Intrusión en la red corporativa

A 90-minute, 4-round intermediate Express simulation for Spanish vocational training (Formacion Profesional, grado superior), module 0378 Seguridad y alta disponibilidad of the Tecnico Superior en Administracion de Sistemas Informaticos en Red.

You are Nerea Saldise, a junior systems technician on call at Distribuciones Valdeorno, a fictional food distributor with 180 employees, 140 user devices and 24 virtual servers. At 02:10 on a Friday the EDR flags a reception PC: an intruder with stolen credentials is moving laterally towards the file and ERP servers. Round 1: you read the alerts and choose the first containment.

Round 2: you contain the servers and deal with the credentials. Round 3: you recover the two servers and decide what happens to the evidence. Round 4: payroll data of the 180 employees has left the network - you decide how the breach is notified and how the incident is closed.

The model works with expected values; each round is scored on all phases so far, on compromised hosts, hours of critical services down, the impact the cyber policy does not cover, and valid evidence. Attacking the attacker's systems, or not notifying a personal data breach, caps the score. The lesson: containing without destroying evidence is what lets you know what happened. Spanish with English.

An intermediate simulation for participants who already know the core concepts of the subject, designed for master's and MBA programmes.