Lab 4: Grocery Store Downtime

It is a busy Saturday morning at a local grocery store. Prices are wrong, the inventory system says full shelves are empty, and card payments keep failing. As the IT support intern, you investigate the logs, decide which parts of the CIA triad were compromised, measure the impact, fix the network design that let it happen, and report to store management.

The situation

The store manager fears a security incident affecting confidentiality, integrity, and availability all at once. Your job is to find out what happened and when, which systems were affected, what evidence proves each CIA impact, and what the short-term and long-term consequences could be for the store and its customers.

Starter files

• Store manager's notes (.txt)
• IDS alerts, Friday night through Saturday morning (.csv)
• Inventory database audit log (.log, also retrieved by SFTP in Part 1)
• tracert to the payment processor, before and during the incident (.txt)
• Switch show vlan brief output and port map (.txt)
• Incident evidence and impact report template (Word)
• Packet Tracer build sheet: segment the store with VLANs (.txt)

Team roles

Teams of three: the project lead also keeps documentation. Teams of five: add an AI liaison who writes the prompts and leads the evaluation of AI output. Rotate roles from lab to lab so that every student does each job once.

Walkthrough

Part 1: Collect the evidence securely (Day 1)

In a real investigation you copy logs off the server instead of working on it. If your teacher has set up the class Linux lab server, retrieve the audit log with SFTP. Otherwise, download it above and write the commands you would use.

student@lab:~$ pwd
student@lab:~$ mkdir -p lab4 && cd lab4
student@lab:~/lab4$ sftp intern@<log server address from your teacher>
sftp> pwd
sftp> cd /var/log/invdb
sftp> ls
sftp> get invdb01-audit.log
sftp> exit
student@lab:~/lab4$ ls

1. Explain in your log what each command does and why SFTP (SSH, port 22) is used instead of FTP (port 21).
2. Record the absolute path where the file now sits on your device.

Part 2: Build the timeline (Day 1)

1. Merge the manager's notes, IDS alerts, and audit log into one timeline from Friday 23:14 to Saturday 10:20. Mark each entry as an attack step, a symptom, or a performance problem.
2. Identify the device the activity came from and explain why that device was a weak point (check the port map and the manager's notes).

Part 3: CIA analysis (Day 2)

1. For confidentiality, integrity, and availability, state whether it was compromised and cite at least two pieces of evidence for each (log time and entry).
2. Separate IDS entries that indicate a security threat from entries that indicate a performance or configuration issue. Explain how the two are connected in this incident.

Part 4: Trace the payment failures (Day 2)

1. Compare the two tracert runs. Count the hops, and find where the delay begins.
2. Is the payment problem inside the store, at the ISP, or at the processor? Use the OSI model to say which layer you would investigate first and why (Lesson 4.2).

Part 5: Impact assessment (Day 3)

1. Short-term: list the immediate effects on customers, employees, and operations. Why did timing make this worse?
2. Long-term: describe possible consequences for sales, reputation, and customer trust, including the loyalty-program data.

Part 6: Fix and harden (Days 4–5)

1. Design a VLAN segmentation plan for the store using the port map: group devices by function and security level, assign VLAN IDs and names, and say which ports go in each VLAN. Unused ports should be shut down.
2. Configure your plan in Packet Tracer using the build sheet. Verify with show vlan brief and ping tests: same-VLAN devices communicate; the customer Wi-Fi and break-room VLANs cannot reach the inventory server.
3. Recommend controls that address each step of the attack (accounts and passwords, lockout, least privilege, segmentation, firewall, monitoring, physical security, policies such as an AUP).
4. Write an availability plan: how would the store keep taking card payments during the next outage? Consider redundancy, backup internet, UPS, monitoring, and patching (Lesson 4.6).

Report and rubric

Your incident evidence and impact report must include: an incident summary (what happened, when, and which systems were affected); the CIA analysis with evidence; the impact assessment; the traceroute and IDS findings; the segmentation plan with verification; and recommended controls and the availability plan.

Walkthrough video

Teachers: the complete timeline, CIA key, VLAN model plan, and setup notes for a class SFTP server are in the teacher area.