Week 4 Case Files

Unit 3 — Securing Networks (Topics 3.4–3.5) | Unit 4 — Securing Devices (Topics 4.1–4.2)

This week's investigation follows two organizations: Riverbend Bakery & Café, whose small network relies on firewall rules and log monitoring, and Fairwind Family Clinic, a small medical practice working to secure its devices and staff logins. Work through each case in order. Your responses save automatically to this browser as you type.

Note to students: Riverbend Bakery & Café and Fairwind Family Clinic are fictional organizations created for this lab. All logs, tables, device inventories, and scenarios below are simulated for instructional purposes and do not represent a real business, clinic, incident, or person.

CASE 2027-4A

Firewall Traffic Filtering

Riverbend Bakery & Café · Topic 3.4

NETWORK
DEFENSE

Riverbend Bakery & Café recently installed a firewall to separate its guest Wi-Fi from its point-of-sale (POS) and back-office network. The owner asked the IT contractor to configure rules that keep customers online without exposing the register system or back-office computers to outside traffic.

Review the firewall rule table below, then evaluate whether each overnight traffic event would be allowed or blocked under those rules.

Evidence: Firewall Rule Table

Rule #	Source	Destination	Port / Service	Action
1	Guest Wi-Fi (any device)	Internet	80/443 – HTTP/HTTPS	ALLOW
2	Guest Wi-Fi (any device)	POS Server	3389 – RDP	DENY
3	POS Terminals	Payment Processor	443 – HTTPS	ALLOW
4	Any external network	Back-Office Network	22 – SSH	DENY
5	Manager Laptop	Cloud Accounting Portal	443 – HTTPS	ALLOW
6	Guest Wi-Fi (any device)	Back-Office Printer	9100 – RAW/Printing	DENY

Fictional rule set authored for this lab, based on Topic 3.4 concepts (allow rules, deny rules, ports).

Guided Practice: Evaluate Overnight Traffic

#	Traffic Event	Your Determination
1	A guest's phone on Wi-Fi attempts to connect to the POS Server on port 3389 (RDP).
2	A front-counter POS terminal connects to the payment processor over port 443.
3	An unknown external IP address attempts SSH (port 22) into the back-office router.
4	The manager's laptop connects to the cloud accounting portal over HTTPS.
5	A guest laptop on Wi-Fi attempts to print directly to the back-office printer (port 9100).

Case Questions

1. Explain why Rule 2 — blocking guest Wi-Fi from reaching the POS server — is important for protecting Riverbend's payment systems. Saved

2. Riverbend wants its delivery drivers' tablets to reach the scheduling app but never the POS system. Write a firewall rule (source, destination, port/service, action) that would accomplish this, and explain your reasoning. Saved

Exit Ticket

1. What is a firewall?

2. What is the difference between inbound and outbound traffic?

3. What does an allow rule do?

4. What does a deny rule do?

5. Why are firewall rules important?

CASE 2027-4B

Detecting Network Attacks

Riverbend Bakery & Café · Topic 3.5

INCIDENT
REVIEW

A few weeks after the firewall was installed, Riverbend's manager notices the back-office computer running slowly and asks the IT contractor to check the logs. Normal business hours are 6:00 AM–9:00 PM, and only three employee accounts (Manager, Assistant Manager, Bookkeeper) should ever log in remotely.

Review the network log below. Flag any entries you believe are indicators of compromise (IoCs) using the flag button, then answer the questions.

Evidence: Overnight Network Log

Time	Source	Destination / Account	Event
6:45 AM	Front-counter POS	POS Server	Normal shift login
8:15 AM	Manager Laptop	Back-Office Network	Normal login, manager account
1:12 AM	Guest Wi-Fi device	POS Terminal	3 failed login attempts to POS admin panel
2:47 AM	203.0.113.44 (external)	Manager account	5 failed login attempts in 2 minutes
2:51 AM	203.0.113.44 (external)	Manager account	Successful login after failed attempts
2:53 AM	Back-Office Server	198.51.100.9 (external)	Large outbound data transfer, 1.2 GB
9:10 AM	Employee phone	Guest Wi-Fi	Normal badge-in connection
3:15 PM	Vendor delivery scanner	Guest Wi-Fi	Normal vendor check-in scan
4:00 PM	Bookkeeper Laptop	Back-Office Network	Normal close-out report generated

Fictional log authored for this lab, based on Topic 3.5 concepts (baseline, anomaly, IoC).

Case Questions

1. Identify at least three indicators of compromise in this log and explain why each is suspicious compared to the baseline.

2. What time frame in this log falls outside of Riverbend's normal business hours, and why does that matter when looking for anomalies?

3. Working as an investigative team, what should Riverbend's IT contractor do immediately after finding this log? Recommend a next step.

Exit Ticket

1. What is an IDS?

2. What is an indicator of compromise?

3. Why is a baseline important?

4. Define anomaly.

5. What is the purpose of a SIEM?

CASE 2027-4C

Device Vulnerabilities & Attacks

Fairwind Family Clinic · Topic 4.1

ENDPOINT
RISK

Fairwind Family Clinic is a small medical practice with a front desk, two exam rooms, a billing office, and a waiting room. Staff use a mix of laptops, tablets, and a check-in kiosk to manage patient records. A new IT intern has been asked to audit the clinic's devices before a compliance review.

Evidence: Device Inventory & Vulnerability Log

Device	OS / Patch Status	Observed Issue	Vulnerability
Front Desk Tablet	Android 9 (end of life), no updates in 14 months	OS no longer receives security updates	Unsupported OS — no patches for known exploits
Nurse Station Laptop	Windows 10, patches current	Antivirus disabled by staff to "speed up" the computer	No active malware protection
Dr. Ahmed's Laptop	Windows 11, 3 critical patches pending (60+ days overdue)	Updates postponed repeatedly	Unpatched known vulnerabilities
Waiting Room Check-in Kiosk	Windows 10 IoT	Public USB ports enabled; open web browsing allowed	Physical access / malware injection risk
Billing Desktop	Windows 10	Standard employee account has local admin rights	Violates least privilege; malware could gain admin access
Personal Phone (BYOD)	Unknown / unmanaged	Staff member connects personal phone to clinic Wi-Fi	Unmanaged device on a trusted network

Fictional device inventory authored for this lab, based on Topic 4.1 concepts (endpoint, patch, vulnerability, endpoint protection).

Class Activity: Device Security Assessment Checklist — Dr. Ahmed's Laptop

Operating system is fully patched and up to date
Endpoint protection / antivirus is active
Screen lock / auto-lock is enabled
Standard user account follows least privilege (no unnecessary admin rights)
Device storage is encrypted
Automatic updates are enabled going forward

Case Questions

1. Choose one device from the inventory table and explain the specific risk it introduces to patient data at Fairwind Family Clinic.

2. Why is an outdated or unsupported operating system considered a vulnerability even if no malware has been detected yet?

3. Based on your checklist above, write two specific recommendations to improve the security of Dr. Ahmed's laptop.

Exit Ticket

1. What is an endpoint?

2. What is a software patch?

3. Why are updates important?

4. What is endpoint protection?

5. Give one example of a device vulnerability.

CASE 2027-4D

Strengthening Authentication

Fairwind Family Clinic · Topic 4.2

ACCESS
CONTROL

Following the device audit, Fairwind's office manager asks the IT intern to review how staff log into clinic systems — since the clinic stores protected patient health information, weak logins are a serious risk.

Evidence: Login Scenarios

#	Login Scenario	Your Rating
1	Front desk staff share one login and password for all check-ins to save time.
2	A nurse uses a fingerprint scanner plus a PIN to open the medication log.
3	Billing staff use a 6-character password with no MFA to access the accounting software.
4	Doctors tap an ID badge and enter a rotating 6-digit code to open the patient records (EHR) system.
5	The IT admin account still uses the default password set at installation, and it has never been changed.
6	A receptionist uses a 20-character passphrase (no MFA) to log into the scheduling calendar.

Fictional login scenarios authored for this lab, based on Topic 4.2 concepts (authentication factors, MFA, least privilege).

Case Questions

1. For each scenario you rated "Weak," explain specifically what makes that login method vulnerable.

2. Redesign the shared front-desk login (Scenario 1) using at least one authentication improvement discussed in class (MFA, passphrase, biometrics, or security token). What tradeoffs come with your solution?

3. Why might MFA be especially important for an electronic health record (EHR) system compared to a low-risk system like a break-room scheduling calendar?

Exit Ticket

1. What is authentication?

2. What is authorization?

3. Name the three authentication factors.

4. Why is MFA stronger than a password alone?

5. What does least privilege mean?

CASE 2027-4E

Weekly Review: Securing Networks & Devices

Riverbend Bakery & Café + Fairwind Family Clinic · Topics 3.4–3.5, 4.1–4.2

FIELD
REVIEW

To close out the week, pull together everything you've learned about firewalls, detection, device vulnerabilities, and authentication. Work through four short AP-style scenarios, then reflect on a network topology to finish the week.

AP-Style Scenario Practice

Scenario 1 — Network

Riverbend's software vendor asks for direct remote access into the POS network to install updates whenever needed.

Scenario 2 — Device

Fairwind's front desk tablet is running an operating system that no longer receives security updates.

Scenario 3 — Authentication

Fairwind's billing team wants a faster way to log into their shared computer during busy mornings.

Scenario 4 — Detection

An overnight log shows a successful login to the manager's account from an unfamiliar IP address, outside business hours.

Packet Tracer Reinforcement Reflection

Revisit your Week 4 Packet Tracer topology (or the Riverbend Bakery network from Case 4A). Identify one device in the topology that could become a vulnerability if left unpatched or misconfigured, and recommend one improvement to strengthen its security.

Reflection & Exit Ticket

1. Why are software patches important?

2. Explain the difference between authentication and authorization.

3. What is one benefit of multifactor authentication?

4. Describe one endpoint vulnerability.

5. What topic do you feel most confident about this week?