Home / The Lab
Six small experiments in segmentation, firewall rules, monitoring, evidence, recovery, and uptime. About a minute each.
Everything runs in your browser. Nothing you type or pick here is sent to us.
Pick a device and watch where it can get to. Then switch the network to zones and pick again.
Pick any device to start.
reaches of 11 other devices.
On a flat network, any device reaches all 11 others. With zones, a guest phone reaches none of them, and the admin PC, the best-connected device, reaches five.
Where this shows up in our work: Network and Physical Security
Two of the six test packets do the wrong thing. Reorder the rules until all six behave.
DenyAnything no rule above matches
The firewall reads top to bottom and stops at the first rule that matches. Anything no rule matches is denied.
Move rule C (deny guest traffic to internal systems) above rule A, which allows web traffic from anywhere. Move rule B (allow the admin PC to manage cameras) above rule D, which denies camera management to everyone. Specific rules go above the broad ones they would otherwise lose to.
The policy holds. Specific rules first, broad rules after, and anything unmatched is denied.
Where this shows up in our work: Security Assessments
Seven events from an ordinary day. Make the call on each one.
02:10 | Backup server | Nightly job | FinishedThe nightly backup finished at 02:10, the same as every night.
Normal. Expected job, expected time, expected result. Nothing to do.
Expected job, expected time, expected result. Nothing to do.
07:41 | Staff account | 5 failed sign-ins, then success | New locationFive failed sign-ins on a staff account, then a success from a place this account has never signed in from.
Escalate. Failures followed by a success from somewhere new is a common sign of a guessed or stolen password. Someone should decide now whether to lock the account.
Failures followed by a success from somewhere new is a common sign of a guessed or stolen password. Someone should decide now whether to lock the account.
11:05 | Guest Wi-Fi device | 40 camera addresses tried | All blockedA guest Wi-Fi device tried 40 camera addresses in a minute. The boundary blocked every attempt.
Look closer. The boundary did its job. It is still worth finding the device and checking that it tried nothing else.
The boundary did its job. It is still worth finding the device and checking that it tried nothing else.
04:00 | Point-of-sale server | Restart | Patch windowThe point-of-sale server restarted at 04:00, inside its approved patch window.
Normal. A planned restart in a planned window. Confirm it came back, then move on.
A planned restart in a planned window. Confirm it came back, then move on.
13:22 | File server | 3,000 files renamed | Same new extensionOn the file server, 3,000 files were renamed with the same new extension within a few minutes.
Escalate. Mass renames at machine speed are what file encryption by an attacker often looks like. This one cannot wait for a full investigation.
Mass renames at machine speed are what file encryption by an attacker often looks like. This one cannot wait for a full investigation.
03:12 | Vendor account | Sign-in | Outside scheduleA vendor account signed in at 03:12. That vendor's access is scheduled for Tuesdays, 9 to 11.
Look closer. Not routine, and not yet proof of a problem. Ask the vendor first; escalate if they cannot account for it.
Not routine, and not yet proof of a problem. Ask the vendor first; escalate if they cannot account for it.
09:30 | Business network | New device | Smart TVA smart TV appeared on the business network this morning.
Look closer. Probably harmless, but it does not belong there. Find its owner and move it to the guest zone.
Probably harmless, but it does not belong there. Find its owner and move it to the guest zone.
Where this shows up in our work: Managed Detection and Response
Edit the drawer log, then try to cover your tracks.
| Time | Who | Entry | Amount | Fingerprint | Seal |
|---|---|---|---|---|---|
| 08:00 | Supervisor | Drawer opened | 495c 4474 aa67 | Matches | |
| 10:14 | Cashier 2 | Paid out | 554c c920 ad35 | Matches | |
| 12:30 | Cashier 2 | Received | 8989 b20c c813 | Matches | |
| 15:45 | Supervisor | Count checked | 54a5 ac87 7412 | Matches | |
| 16:00 | Shift lead | Drawer closed | cb6a b733 b1dc | Matches |
cb6a b733 b1dcMatchesEach row's fingerprint is a SHA-256 hash of the row and the fingerprint before it. When a row is written, its fingerprint is recorded as its seal.
Change any amount. Try 150.00 to 15.00.
Change one amount and that row no longer matches its seal, and neither does any row after it. Rewrite every seal to cover the change, and the last fingerprint still differs from the copy on the shift report.
Where this shows up in our work: Compliance and Governance
Choose your backups, then pick a bad day, or roll the dice.
Choose a bad day to see what survives.
| Copy | Deleted folder | Failed disks | Encrypted by an attacker | Building lost |
|---|---|---|---|---|
| Snapshot on the server | SurvivesHas the folder | LostOn the failed disks | LostDeleted by the attacker | LostGone with the building |
| Backup in the same building | SurvivesHas the folder | SurvivesSeparate device | LostReachable, so encrypted | LostGone with the building |
| Copy at another site | SurvivesHas the folder | SurvivesSomewhere else | At riskReachable with stolen admin access | SurvivesSomewhere else |
| Locked copy at another site | SurvivesHas the folder | SurvivesSomewhere else | SurvivesLocked: cannot be changed | SurvivesSomewhere else |
Where this shows up in our work: Incident Response and Recovery
Set how reliable each part is, pair the weak ones, and watch the year fill in.
All together
One square per day of the year. Red marks failures; amber, planned work.
| Available | Down per year | Down per month |
|---|---|---|
| 99% | 3.7 days | 7.3 hours |
| 99.9% | 8.8 hours | 44 minutes |
| 99.99% | 53 minutes | 4 minutes |
| 99.999% | 5 minutes | less than a minute |
The math assumes parts fail independently. Real pairs often share power, software, or the person changing them.
Six parts in a row at 99.9% each are up 99.4% together: about 2.2 days down a year. A pair of any part, failing independently, is down only when both are.
Where this shows up in our work: Managed IT and Help Desk
Each experiment is simplified to teach one idea. Devices, people, and events are invented; real networks, logs, and recovery plans have more moving parts.
Tell us what you run, and what you would like to know.
Confidential briefing. One reply from a senior engineer. No drip campaigns.