The Four Rubber Bands
Late night at the kitchen table. Sifting through 800 pages of exam trivia to extract the four machine invariants (CPU, RAM, Disk, NIC) and study triage reflexes.
Late night at the kitchen table. Sifting through 800 pages of exam trivia to extract the four machine invariants (CPU, RAM, Disk, NIC) and study triage reflexes.
Graveyard shift at the Gresham warehouse. Dead sorting terminal, hex POST codes, bent serial pins, and baud rate mismatches before the 5:00 AM dispatch.
First day on the live phone queue under Jules Mercer. Isolating Accounting PC freezes with Safe Mode, Clean Boot, and Windows Event Viewer crash logs.
East Portland pump station switch reboot. APIPA 169.254.x.x trap, /26 subnet boundaries, ARP cache inspection, and local vs gateway frame rewriting.
Early spring downpour. Remote VPN workers fail to reach internal portals while in-office staff succeed. Split-horizon DNS, resolver caches, and rogue hosts overrides.
Warehouse socket timeouts. Connection refused (RST) vs Connection timed out (Drop). TCP 3-way handshake mechanics, socket states, and ephemeral port exhaustion.
Pacific Northwest atmospheric river floods Building C basement at 04:00 AM. Physical switch swap, trunk VLAN configuration, and resolving a massive DHCP exhaustion storm.
Cleartext Telnet vs encrypted SSH, HTTP vs HTTPS, credential harvesting on unencrypted Wi-Fi, and firewall port boundary decisions.
Authentication factors (know, have, are), TOTP vs SMS, Password+PIN confusion, and Active Directory lockout triage with Event ID 4625 & 4740 caller computer detection.
Spear phishing and executive impersonation wire fraud. RFC 5322 MIME header dissection, SPF/DKIM/DMARC alignment checks, and typosquatted domains.
Rogue USB drive and fan pegged at 100%. Windows host persistence (Registry Run keys, Event ID 7045 service creation, scheduled tasks) and Base64 LOLBins analysis.
Rogue wireless router plugged into a warehouse cubicle. WPA2/WPA3-Enterprise 802.1X with RADIUS, EAP-TLS certificates vs PEAP passwords, and RSSI triangulation.
Multi-stage incident across plant telemetry and finance. Chain of custody, order of volatility, memory capture, and assembling the professional CSIRT/SOC handoff dossier.
Physical access control, mantrap tailgating, CCTV verification, and server room badge access telemetry.
Public key infrastructure, certificate authority trust chains, X.509 validity dates, and private key security.
Step-by-step walkthrough of the NIST/SANS 6-phase incident response lifecycle from preparation to post-mortem.