Keep Customers Working

Part of the Stopping the Spread section of Coddy's Cybersecurity journey. Lesson 14 of 20.

Containment can interrupt too much if the wrong computer is isolated. A shared server may serve customers as well as accept administration connections.

Suppose a reviewed, clean demo-shop was isolated during an alert. Reconnect it after the team confirms it is safe:

seclab host demo-shop reconnect

You should see:

demo-shop: reconnect.

Check the order route:

seclab probe demo-order

You should see:

till-north -> demo-shop:443
Allowed: allowed (rule 1)

The route is available again. The existing firewall policy still controls who can use the administration service; reconnecting does not remove its rules.

Use the investigation to decide what must stay isolated and what can return. Preserve narrow protections when restoring a shared service.

Challenge

Easy

Ticket from Sam, IT lead

The service desk isolated webstore during the alert, stopping checkout. The investigation found no unwanted program there, and Sam has approved its return. Restore customer orders and payments while keeping office administration blocked. West-laptop must remain isolated.

Try it yourself

Terminal

All lessons in Stopping the Spread

1Trace the Connection

Follow a Connection Test a Route Follow the Whole Order Inside the Company Orders Without Payment

4Recover and Verify

Prove the Block Recover in Stages Report the Impact Review the Boundary Lumen Stays Open

2Close the Unwanted Route

Destination Rules Rule Order Outbound Rules Allow the Needed Work Two Unwanted Routes

3Contain More Than One Computer

Isolate a Computer The Exposed Password Follow the SpreadKeep Customers WorkingTwo Active Computers