Case File: Week 2 — Cyber Foundations & Securing Spaces

CASE 2027-1A

Flag: Review

The 3 A.M. Anomaly

Detection Rule Triggered: Impossible Travel — Login Velocity

At 8:02 AM, employee jdoe successfully logs into the company VPN from Fort Payne, Alabama. Forty-five minutes later, at 8:47 AM, the same account logs in again — this time from Kyiv, Ukraine. The AI-assisted defense platform's login-velocity rule calculates that no commercial flight could cover that distance in 45 minutes, and automatically generates a security alert.

Evidence: Authentication Log

Timestamp	Username	Source IP	Geolocation	Device	Result
08:02:14	jdoe	98.14.201.7	Fort Payne, AL, US	Windows-Laptop-JD11	Success
08:47:52	jdoe	185.220.101.4	Kyiv, Ukraine	Unknown / Linux CLI	Success
08:48:10	jdoe	185.220.101.4	Kyiv, Ukraine	Unknown / Linux CLI	Accessed Payroll Export Tool

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.Is this alert more likely a true positive or a false positive? Justify with specific evidence from the log.

2.What detection rule triggered this alert, and what condition does it check for?

3.What immediate action should the analyst take, and why does this still need human review?

CASE 2027-1B

Flag: Likely FP

The Cried-Wolf Update

Detection Rule Triggered: Behavioral Heuristic — System File Modification

The endpoint detection platform flags a new process, acrobat_update_service.exe, as malicious. Its behavior — writing files into System32 and modifying registry keys — matches patterns the AI associates with malware installation. A closer look at the process metadata tells a different story.

Evidence: Process & Signature Log

Field	Value	Review
Process Name	acrobat_update_service.exe
Digital Signature	Valid — signed by Adobe Inc., not expired
Deployment Source	Company-managed patch management server
Hash Reputation	Matches known-good hash in vendor database

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.Define false positive using this scenario as your example.

2.Which pieces of evidence point toward this being legitimate rather than malicious?

3.What risk does an organization take on if analysts start ignoring alerts like this?

DAY 1 EXIT TICKET

Reflection

Day 1 Exit Ticket

Topic 1.5 — Leveraging AI in Cyber Defense

1.What is threat detection?

2.Define false positive.

3.Define false negative.

4.Why should humans review AI recommendations?

5.Name one way AI helps cyber defenders.

CASE 2027-2A

Profile the Adversary

Who's Knocking?

Task: Match Each Incident to an Adversary Type

Four unrelated incidents landed on your desk this morning. For each one, use the dropdown to classify the adversary type based on their apparent skill level and motivation, then answer the questions below.

Evidence: Incident Summaries

Incident	Classify Adversary
A teenager downloads a free "DDoS booter" tool from a forum and takes a rival's game server offline for fun.
A group defaces a company's website with a political message after the company was accused of environmental damage.
A recently terminated employee, whose VPN access was never revoked, logs in and deletes shared project files out of anger.
A coordinated group attempts to knock a regional power grid's control system offline to cause widespread disruption.

1.Which incident above did you find hardest to classify, and why?

2.What is an insider threat, and why can it be more dangerous than an outsider with the same skill level?

3.Name one motivation that separates a hacktivist from a cyberterrorist.

CASE 2027-2B

Risk Assessment

Risk Assessment: Riverbend Bakery & Café

Task: Rate Likelihood, Impact, and Overall Risk

Riverbend Bakery & Café stores customer loyalty and payment data on an aging point-of-sale computer in an unlocked back office. Employees share one login, and the back door lock has been broken for weeks. Rate each risk below by selecting a Likelihood and Impact — the Risk Rating will calculate automatically.

Evidence: Asset / Threat / Vulnerability Register

Asset	Threat	Vulnerability	Risk Rating
Customer payment data	External hacker	Outdated POS software, no firewall	Pending
Cash drawer	Burglary	Back door lock is broken	Pending
Employee login credentials	Insider misuse	Shared login, no accountability	Pending

1.Which asset above is most in need of protection, and why?

2.Pick the risk you rated highest and recommend one security control to reduce it.

3.What is a risk assessment, and why do organizations repeat this process regularly?

DAY 2 EXIT TICKET

Reflection

Day 2 Exit Ticket

Topic 2.1 — Cyber Foundations

1.What is a risk assessment?

2.Name one type of cyber adversary.

3.What is an insider threat?

4.What does defense in depth mean?

5.Why is protecting assets important?

CASE 2027-3A

Flag: Review

The Held Door

Incident Type: Unauthorized Entry

Camera footage shows an employee badge in at the north entrance, then hold the door open while chatting with a coworker. A person in a delivery uniform, carrying no visible badge, walks in directly behind them without being challenged. Ten minutes later, the same "delivery" person is seen near the server room — nowhere close to the loading dock.

Evidence: Camera & Access Log

Time	Location	Observation
9:14 AM	North Entrance	Employee badges in, holds door, chats with coworker
9:14 AM	North Entrance	Unbadged person in delivery uniform enters directly behind employee
9:24 AM	Server Room Corridor	Same person seen near server room, no delivery in hand

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.Is this tailgating or piggybacking? Explain the difference using this incident.

2.What made this vulnerability possible even though the door has a badge reader?

3.What should the employee have done differently?

CASE 2027-3B

Flag: Multiple Findings

What the Trash Revealed

Incident Type: Information Exposure

A routine facility walkthrough turned up three separate findings in the same week. Each represents a different way physical exposure can compromise security — even when every digital password policy is followed perfectly.

Evidence: Facility Findings

Finding	Location	Review
Sticky note with the office Wi-Fi password taped to a monitor, visible from the hallway	Front Office
Unshredded printout listing all employee ID numbers found in the recycling bin	Loading Dock Dumpster
Small skimmer device discovered attached to the badge reader	Loading Dock Entrance

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.Match each finding to its vulnerability type: shoulder surfing, dumpster diving, or card cloning.

2.Which finding poses the greatest immediate risk, and why?

3.Recommend one policy or procedure change to prevent each type of exposure found.

DAY 3 EXIT TICKET

Reflection

Day 3 Exit Ticket

Topic 2.2 — Physical Vulnerabilities and Attacks

1.What is tailgating?

2.How is piggybacking different from tailgating?

3.What is shoulder surfing?

4.Why are physical vulnerabilities important?

5.Recommend one way to improve physical security in a school.

CASE 2027-4A

Pick the Control

Task: Match Each Gap to the Best-Fit Control

A walkthrough of a mid-size office turned up five physical security gaps. Choose the best-fit control for each — the control type will tag automatically.

Evidence: Walkthrough Findings

Gap	Select Control	Control Type
Server room door can be propped open and anyone can walk in.		—
Sensitive printed reports are left out on desks overnight.		—
A storm-related power outage risks corrupting financial transaction data.		—
Multiple people slip through the lobby behind a single badge scan.		—
New employees don't realize they shouldn't hold the door open for strangers.		—

1.For the gap you found trickiest, explain why more than one control could apply.

2.Give one example of a physical control and one example of a managerial control from this list.

3.Why do preventative controls matter, even when detection controls also exist?

CASE 2027-4B

Flag: Multi-Zone

Floor Plan Retrofit

Task: Recommend Improvements by Zone

Riverbend Bakery & Café is renovating and wants your recommendations for each zone of the building before they finalize construction.

Evidence: Zone Gaps

Zone	Current Gap	Review
Front Lobby	No barrier between public seating and staff-only hallway
Back Office	POS server sits on an open desk with no locked cabinet
Loading Dock	Door propped open during deliveries with no one monitoring it
Employee Break Room	Shared computer stays logged in to the scheduling system all day

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.Recommend one specific control for each of the four zones above.

2.Which zone's gap would you fix first with a limited budget, and why?

3.Which of your recommendations is managerial rather than physical, and why does that distinction matter?

DAY 4 EXIT TICKET

Reflection

Day 4 Exit Ticket

Topic 2.3 — Protecting Physical Spaces

1.What is a managerial control?

2.Give one example of a physical control.

3.What is the purpose of a UPS?

4.Why are badge readers used?

5.Explain one benefit of a clean desk policy.

CASE 2027-5A

Design the Plan

Design the Monitoring Plan

Task: Place Detection Controls on the Floor Plan

Click a zone on the floor plan below, then choose a detection control for it in the table. Assigned zones will highlight so you can see your full monitoring plan at a glance.

Evidence: Building Floor Plan

Assign Detection Controls

Zone	Assigned Control
Front Lobby
Server Room
Executive Office
Loading Dock
Parking Lot

Clicking a zone on the floor plan jumps to and focuses its dropdown below.

1.Justify your placement for the zone you consider highest risk.

2.What's the difference between a detection control and a preventative control? Give one example of each.

3.Why isn't it enough to rely only on CCTV to detect physical attacks?

CASE 2027-5B

Flag: Review

The 2 A.M. Badge Swipe

Incident Type: Detection Control Failure

An access log shows a badge used at the server room door at 2:14 AM by an employee who, according to the shift schedule, wasn't on shift that night. No alarm was triggered, because the motion sensor covering that hallway had been switched to "maintenance mode" two days earlier for a false-alarm issue — and no one ever turned it back on.

Evidence: Access Log

Time	Event	Detail
2 days prior, 4:10 PM	Motion sensor set to maintenance mode	Server room corridor sensor, reason logged: "false alarms"
2:14 AM	Badge swipe — server room door	Employee not listed on tonight's shift schedule
2:14 AM	No alarm triggered	Motion sensor still in maintenance mode

Click "Unreviewed" on each row to cycle through Suspicious → Confirmed Malicious → Cleared.

1.What two detection controls failed or were compromised here, and how?

2.What is recorded in an access log, and how did it help piece together what happened?

3.Recommend one procedural change to prevent maintenance mode from being left on indefinitely.

DAY 5 EXIT TICKET

Reflection

Day 5 Exit Ticket

Topic 2.4 — Detecting Physical Attacks

1.What is a detection control?

2.What information is recorded in an access log?

3.Why are motion sensors useful?

4.Where should CCTV cameras be placed?

5.Why is monitoring important for physical security?

CAPSTONE

Synthesis

Week 2 Synthesis: Building a Layered Defense Plan

Task: Bring Every Layer Together for Riverbend Bakery & Café

You've spent the week analyzing AI-generated alerts, assessing risk, investigating physical breaches, and choosing controls. Now assign a control type to each remaining gap at Riverbend Bakery, then answer the synthesis questions below.

Evidence: Remaining Gaps

Asset / Area	Threat / Adversary	Select Control Type
Customer payment data on POS system	External hacker
Back office server	Insider misuse
Loading dock entrance	Tailgating / unauthorized entry
Employee awareness of social engineering	Piggybacking / social engineering

1.Explain defense in depth using at least two different layers from this week (AI detection, risk assessment, physical controls, detection controls).

2.If Riverbend Bakery could only implement two of the controls you've learned about this week, which two would you choose and why?

3.Why doesn't any single security control — no matter how advanced — fully protect an organization on its own?

Briefing: Week 2 Case File

Topic 1.5 — Leveraging AI in Cyber Defense

The 3 A.M. Anomaly

The Cried-Wolf Update

Day 1 Exit Ticket

Topic 2.1 — Cyber Foundations

Who's Knocking?

Risk Assessment: Riverbend Bakery & Café

Day 2 Exit Ticket

Topic 2.2 — Physical Vulnerabilities and Attacks

The Held Door

What the Trash Revealed

Day 3 Exit Ticket

Topic 2.3 — Protecting Physical Spaces

Pick the Control

Floor Plan Retrofit

Day 4 Exit Ticket

Topic 2.4 — Detecting Physical Attacks

Design the Monitoring Plan

The 2 A.M. Badge Swipe

Day 5 Exit Ticket

Week 2 Synthesis: Building a Layered Defense Plan

Week 2 Case File — Cyber Foundations & Securing Spaces — Submission