Lesson 2.1

Security is operated, not installed

Access: VPN-class remote access, personal accounts, MFA where supported, everything logged (406). Third parties get sponsored, time-limited, logged access — the breach lesson, operationalized.
Patching = 409's ceremony: tested, windowed, backed up, rollback ready. Field-tool hygiene: your laptop bridges networks — keep it clean, patched, and off customer networks except through sanctioned paths; USB discipline is real.
Monitoring: watch for anomalies — new devices, odd traffic, failed logins, off-hours commands. Incident basics: isolate, preserve evidence, escalate per plan, restore from known-good backups — ransomware recovery is 406's restore drill with an adversary.
The business layer: customer security questionnaires are procurement now — the floor is rising into contracts. Your daily contribution is hygiene + reported anomalies; your customer conversation is honest posture + prioritized steps — not fear, not dismissal.

LAB — harden and respond

Audit the trainer BAS network against a 12-item hardening checklist (defaults, exposure, segmentation, accounts, logging) — find the five seeded sins.
Fix what is fixable in the lab window; write the prioritized remediation plan for the rest, in owner language.
Incident drill: the instructor ‘compromises’ a station (simulated) — run the response: isolate, preserve, escalate, restore from your backup, verify.

Pass: 5/5 sins found; remediation prioritized sanely; response order correct; restore verified.

LAB DEMO VIDEO

Instructor walkthrough — the hardening audit + incident-response order

[ ~12 min ]

The defended BAS — architecture: internet → firewall → corporate VLAN | BAS VLAN (zones/conduits) with stations+controllers; VPN+MFA remote path; vendor time-boxed access lane; monitoring eye; known-good backup vault; ember Xs on exposed-port and default-password anti-patterns