# Chapter 1 Labs: Foundations of Cybersecurity

Chapter 1 establishes the conceptual and analytical foundations of the discipline: the CIA triad and Parkerian hexad, threat actors, the Cyber Kill Chain, MITRE ATT&CK, vulnerability management, and risk quantification. Its three labs are deliberately framework-first rather than tool-first. All three are analytical exercises carried out with a browser, a text editor, and a spreadsheet. No container targets or local tooling are needed. The docker-compose.yml in this directory validates cleanly but contains only a no-op placeholder service; containerised targets begin in earnest from Chapter 3 onward.

---

## Prerequisites

- Docker Desktop 4.x (or Docker Engine + Compose v2) -- required from Chapter 3; listed here for environment consistency
- A modern browser (Chrome, Firefox, or Edge) for the ATT&CK Navigator
- A spreadsheet application (LibreOffice Calc, Google Sheets, or Microsoft Excel) for Lab 1.3
- Internet access for the MITRE ATT&CK knowledge base and Navigator
- No significant disk space required for Chapter 1

---

## Quick start (no-op for this chapter)

```bash
docker compose up -d   # exits immediately; confirms compose stack is healthy
docker compose down
```

---

## Lab 1.1: Map NotPetya to the Cyber Kill Chain

**Host setup (not containerised) -- written analysis exercise**

### Objective

Apply the Lockheed Martin Cyber Kill Chain seven-phase model to a documented real-world intrusion. Understand which phases present detection and interdiction opportunities and where the NotPetya attack could have been interrupted.

### Setup

No software installation required. Gather the following publicly available primary sources before starting:

- Greenberg, A. (2018) "The Untold Story of NotPetya, the Most Devastating Cyberattack in History", *Wired*: https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/
- NCSC (2018) advisory attributing NotPetya to the GRU: https://www.ncsc.gov.uk/news/russian-military-almost-certainly-responsible-destructive-2017-cyber-attack
- Symantec Security Response (2011) W32.Stuxnet Dossier (useful background on EternalBlue-era tooling): available via DTIC and Symantec's threat intelligence portal
- The ATT&CK v19.0 mapping table in Section 1.6.3 of the book

### Walkthrough

1. Open a blank document or table with columns: **Kill Chain Phase**, **What the attacker did**, **Observable evidence**, **Possible interdiction control**.

2. Work through each of the seven Kill Chain phases in order:
   - Reconnaissance: how did the attackers identify M.E.Doc as a viable supply-chain vector?
   - Weaponisation: construction of the poisoned update package incorporating EternalBlue and the Mimikatz credential-harvesting component.
   - Delivery: the M.E.Doc update channel as the delivery mechanism (T1195 Supply Chain Compromise).
   - Exploitation: EternalBlue (CVE-2017-0144) exploiting unpatched SMBv1 on Windows hosts.
   - Installation: dropping the wiper payload and establishing execution on each infected host.
   - Command and Control: NotPetya had no persistent C2 channel; consider what this implies for detection models that rely on C2 beaconing.
   - Actions on Objectives: MBR overwrite (T1561.002) and file destruction (T1485); the ransomware display screen as masquerading (T1036).

3. For each phase, answer: at what phase could detection have interrupted the chain before the wiper payload executed? Justify your answer with reference to the observable evidence column.

4. Optional extension: revisit your mapping using the ATT&CK technique IDs from the mapping table in Section 1.6.3. Note how ATT&CK adds sub-technique precision (e.g. T1003.001 for LSASS Memory via Mimikatz) that the Kill Chain phase label alone does not capture.

### Expected output

A completed seven-row table. Example row (Exploitation phase):

| Phase | What attacker did | Observable evidence | Interdiction control |
|---|---|---|---|
| Exploitation | EternalBlue exploited SMBv1 (CVE-2017-0144) on unpatched Windows hosts to propagate laterally without credentials | Unusual SMB traffic on port 445 between internal hosts; network IDS alert on MS17-010 signature | Apply MS17-010 patch (released March 2017); disable SMBv1; network segmentation to limit lateral SMB reachability |

### Verify completion

Your table has exactly seven rows, one per Kill Chain phase. At least one phase has a realistic detection mechanism that would have been available in June 2017. The C2 phase notes the absence of conventional C2 beaconing and explains the implication for detection.

### Cleanup

No containers or files to remove.

---

## Lab 1.2: MITRE ATT&CK Navigator -- Map Three Adversary Groups

**Host setup (not containerised) -- web browser exercise using the hosted ATT&CK Navigator**

### Objective

Use the MITRE ATT&CK Navigator to create per-group technique layers for three APT groups, compare their technique overlap, and derive which defensive controls provide the broadest coverage against the selected adversary set.

### Setup

No installation required. The ATT&CK Navigator is a fully client-side React application hosted by MITRE:

- ATT&CK Navigator (web-hosted, Enterprise v19.0): https://mitre-attack.github.io/attack-navigator/
- ATT&CK knowledge base (group profiles and technique lists): https://attack.mitre.org/groups/

If you prefer to run Navigator locally (optional, useful for offline/airgapped environments):

```bash
# ATT&CK Navigator is open-source; upstream repo is:
# https://github.com/mitre-attack/attack-navigator
# Run locally with:
git clone https://github.com/mitre-attack/attack-navigator.git
cd attack-navigator/nav-app
npm install
npm start
# Then open http://localhost:4200
```

### Walkthrough

1. Open https://mitre-attack.github.io/attack-navigator/ in your browser. Select **Enterprise** and ensure you are on **v19.0** (the version selector is in the top-right corner of the layer tab).

2. Select three APT groups from the ATT&CK Groups list at https://attack.mitre.org/groups/ that are relevant to your sector. Suggested starting points:
   - APT28 / Fancy Bear (G0007) -- relevant if your sector is government, defence, or critical infrastructure
   - Lazarus Group (G0032) -- relevant if your sector is financial services or cryptocurrency
   - Volt Typhoon (G1017) -- relevant if your sector is telecommunications, energy, or water utilities

3. For each group, create a new layer in ATT&CK Navigator:
   - Click "Open Existing Layer" then "From URL" -- paste the STIX bundle URL from the group's ATT&CK page; or use the "Create Layer from Other Layers" option with "from URL" set to the group's Navigator-direct URL (available on each group's ATT&CK page under "ATT&CK Navigator Layers").
   - Alternatively: create a new layer, use the "search and add" technique function, and manually enable each technique listed on the group's ATT&CK page.
   - Assign a distinct colour to each group's layer.
   - Name the layer clearly (e.g. "APT28 - v19.0").
   - Export the layer as JSON (Layer > Export Layer > Download JSON).

4. Use the "Create Layer from Other Layers" function to produce a fourth layer that shows technique overlap across all three groups (use the scoring operation "score by number of layers where technique is populated"). Techniques that appear in all three groups will have a score of 3.

5. Analyse the overlap layer:
   - Which techniques score 3 (present in all three groups)?
   - Which techniques score 1 (unique to a single group)?
   - For the high-overlap techniques, identify the mitigations listed on the ATT&CK technique page and note whether your organisation has those controls in place.

6. Optional extension: add a fourth source layer representing the NotPetya techniques from the mapping table in Section 1.6.3 of the book. Compare: how much of NotPetya's technique set overlaps with the three APT groups you selected?

### Expected output

Three exported JSON layer files (one per APT group) plus one overlap/scoring layer. A short written summary (one paragraph) identifying the two to three highest-overlap techniques and the controls that would address them.

### Verify completion

You can reload each exported JSON layer into ATT&CK Navigator and see the correct techniques highlighted. The overlap layer has at least one technique scored at 2 or 3. Your written summary references specific technique IDs (e.g. T1078 Valid Accounts, T1566 Phishing) rather than tactic names alone.

### Cleanup

No containers to remove. Delete the four JSON export files from your downloads folder if you do not want to keep them.

---

## Lab 1.3: Risk Register Exercise -- Ten Scenarios

**Host setup (not containerised) -- spreadsheet exercise**

### Objective

Build a qualitative risk register for ten realistic threat scenarios, apply the Likelihood x Impact scoring model, propose treatments and controls, and optionally extend to quantitative ALE/SLE calculations. Practise translating threat intelligence into a structured risk management artefact.

### Setup

Open a new spreadsheet in LibreOffice Calc, Google Sheets, or Microsoft Excel. Create the following column headers in row 1:

| A | B | C | D | E | F | G | H | I |
|---|---|---|---|---|---|---|---|---|
| Risk ID | Description | Threat Actor | Vulnerability | Likelihood (1-5) | Impact (1-5) | Risk Score (L x I) | Treatment | Residual Risk Score |

Use the scale: 1 = Very Low, 2 = Low, 3 = Medium, 4 = High, 5 = Critical.

### Walkthrough

1. Enter the following ten scenarios as rows 2 through 11 (one per row), filling in Risk ID (R01 through R10) and Description. Then complete Threat Actor, Vulnerability, Likelihood, Impact, Risk Score, Treatment, and Residual Risk Score for each:

   - R01: Phishing email leads to credential theft
   - R02: Unpatched web application exploited via SQL injection
   - R03: Ransomware deployed via compromised RDP
   - R04: Disgruntled employee exfiltrates customer database
   - R05: DDoS attack takes down public-facing website
   - R06: Supply-chain compromise via a software dependency
   - R07: Physical theft of an unencrypted laptop
   - R08: Misconfigured cloud storage bucket exposes sensitive files
   - R09: Social engineering targets the finance team for wire fraud
   - R10: Zero-day exploit in a browser plugin deployed via a malicious advertisement

2. For each scenario, choose a treatment from: **Accept** (tolerate the residual risk), **Avoid** (stop the activity that creates the risk), **Transfer** (cyber insurance, contractual transfer), **Mitigate** (implement a control to reduce likelihood or impact). Describe one specific control in a notes column.

3. Recompute the Risk Score assuming the proposed control is in place to produce the Residual Risk Score column.

4. Create a 5x5 heat map on a separate sheet tab. Axes: Likelihood (1-5, vertical) and Impact (1-5, horizontal). Plot each risk ID at its Residual Risk Score coordinates using conditional formatting (green: score 1-4, amber: 5-9, red: 10-25). Identify which residual risks remain in the top-right (red) quadrant.

5. Extension (SLE/ALE quantification): for the three risks with the highest residual scores, assign an Asset Value (AV) and Exposure Factor (EF) and compute:
   - SLE = AV x EF
   - ALE = SLE x ARO (Annualised Rate of Occurrence)
   - Maximum annual control cost = ALE(before) - ALE(after)

   For example: R03 (Ransomware via RDP): AV = EUR 500,000 (estimated cost of recovery, downtime, ransom, regulatory notification); EF = 0.6; ARO = 0.25 (1-in-4 annual probability); SLE = EUR 300,000; ALE = EUR 75,000. A control costing EUR 12,000/year that reduces ARO to 0.05 saves EUR 60,000/year in expected losses - cost effective.

### Expected output

A spreadsheet with:
- Columns A through I completed for all ten scenarios
- A 5x5 heat map tab with all ten risks plotted at their residual score coordinates
- A brief notes column entry for each risk describing the proposed control
- (Optional extension) SLE/ALE calculations for the top three residual risks

### Verify completion

- All ten Risk IDs have a completed Residual Risk Score that is lower than the initial Risk Score (unless you chose Accept as the treatment, in which case they are equal).
- At least one risk is in the red quadrant of the heat map and your notes explain why no practical control can reduce it out of that quadrant.
- If you completed the extension, each ALE(before) figure exceeds the annual cost of the proposed control.

### Cleanup

Save the spreadsheet. No containers or temporary files to remove.

---

## Teardown

```bash
docker compose -f /path/to/ch01/docker-compose.yml down -v
```

The only container in this chapter is the no-op `lab-ready` service, which exits immediately on start. Teardown is a no-op.

---

## Safety and Authorisation

The Chapter 1 labs are purely analytical. No offensive tooling is used and no network scanning, exploitation, or active attacks are performed against any system. All research references publicly documented, attributed incidents (NotPetya, SolarWinds) studied through open-source reporting.

From Chapter 3 onward, labs involve active scanning and exploitation techniques. Those labs target only the containerised services defined in the chapter's docker-compose.yml, never external hosts. Never run offensive tools against systems you do not own or have explicit written permission to test.
