Your Mission
Investigate a cybersecurity incident, share evidence with your team, uncover a three-digit code, and unlock the recovery box.
The Incident
PixelPop Media, a digital media studio, has discovered that someone accessed a company account, changed a scheduled client post, and locked the employees out. Your team must determine how it happened and what the company should do next.
Assign Roles
Each person receives a role and different evidence. Keep your role for the entire station.
- Scene Investigator: Search the Web Studio for physical evidence that may help explain the incident. You will be the only member of your team to investigate this room.
- Email Analyst: Examine the printed email evidence and determine which details may be connected to the incident.
- Security Records Analyst: Examine the account activity report and supporting records to identify information that may be connected to the incident.
- Incident Coordinator: Organize the team’s findings, record the key evidence, and lead the Final Code Challenge and response discussion. If your group has three freshmen, the senior station leader fills this role.
Instructions
Phase 1: Investigate
- Collect your role card and evidence.
- Investigate independently for five minutes.
- Examine everything carefully and decide which details matter.
- Identify the security concern connected to your evidence and prepare to explain your reasoning.
- Do not exchange evidence until the five-minute investigation ends.
Phase 2: Share the Evidence
- Reconvene with your team when the five-minute investigation ends.
- Each investigator explains the relevant evidence, the security concern, and the conclusion reached.
- The Incident Coordinator records the team’s findings.
- After everyone reports, the senior station leader will provide the Final Code Challenge card.
- Use your findings to determine the three digits and arrange them in the correct order.
Phase 3: Unlock the Recovery Box
- Enter your team’s three-digit code.
- Do not guess repeatedly or force the lock.
- Your group receives a prize only if you figure out the code without being given the answer.
- If the box does not open, review your evidence before asking the senior station leader for a hint.
Recovery Box Code Hints
- Time found in the content of the phishing attack email.
- Number of unauthorized login attempts.
- Last character of the user’s password.
Phase 4: Respond to the Incident
- Remove the incident response action cards from the recovery box.
- Choose the three actions your team believes PixelPop Media should take first.
- Explain why each selected action would help the company respond to the incident.
Important
- Keep all evidence and materials at the station.
- Team members may give hints or explanations, but each investigator should share their own findings.
- Return all response cards before rotating to the next station.