T-4D — Crypto Consultant, 4 days

Lab guide · Isla Mercantile Group · 4 days, 1235m net

Schedule

Before you start

Log in

Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.

In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.

Shared environment

• One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
• Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
• There is no personal reset. Do not delete data, uploads or tags you did not create.
• Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
• Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
• Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
• AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.

Isla at a glance

Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.

Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.

Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.

Exercises

I-M0 — Welcome & client brief

09:00 · 15 min

I-M1 — Crypto 101

09:15 · 60 min

I-M2 — How Insights sees (live)

10:15 · 45 min

I-M3 — Dashboard tour

11:15 · 75 min

I-TAG — Tag teams: build the chain

13:15 · 45 min

I-M4 — Compliance & risk

14:00 · 40 min

I-M5 — Hands-on lab

14:55 · 40 min

I-M6 — Crypto deep-dive

09:00 · 60 min

I-M7 — Threat on the wire

10:00 · 50 min

The trainer plays the beacon chapter at the start of the block.

I-M9 — Beyond TLS

11:05 · 35 min

I-M10 — Operationalise

11:40 · 45 min

I-M8 — Quantum & CBOM

13:10 · 50 min

The hook to A1 (crypto agility) follows this block in some tracks.

K-1 — Outside-in with Kartis

14:00 · 45 min

K-2 — Is the C2 ours?

15:00 · 35 min

I-M11 — Capstone (inside + outside)

09:00 · 50 min

The trainer plays the capstone chapter (and beacon if not played earlier). Per team, for your own app:

Expected: one inside-only, one outside-only and one both finding per app, plus the weakest link.

C0 — Engagement kickoff

10:05 · 15 min

C1 — The consultancy craft

10:20 · 45 min

C2 — Maturity quick-scan (CMB)

11:05 · 30 min

C3 — Baseline assessment (CBA)

11:35 · 70 min

C4 — Inventory intake

13:30 · 45 min

C5 — Outside-in view: register versus reality

14:30 · 50 min

C6 — Verify in the field

09:00 · 35 min

C9 — Supplier crypto risk (TPRM)

09:35 · 40 min

C7 — Design & policy

10:30 · 40 min

A1 — Crypto agility

11:10 · 10 min

No exercise. Discussion question: NIST deprecates an algorithm Isla uses for card payments. Who at Isla knows how long replacing it takes, and where is that written down?

X1 — Inside-out meets outside-in

11:20 · 30 min

C8 — Report & readout

11:50 · 50 min

Queries, live checks and templates

Queries

Run these through the Insights Chat. The Chat only accepts SELECT/WITH and rejects any query containing words such as INSERT, UPDATE, DELETE, ALTER, CREATE, REPLACE, SET anywhere in the text.

A.1 Chain view (I-TAG.2, I-M11)

Replace app:webshop with your app.

SELECT
    hostname,
    toString(any(ipv4))                                  AS ip,
    arrayDistinct(groupArrayArray(tags))                 AS all_tags,
    arrayFirst(t -> startsWith(t, 'tier:'),  all_tags)   AS tier,
    arrayFirst(t -> startsWith(t, 'owner:'), all_tags)   AS owner,
    anyLast(security_level)                              AS level,
    multiIf(level = 'insecure', 1, level = 'weak', 2,
            level = 'secure', 3, level = 'recommended', 4, 5) AS ladder_rank
FROM hosts
GROUP BY hostname
HAVING has(all_tags, 'app:webshop')
ORDER BY ladder_rank, tier

A.2 Negotiated suites per Isla host (I-M6.C)

SELECT h.dst_ip, h.sni, h.tls_version, c.name AS cipher, c.security, count() AS n
FROM tls_hellos AS h
LEFT JOIN ciphersuites AS c ON c.hex = h.negotiated_cipher
WHERE h.dst_ip LIKE '10.20.%'
GROUP BY h.dst_ip, h.sni, h.tls_version, cipher, c.security
ORDER BY h.dst_ip

tls_version is the wire value: 769 = TLS 1.0, 770 = TLS 1.1, 771 = TLS 1.2, 772 = TLS 1.3.

A.3 Beacon interval (I-M7.A)

SELECT src_ip, dst_ip, sni, ja3, count() AS beacons,
       arrayDifference(arraySort(groupArray(toUnixTimestamp(timestamp)))) AS intervals_s
FROM tls_hellos
WHERE sni = 'cdn-update-check.net'
GROUP BY src_ip, dst_ip, sni, ja3

A.4 IKE and OpenVPN of vpn.payments (I-M9.1)

SELECT src_ip, dst_ip, ike_version, exchange_type_name, dh_groups,
       encryption_algs, integrity_algs, vendor_ids,
       has_weak_dh, has_weak_encryption, has_weak_integrity
FROM ipsec_connections
WHERE '10.20.3.11' IN (src_ip, dst_ip)
ORDER BY timestamp DESC
LIMIT 10

SELECT src_ip, dst_ip, dst_port, vpn_type, openvpn_version, tls_auth_enabled
FROM vpn_connections
WHERE '10.20.3.11' IN (src_ip, dst_ip)
LIMIT 10

A.5 SSH to hsm.payments (I-M9.2)

SELECT src_ip, dst_ip, client_version, server_version, hassh, hassh_server,
       kex_algorithms, encryption_algorithms, mac_algorithms,
       has_weak_kex, has_weak_cipher, has_weak_mac
FROM ssh_connections
WHERE dst_ip = '10.20.3.12'
LIMIT 10

A.6 Certificates expiring within 60 days (I-M10.A)

SELECT subject, issuer, valid_to, dateDiff('day', now(), valid_to) AS days_left
FROM certificates FINAL
WHERE valid_to < now() + INTERVAL 60 DAY
ORDER BY valid_to

Live checks

Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.

B.1 3DES on pay (I-M2.3, K-1.6, C6.1)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/null

B.1b Control: can your client speak TLS 1.0? (C6.2, K-1.5, I-M11)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null

Handshake succeeds: your client can test TLS 1.0. no protocols available or a failure before any server answer: your client refuses TLS 1.0, and B.2 proves nothing.

B.2 TLS versions on intranet (K-1.5, C6.2, I-M11)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1_2 </dev/null

B.3 Certificate expiry (I-M11, C6)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net </dev/null \
  | openssl x509 -noout -enddate

Record every check you use as evidence: date, command, result.

Templates

C.1 Capstone readout (I-M11)

Team <app> — 3 minutes
1. Inside only:   <host / value> — why it is not visible outside — owner — fix — deadline
2. Outside only:  <what / page>  — why Insights cannot see it  — owner — fix — deadline
3. Both:          <finding>      — inside shows … / outside shows … — agree? — fix — deadline
4. Weakest link of our app and the first action for Monday

C.2 Inside/outside matrix (X1.1)