Lesson 3.26: A sector-wide supplier incident
At 07:30 your sector's information-sharing centre (ISAC) warns that a widely used file-transfer product is being exploited at several member companies. You're not the only victim, and you may not be one at all: the job is to find out fast, act, and help the rest of the sector by sharing what you see. In the lab you read the ISAC advisory, find Northwind's affected instances, search the proxy logs for the shared indicators, spot a new indicator nobody has reported yet, check the internal instance and send a properly marked update back.
20 min
You will learn to
- Explain the role of an ISAC and of TLP markings
- Triage exposure across your estate from an inventory
- Search logs for shared indicators
- Find and share a new indicator
- Decide actions per host
Key terms
- ISAC
- Information Sharing and Analysis Center: members of a sector share threats and indicators.
- TLP
- Traffic Light Protocol (FIRST, version 2.0): CLEAR, GREEN, AMBER, AMBER+STRICT, RED, saying how widely information may be shared.
- Indicator of compromise
- An address, file or other artefact linked to an attack.
- Lookback
- How far back to search logs for signs of the attack.
- Exposure triage
- Quickly finding which of your systems are affected and how reachable they are.
← Testing controls: design and operating effectiveness · All lessons · The Linux filesystem hierarchy →