Follow the Spread

Part of the Stopping the Spread section of Coddy's Cybersecurity journey. Lesson 13 of 20.

Containing the first computer does not stop a program that already reached another one. Each affected computer can have its own process and connection.

Read the source and process in a connection record:

seclab inspect connections demo-upload

Look for these lines:

demo-upload:
  Source: practice-laptop
  Process: demo-helper

Those fields tell you where this activity is happening now. An old link to another computer is not enough to contain the current source.

Follow new evidence wherever it leads. If another computer has its own running copy, deal with that copy too. Keep the original computer contained while you investigate the second one.

Challenge

Easy

Ticket from Sam, IT lead

A new record shows that a program reached print-relay before west-laptop was isolated. Find the relay’s outside connection and stop its responsible process before the next upload succeeds. Keep west-laptop contained and checkout working. Record the second affected computer as host.

Try it yourself

Terminal

All lessons in Stopping the Spread

1Trace the Connection

Follow a Connection Test a Route Follow the Whole Order Inside the Company Orders Without Payment

4Recover and Verify

Prove the Block Recover in Stages Report the Impact Review the Boundary Lumen Stays Open

2Close the Unwanted Route

Destination Rules Rule Order Outbound Rules Allow the Needed Work Two Unwanted Routes

3Contain More Than One Computer

Isolate a Computer The Exposed PasswordFollow the SpreadKeep Customers Working Two Active Computers