient portal
- Testing the access rules from the DMZ to the internal network
- Short task: validate the external-surface findings
Internal network
- Auditing the separation between the clinical and office networks
- Access and authentication settings of the database server
- Devices with old operating systems: compensating controls
- Auditing service account privileges
- Logging and monitoring: was our assessment noticed?
- Short task: evaluate the internal findings as a chain
Report
- Risk in healthcare: patient safety and data privacy
- Mapping findings to health-data regulations
- Retesting the fixes
- Capstone: write the full assessment report for Lavinya Clinics
Practice labs
- Write extra rules of engagement for the clinic: Add prohibition, stop and notification rules for patient data and medical devices at Lavinya Klinikleri to the standard document.
- Apply the notification steps for patient data seen during testing: Write what you record, whom you notify and when, and what you must not do when a patient list is seen on an open share.
- Prepare a safe test window and monitoring plan for critical systems: Choose test hours from the exam and appointment systems' load data and add service monitoring and a rollback plan.
- Inventory the clinic's external domains and open services: Gather the clinic's domains and externally exposed services from the lab DNS zone and scan results into one table.
- Audit and fix the patient portal's TLS and security headers: Find old TLS versions and missing security headers on the lab patient portal, fix the configuration and audit again.
- Test the DMZ-to-internal access rules and close the excess: Measure which ports are reachable from the DMZ web server into the internal network, find the excess against the rule document and verify the corrected rule.
- Audit the separation between the exam network and the office network: List the services reachable from the office network into the exam network and record those that contradict the segmentation policy.
- Audit the database server's access and authentication settings: Find listen-on-all, weak authentication and an over-privileged user on the lab database, fix them and retest.
- Assess legacy device and service account findings as a chain: Explain the risk combining an unsupported device, an over-privileged service account and missing monitoring, and apply compensating controls.
- Check whether the assessment was noticed in the logs: Compare the times of your scans and login attempts with the clinic's logs and note which steps were not recorded.
- Add a log rule for a step that went unseen and verify it: Add a logging and alert rule for the unnoticed connection attempt, repeat the step and show the alert fires.
- Retest the internal finding chain after the fixes: Retest each link in the chain, prove where the chain is now broken and report the remaining risk.
- Rate findings for patient safety and data privacy: Score six clinic findings separately for their effect on patient safety and on data privacy.
- Map findings to health data regulations: Prepare a compliance table mapping the findings to relevant articles of regulations such as HIPAA, GDPR and KVKK.
- Write the full assessment report for Lavinya Klinikleri: Prepare the complete report with executive summary, health context risk, findings, regulatory mapping and retest results.
About this course
You assess the fictional Lavinya Clinics, which handle patient data, under extra rules: you audit the external surface, the patient portal, segmentation, the database and legacy devices, and write a healthcare-aware risk report.
What you will learn
- Brief and special conditions
- External surface and DMZ
- Internal network
- Report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.