Module 4 · Week 10 · Two labs · about 45–60 minutes each
Cloud Heights Family Clinic — Risk & Threat Investigation
You have spent earlier weeks at the keyboard: commands, networks and firewalls, encryption and SSH keys, certificates and trust. This week asks the question a security professional is actually paid to answer — what does any of that mean for a real business, and what should it do first?
Scenario date: Friday 13 March 2026, 09:00 (clinic local time). Nothing here is timed and nothing is scored automatically.
How this works
- 1. Walk the five rooms below. Read each staff statement and open the evidence cards.
- 2. Add the evidence you think matters to your findings. The lab never writes your interpretation for you.
- 3. In Lab 1, turn your findings into five risk scenarios and analyse the suspicious email.
- 4. In Lab 2, rate each risk, pick your top two, recommend a control for each, and brief the practice manager.
- 5. Download week10-lab-1.md and week10-lab-2.md and upload each one to the week-10/labs/ folder of your own CyberFoundations portfolio repository on GitHub (step-by-step directions are in Downloads on each lab page). Downloading alone does not upload anything.
You can stop at any point and come back — your work is saved on this browser and restored when you return.
Safety boundaries
- • Everything in this case is fictional. No real clinic, patient, address, or mailbox is involved.
- • Nothing in this lab scans, connects to, or attacks anything. All output shown is authored teaching text.
- • Where a fact is not known, the case says so. Unknown never means 'secure' and never means 'already breached'.
The clinic at a glance
AS-01
Appointment scheduling account
Books, moves and cancels patient appointments for the whole clinic.
AS-02
Patient records application
Stores and shows clinical information about patients.
AS-03
Staff laptops
The devices staff use to reach email and the records application.
AS-04
Public information website
Tells the public the address, hours and services of the clinic.
AS-05
Backup archive
The copy of clinic data used to recover after loss or damage.
Working out what could go wrong here is the job of this lab. Walk the rooms, read the evidence, and write your own list in Lab 1.
Investigate the clinic
Show a hint
Work through the rooms one at a time and ask, in this order:
- 1. What does this room need in order to do its job?
- 2. Which evidence card actually shows a weakness — not a worry, a weakness?
- 3. Who or what could take advantage of it, and how would they do it?
- 4. What would it cost the clinic and its patients if they did?
- 5. What does the evidence still not tell me? Write that down as an unknown.
Lab 1 has a fully worked example built on a different, non-assessed situation, if you want to see the shape of a finished row.
Clinic floor plan
Rooms (list view)
Room 2
Records Office
This is where patient information lives. The question here is not only who can get in, but whether the clinic can tell who did.
Renata Coyle — Practice Manager
“All four of my front desk people sign in to records the same way, with the same login. It is quicker. When someone leaves we take their badge back, but that login stays as it is.”
Evidence in this room
Adding a card keeps it in your findings list. It does not write your interpretation — what the evidence means is yours to say in the notebook and in Lab 1.
EV-REC-OFF-01
System report
Records application account list
- Accounts with access to patient records: 4 clinician/nurse accounts (named), 1 billing account (named), 1 account named `frontdesk`.
- `frontdesk` is the account all four reception staff sign in with. The password is written on a card in the desk drawer.
- Last password change on `frontdesk`: 8 months ago.
EV-REC-OFF-02
System report
Records access log extract
- 12 March 2026 14:02 — user `frontdesk` opened 6 patient records.
- 12 March 2026 16:41 — user `frontdesk` opened 2 patient records.
- Every reception-side entry in the log shows `frontdesk`. The log cannot show which of the four people was at the keyboard.
Not known from this evidence
Whether those record openings were appropriate cannot be judged from this log, because the log does not identify a person.
EV-REC-OFF-03
Staff statement
Practice manager statement — leavers
- Renata Coyle, Practice Manager: "When a front desk person leaves we collect their badge. The shared records login stays the same, because changing it means telling everyone the new password."
- Two reception staff have left in the past year.
Not known from this evidence
Whether a former member of staff can still reach the records application from outside the clinic is not established by this evidence.
Show a hint
My investigation notebook
Yours to keep. Nothing here is graded automatically.
0 evidence cards in your findings.
Your Week 10 summary
This is a picture of your own work so far. Nothing here is graded, and no model answers are shown — it simply reflects what you have opened, chosen and written. Opening a room records that you looked at it; it does not say your answer is right.
Rooms you have visited
- Not opened yet:Reception
- Not opened yet:Records Office
- Not opened yet:Staff Workspace
- Not opened yet:Website Station
- Not opened yet:Backup Room
0 of 5 rooms opened.
Evidence in your findings
You have not added any evidence yet. Open a room and use “Add to my findings”.
Decisions you have recorded
Everything below is your own writing.
1. Appointment scheduling account SC-01
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
2. Patient records application SC-02
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
3. Staff laptops SC-03
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
4. Public information website SC-04
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
5. Backup archive SC-05
- Your threat / event
- Not written yet
- Evidence attached
- None chosen yet
- Likelihood × impact
- Not rated yet — Not rated yet. Not rated yet.
- Recommendation
- Not chosen as a priority
- Suspicious email: 0 of 3 warning signs written, reporting step still to write.
- Priority reasoning: 0 of 2 priorities chosen.
- Owner briefing: not started yet.
- Notebook (optional): nothing entered yet.
Still to do
Investigation steps left — this lab asks you to walk all 5 rooms:
- • Lab 1 — All 5 clinic rooms opened (the walkthrough this lab asks for)
- • Lab 1 — At least five pieces of evidence added to your findings
- • Lab 1 — Scenario 1 (SC-01): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 2 (SC-02): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 3 (SC-03): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 4 (SC-04): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Scenario 5 (SC-05): evidence, threat, vulnerability, consequence and at least one CIA concern
- • Lab 1 — Email analysis: three warning signs, a safe reporting step, and your "suspicious vs proven" reflection
- • Lab 2 — Risk 1 (SC-01): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 2 (SC-02): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 3 (SC-03): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 4 (SC-04): likelihood and impact rated, both with a reason
- • Lab 2 — Risk 5 (SC-05): likelihood and impact rated, both with a reason
- • Lab 2 — Two priority risks chosen, with your reasoning
- • Lab 2 — Each priority risk has a control, how it helps, and remaining risk described
- • Lab 2 — Owner briefing written (about 100–150 words is the guide, not a limit)
Your Week 10 investigation is not finished yet. Finish the steps above before you upload your reports to GitHub.
Your progress
- Still to do:Lab 1 — All 5 clinic rooms opened (the walkthrough this lab asks for)
- Still to do:Lab 1 — At least five pieces of evidence added to your findings
- Still to do:Lab 1 — Scenario 1 (SC-01): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 2 (SC-02): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 3 (SC-03): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 4 (SC-04): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Scenario 5 (SC-05): evidence, threat, vulnerability, consequence and at least one CIA concern
- Still to do:Lab 1 — Email analysis: three warning signs, a safe reporting step, and your "suspicious vs proven" reflection
- Still to do:Lab 2 — Risk 1 (SC-01): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 2 (SC-02): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 3 (SC-03): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 4 (SC-04): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Risk 5 (SC-05): likelihood and impact rated, both with a reason
- Still to do:Lab 2 — Two priority risks chosen, with your reasoning
- Still to do:Lab 2 — Each priority risk has a control, how it helps, and remaining risk described
- Still to do:Lab 2 — Owner briefing written (about 100–150 words is the guide, not a limit)
Completion means the required work is present. Nothing here grades your wording.
Study mode and saving
Ready · Saved on this browser/device only. This is not cross-device sync — use the JSON backup to move your work.
Saved with your Week 10 work on this browser/device and included in your JSON backup.
Downloads
Reminder: enter your name above before downloading, so your reports show who wrote them.
Reports contain your own writing only. Unfinished work is still downloadable and is clearly marked as a draft with a list of what is missing.
How to add your Week 10 reports to your GitHub portfolio
- 1. Finish the lab here, check the required-work list and your reasoning, and enter or check your name above.
- 2. Use Download Lab 1 report (Markdown) to get week10-lab-1.md, or Download Lab 2 report (Markdown) to get week10-lab-2.md.
- 3. Open your own existing CyberFoundations student portfolio repository on GitHub — not the institute's template repository. Week 10 reports belong in the week-10/labs/ folder, the same pattern as Week 8 (week-08/labs/) and Week 9 (week-09/labs/). The full destinations are week-10/labs/week10-lab-1.md and week-10/labs/week10-lab-2.md.
- 4. If the week-10/labs/ folder does not exist yet, create it once: from your repository's main page choose Add file → Create new file, type week-10/labs/README.md as the filename, add a short heading such as # Week 10 Lab Reports, and choose Commit changes. If the folder already exists, use it as it is — don't replace an existing README.
- 5. Open the week-10/labs/ folder, choose Add file → Upload files, select the matching downloaded .md report, check the filename and destination, type a meaningful commit message, and choose Commit changes (follow GitHub's confirmation if it asks).
- 6. Open the committed file on GitHub and confirm your name and latest completed answers show. Downloading a report alone does not upload it to GitHub or submit it for grading.
Revising a report
Edit your answers here, download a fresh report, and keep the original filename (remove any “(1)” or “(2)” your browser added). Upload it to the same week-10/labs/ folder under the same filename, check that you are updating the intended file, commit, then reopen it to verify. Do not delete your other work.
- • Grading submission instructions will be provided separately.
- • The combined portfolio report is optional and does not replace the two individual reports.
- • The JSON backup only restores editable work in this demo — it is not a lab report to upload.
- • Screenshots are optional.
Backup and restore (this browser only)
Your work is saved on this browser/device. To move it to another computer, download the backup file here and restore it there. This is a file you carry, not automatic sync.
Reset Week 10
This clears only your Week 10 work. Work from other weeks is untouched. Download a backup first if you might want it back.