Module 4 · Week 10 · Lab 1 · about 45–60 minutes
Investigate What Needs Protection
Your job is to understand the clinic before judging it. Read the rooms, collect the evidence, then describe five situations where something could go wrong — each one anchored to evidence you can point at.
You are finished when you have opened all five clinic rooms, added at least five pieces of evidence to your findings, five scenarios each have evidence, a threat, a vulnerability, a consequence and at least one CIA concern, and the email analysis has three warning signs, a safe reporting step and your “suspicious vs proven” reflection. Finished means the work is present — it is not a judgement of whether your analysis is correct.
The clinic
Clinic floor plan
Rooms (list view)
Room 1
Reception
This is the front desk. People here answer email all day, which means they are the part of the clinic strangers can reach most easily.
Priya Osei — Reception & Scheduling Lead
“I had a message this morning saying our scheduling account closes in two hours unless I confirm the password. It looked official, but the address underneath was not our usual one. We get something like this most weeks.”
Evidence in this room
Adding a card keeps it in your findings list. It does not write your interpretation — what the evidence means is yours to say in the notebook and in Lab 1.
EV-REC-01
Document
Email received at the reception mailbox
- From: Clinic IT Support <appointments@clinic-support.example>
- To: reception@cloudheights-clinic.example
- Received: 13 March 2026, 07:58
- Subject: URGENT — scheduling account will be closed today
- Body: "Our records show your scheduling password has expired. Confirm your username and current password within 2 hours at https://account-verify.clinic-support.example/reset or the appointment system will be locked for your whole clinic today."
- The message is shown here as inert text. The address is not a working link and nothing is sent anywhere.
Not known from this evidence
Whether anyone at the clinic replied or entered a password is not recorded anywhere in this case.
EV-REC-02
Staff statement
Sender address comparison card
- The clinic's real scheduling vendor writes from: support@appointments-vendor.example
- The clinic's own domain is: cloudheights-clinic.example
- The message arrived from: clinic-support.example — a third, different domain.
- The display name says "Clinic IT Support". The display name is typed by the sender and is not proof of who sent it.
EV-REC-03
Staff statement
Reception desk log note
- Log note, 13 March 2026: "Third message like this in three weeks. Everyone at the front desk gets them. We just delete them."
- Reception scheduling accounts sign in with an email address and a password only.
Not known from this evidence
There is no record of these messages ever being reported to the IT contractor.
Show a hint
My investigation notebook
Yours to keep. Nothing here is graded automatically.
0 evidence cards in your findings.
Part A
What this clinic is trying to do
A single-location family clinic with 12 staff. It books appointments, keeps patient records, uses staff laptops, publishes a small public information website, and copies its records to a backup drive.
- • 12 staff: 1 practice manager, 2 clinicians, 3 nurses, 4 reception/scheduling staff, 1 billing clerk, 1 part-time IT contractor (one day a week).
- • Appointment system: a hosted scheduling service, signed in with an email address and password. No second step at sign-in.
- • Patient records: a records application on the clinic network. Reception staff reach it through one shared account.
- • Staff laptops: 9 clinic-owned laptops, managed loosely by the part-time IT contractor.
- • Public website: static information pages (address, opening hours, services). It does not contain or reach patient records.
- • Backups: one external drive kept plugged into the reception workstation.
Security work exists to keep this clinic running and to keep patients safe. For the rest of this lab, every judgement you make should trace back to something you can point at in the evidence.
Part B
The five things worth protecting
AS-01
Appointment scheduling account
Books, moves and cancels patient appointments for the whole clinic.
Show a hint: how to think about this asset
- Private: who should never see what is stored or shown here?
- Correct: what would go wrong if this held wrong or changed information?
- Available: what stops for the clinic if this cannot be used today?
Everyday example (not this clinic): a community theatre's ticket list must stay private (buyers' phone numbers), correct (right seats) and available (on show night).
AS-02
Patient records application
Stores and shows clinical information about patients.
Show a hint: how to think about this asset
- Private: who should never see what is stored or shown here?
- Correct: what would go wrong if this held wrong or changed information?
- Available: what stops for the clinic if this cannot be used today?
Everyday example (not this clinic): a community theatre's ticket list must stay private (buyers' phone numbers), correct (right seats) and available (on show night).
AS-03
Staff laptops
The devices staff use to reach email and the records application.
Show a hint: how to think about this asset
- Private: who should never see what is stored or shown here?
- Correct: what would go wrong if this held wrong or changed information?
- Available: what stops for the clinic if this cannot be used today?
Everyday example (not this clinic): a community theatre's ticket list must stay private (buyers' phone numbers), correct (right seats) and available (on show night).
AS-04
Public information website
Tells the public the address, hours and services of the clinic.
Show a hint: how to think about this asset
- Private: who should never see what is stored or shown here?
- Correct: what would go wrong if this held wrong or changed information?
- Available: what stops for the clinic if this cannot be used today?
Everyday example (not this clinic): a community theatre's ticket list must stay private (buyers' phone numbers), correct (right seats) and available (on show night).
AS-05
Backup archive
The copy of clinic data used to recover after loss or damage.
Show a hint: how to think about this asset
- Private: who should never see what is stored or shown here?
- Correct: what would go wrong if this held wrong or changed information?
- Available: what stops for the clinic if this cannot be used today?
Everyday example (not this clinic): a community theatre's ticket list must stay private (buyers' phone numbers), correct (right seats) and available (on show night).
The words you will use
- Asset
- Something the clinic needs in order to work, or needs to protect.
- An asset is anything of value to the organisation: data, a system, a device, or a service.
- Threat / threat event
- The bad thing that could happen, and who or what could cause it.
- A threat event is a specific occurrence that could harm an asset, described as actor + action.
- Vulnerability
- The weak spot that would let the bad thing happen.
- A vulnerability is a weakness in a system, process, or practice that a threat can act on.
- Consequence / impact
- What it costs the clinic and its patients if it happens.
- Impact is the effect on operations, people, data and obligations if the event occurs.
- Likelihood
- How believable it is that this happens here, given what you found.
- A qualitative judgement based on exposure, weaknesses present, and protections already in place.
- Risk
- The combination of how believable it is and how bad it would be.
- Risk here is expressed as a classroom score: likelihood x impact, each rated 1 to 3.
- Control
- The thing you change so the bad outcome gets less likely or less painful.
- A control is a safeguard applied to reduce likelihood, reduce impact, or improve detection.
- Residual risk
- What is still left over after your fix is in place.
- The risk remaining once a control is operating. It is described here in words, not invented numbers.
- CIA
- Three questions: kept private? correct? available when needed?
- Confidentiality, Integrity and Availability.
- Attribution
- Being able to say which person did something.
- Attribution requires individually identified accounts; shared accounts remove it.
Worked example
How one row is built (this row is not one of yours)
This example uses the clinic's paper appointment diary at the front desk. It is deliberately not one of the five scenarios you are asked to complete, so nothing is filled in for you.
- Asset
- The paper day-list printed each morning at reception.
- Evidence
- Front desk photograph showing the day-list face-up on the counter (illustrative only — not in your evidence list).
- Threat / event
- A visitor at the counter reads the names of other patients attending today.
- Vulnerability
- The list is left visible at a public counter with no cover sheet.
- Consequence
- Patient attendance is disclosed to strangers; trust and privacy are damaged.
- CIA
- Confidentiality.
- Unknown / question
- How often the counter is left unattended is not recorded.
Part C
Build your five risk scenarios
Two separate steps: “Add to my findings” in a room collects evidence into your overall list; “Evidence I am using” below attaches evidence to one particular scenario. You need both. Changes here carry into Lab 2 — if you change a scenario, reconsider its rating and recommendation there.
One row per situation. Tick the evidence you are relying on — the IDs travel with your work into Lab 2 and into your report. Where the evidence does not tell you something, say so in the unknown box instead of assuming.
Scenario 1 SC-01
Stuck? Open step-by-step questions (no answers)
These are questions to work through, not answers. Take one step at a time.
Step 1 — Look again at the evidence
Which cards in your findings mention this asset? Read them once more and underline the sentence that describes how things are actually done today, not how they should be done.
Step 2 — Name what could go wrong
Describe an event: who or what acts, and what happens as a result. Write it as something that happens ("someone does X"), not as a feeling that this looks risky.
Step 3 — Explain the weakness that allows it
Point at the specific condition in the evidence that makes your event possible. If you cannot point at a card, it may be an unknown rather than a weakness — write it in the unknown box instead.
Step 4 — Work out the CIA impact
Ask which of three things your event breaks: would something private be seen (confidentiality), would something become wrong or untrustworthy (integrity), or would something the clinic needs be missing (availability)? More than one can apply.
Scenario 2 SC-02
Stuck? Open step-by-step questions (no answers)
These are questions to work through, not answers. Take one step at a time.
Step 1 — Look again at the evidence
Which cards in your findings mention this asset? Read them once more and underline the sentence that describes how things are actually done today, not how they should be done.
Step 2 — Name what could go wrong
Describe an event: who or what acts, and what happens as a result. Write it as something that happens ("someone does X"), not as a feeling that this looks risky.
Step 3 — Explain the weakness that allows it
Point at the specific condition in the evidence that makes your event possible. If you cannot point at a card, it may be an unknown rather than a weakness — write it in the unknown box instead.
Step 4 — Work out the CIA impact
Ask which of three things your event breaks: would something private be seen (confidentiality), would something become wrong or untrustworthy (integrity), or would something the clinic needs be missing (availability)? More than one can apply.
Scenario 3 SC-03
Stuck? Open step-by-step questions (no answers)
These are questions to work through, not answers. Take one step at a time.
Step 1 — Look again at the evidence
Which cards in your findings mention this asset? Read them once more and underline the sentence that describes how things are actually done today, not how they should be done.
Step 2 — Name what could go wrong
Describe an event: who or what acts, and what happens as a result. Write it as something that happens ("someone does X"), not as a feeling that this looks risky.
Step 3 — Explain the weakness that allows it
Point at the specific condition in the evidence that makes your event possible. If you cannot point at a card, it may be an unknown rather than a weakness — write it in the unknown box instead.
Step 4 — Work out the CIA impact
Ask which of three things your event breaks: would something private be seen (confidentiality), would something become wrong or untrustworthy (integrity), or would something the clinic needs be missing (availability)? More than one can apply.
Scenario 4 SC-04
Stuck? Open step-by-step questions (no answers)
These are questions to work through, not answers. Take one step at a time.
Step 1 — Look again at the evidence
Which cards in your findings mention this asset? Read them once more and underline the sentence that describes how things are actually done today, not how they should be done.
Step 2 — Name what could go wrong
Describe an event: who or what acts, and what happens as a result. Write it as something that happens ("someone does X"), not as a feeling that this looks risky.
Step 3 — Explain the weakness that allows it
Point at the specific condition in the evidence that makes your event possible. If you cannot point at a card, it may be an unknown rather than a weakness — write it in the unknown box instead.
Step 4 — Work out the CIA impact
Ask which of three things your event breaks: would something private be seen (confidentiality), would something become wrong or untrustworthy (integrity), or would something the clinic needs be missing (availability)? More than one can apply.
Scenario 5 SC-05
Stuck? Open step-by-step questions (no answers)
These are questions to work through, not answers. Take one step at a time.
Step 1 — Look again at the evidence
Which cards in your findings mention this asset? Read them once more and underline the sentence that describes how things are actually done today, not how they should be done.
Step 2 — Name what could go wrong
Describe an event: who or what acts, and what happens as a result. Write it as something that happens ("someone does X"), not as a feeling that this looks risky.
Step 3 — Explain the weakness that allows it
Point at the specific condition in the evidence that makes your event possible. If you cannot point at a card, it may be an unknown rather than a weakness — write it in the unknown box instead.
Step 4 — Work out the CIA impact
Ask which of three things your event breaks: would something private be seen (confidentiality), would something become wrong or untrustworthy (integrity), or would something the clinic needs be missing (availability)? More than one can apply.
Show a hint
Part D
Email analysis
Reread EV-REC-01 and EV-REC-02: Email received at the reception mailbox.
Show a hint
Your progress
- Still to do:Lab 1 — All 5 clinic rooms opened (the walkthrough this lab asks for)
- Still to do:Lab 1 — At least five pieces of evidence added to your findings
- Still to do:Lab 1 — Scenario 1 (SC-01): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 2 (SC-02): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 3 (SC-03): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 4 (SC-04): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 5 (SC-05): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Email analysis: three warning signs, a safe reporting step, and your "suspicious vs proven" reflection
- Still to do:Lab 2 — Risk 1 (SC-01): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 2 (SC-02): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 3 (SC-03): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 4 (SC-04): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 5 (SC-05): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Two priority risks chosen, with your reasoning
- Still to do:Lab 2 — Each priority risk has a control, how it helps, and remaining risk described
- Still to do:Lab 2 — Owner briefing written (about 100–150 words is the guide, not a limit)
Completion means the required work is present. Nothing here grades your wording.
Study mode and saving
Ready · Saved on this browser/device only. This is not cross-device sync — use the JSON backup to move your work.
Saved with your Week 10 work on this browser/device and included in your JSON backup.
Downloads
Reminder: enter your name above before downloading, so your reports show who wrote them.
Reports contain your own writing only. Unfinished work is still downloadable and is clearly marked as a draft with a list of what is missing.
How to add your Week 10 reports to your GitHub portfolio
- 1. Finish the lab here, check the required-work list and your reasoning, and enter or check your name above.
- 2. Use Download Lab 1 report (Markdown) to get week10-lab-1.md, or Download Lab 2 report (Markdown) to get week10-lab-2.md.
- 3. Open your own existing CyberFoundations student portfolio repository on GitHub — not the institute's template repository. Week 10 reports belong in the week-10/labs/ folder, the same pattern as Week 8 (week-08/labs/) and Week 9 (week-09/labs/). The full destinations are week-10/labs/week10-lab-1.md and week-10/labs/week10-lab-2.md.
- 4. If the week-10/labs/ folder does not exist yet, create it once: from your repository's main page choose Add file → Create new file, type week-10/labs/README.md as the filename, add a short heading such as # Week 10 Lab Reports, and choose Commit changes. If the folder already exists, use it as it is — don't replace an existing README.
- 5. Open the week-10/labs/ folder, choose Add file → Upload files, select the matching downloaded .md report, check the filename and destination, type a meaningful commit message, and choose Commit changes (follow GitHub's confirmation if it asks).
- 6. Open the committed file on GitHub and confirm your name and latest completed answers show. Downloading a report alone does not upload it to GitHub or submit it for grading.
Revising a report
Edit your answers here, download a fresh report, and keep the original filename (remove any “(1)” or “(2)” your browser added). Upload it to the same week-10/labs/ folder under the same filename, check that you are updating the intended file, commit, then reopen it to verify. Do not delete your other work.
- • Grading submission instructions will be provided separately.
- • The combined portfolio report is optional and does not replace the two individual reports.
- • The JSON backup only restores editable work in this demo — it is not a lab report to upload.
- • Screenshots are optional.
Backup and restore (this browser only)
Your work is saved on this browser/device. To move it to another computer, download the backup file here and restore it there. This is a file you carry, not automatic sync.
Reset Week 10
This clears only your Week 10 work. Work from other weeks is untouched. Download a backup first if you might want it back.