T-C-1 — Center, 1 day

Lab guide · Isla Mercantile Group · 385m net (09:00–16:30)

Schedule

Time	Block	Minutes
09:00	C0 — Engagement kickoff	15
09:15	C1 — The consultancy craft	30
09:45	C2 — Maturity quick-scan (CMB)	25
10:10	Break	15
10:25	C3 — Baseline assessment (CBA)	70
11:35	C4 — Inventory intake	40
12:15	Lunch	40
12:55	C5 — Outside-in view: register versus reality	45
13:40	C6 — Verify in the field	25
14:05	C9 — Supplier crypto risk (TPRM)	40
14:45	Break	10
14:55	C7 — Design & policy	35
15:30	A1 — Crypto agility	10
15:40	C8 — Report & readout	40
16:20	Wrap-up	10

Before you start

Log in

Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.

System	Address	Login	Used in
Eon Insights	`https://insights.edu.eoncore.net`	`traineeNN`	I-blocks, I-TAG, X1
Eon Center	`https://center.edu.eoncore.net`	`traineeNN` (`org_admin` of `team-NN`)	C-blocks, K-blocks, X1
Center, Kartis pages only	`https://center.edu.eoncore.net`	`kNN` (`kartis_only`)	K-blocks in the Insights + Kartis tracks
Isla public sites	`https://<vhost>.isla.edu.eoncore.net`	none	I-M2, K-1, C6, I-M11

In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.

Shared environment

One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
There is no personal reset. Do not delete data, uploads or tags you did not create.
Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.

Isla at a glance

Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.

App (team)	Internal hosts	Subnet	Public vhosts
webshop	`shop`, `api`, `db`, `pay` `.webshop.isla.test`	10.20.1.0/24	`www`, `shop`, `api`, `pay`
intranet	`sso`, `portal`, `cache` `.intranet.isla.test`	10.20.2.0/24	`intranet`
payments	`gw`, `vpn`, `hsm` `.payments.isla.test`	10.20.3.0/24	none
loyalty	`app`, `api`, `old` `.loyalty.isla.test`	10.20.4.0/24	`loyalty`, `loyalty-old`

Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.

Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.

Exercises

C0 — Engagement kickoff

09:00 · 15 min

Exercise	Task	Finding
C0.1	Read the client brief in pairs: the two engagement questions, one judging criterion per stakeholder, two statements you would not accept without evidence	F08, F11
C0.2	Log in to Center, open `Isla Mercantile Group (team-NN)`, copy its customer ID, set journey milestone "Maturity intake (CMB)" to In progress with a note	—

C1 — The consultancy craft

09:15 · 30 min

Exercise	Task	Finding
C1.1	Definition of done for D1 and D5 (standard/full: D1, D2, D5): who accepts, what it contains, what not; add as journey notes	—
C1.2 (standard, full)	Four claims from the brief: claim type, the evidence that settles it, the block that produces it	F01, F02, F03, F08, F11

C2 — Maturity quick-scan (CMB)

09:45 · 25 min

Exercise	Task	Finding
C2.1	From the brief alone: which two CMB categories lowest, which one highest?	—
C2.2	`/cmb/results` → `Isla — CMB self-assessment`: overall score, band, three lowest and two highest categories; who does the work behind the highest	—
C2.3	Two answers to treat as claims to verify, one answer whose score misrepresents Isla; which block produces the evidence	F01, F02, F08

C3 — Baseline assessment (CBA)

10:25 · 70 min

Exercise	Task	Finding
C3.1	Interview the CISO (trainer). Short: the 10 marked questions; full: all 36, your pair's subcategories. Write her answers in her words; probe at least three	—
C3.2	Set a maturity level per question with a one-line reason; create assessment `Isla — PQC baseline` for `team-NN` and import the workbook	—
C3.3	Run the AI assessor on question 17 (full: also 33); compare its level with yours, edit, decide on Approve	F03
C3.4	Gap table per subcategory: current level, 12-month target, gap, driver (DORA / NIS2 article or PQC exposure)	F14
C3.5 (full)	Mark each AI advice recommendation as supported (name the question) or generic; which one do you drop?	—

C4 — Inventory intake

11:35 · 40 min

Exercise	Task	Finding
C4.1	Review `ckm-intake.xlsx` without Center: row, issue, proposed action, who at Isla answers; note what is already a finding	F03, F08
C4.2	Create Inventory design `Isla CKM intake`, upload the workbook, read the consolidation report: components per layer vs rows vs distinct systems	—
C4.3	Central registry: two entries (full: four) for assets that need an owner or a decision; owner unknown → `unknown — ask <name>`	F02, F03, F07

C5 — Outside-in view: register versus reality

12:55 · 45 min

Exercise	Task	Finding
C5.2	Start a discovery for `isla.edu.eoncore.net` if needed, upload `register.xlsx`, compare registered hosts with Hosts: which external host is missing?	F08
C5.3	Run Crypto posture; list every finding with verdict, severity, subject, evidence; which one not to report yet?	F02, F03, F04, F08, F09
C5.4 (standard, full)	Set a status per finding, name the owner at Isla and the next action; unverified stays `open` with a note	F02, F03, F04, F08, F09

C6 — Verify in the field

13:40 · 25 min

Exercise	Task	Finding
C6.1	3DES check against `pay` (appendix B.1): protocol and cipher; does it confirm the Kartis drift? Which Insights finding matches?	F02
C6.2	TLS 1.0 and 1.2 against `intranet` (appendix B.2), with the TLS 1.0 control on `pay` (B.1b); what does the server say, what was the scan date?	F03, F04
C6.3	Set the `intranet` `weak_tls_version` finding to `false_positive` (leave `cert_expiring` open); add a Labels note (scan date, check, result, initials); leave `pay` open	F04
C6.4 (standard, full)	Two evidence-log lines: command, date and time, result, confirmed / refuted	F02, F04

C9 — Supplier crypto risk (TPRM)

14:05 · 40 min

Exercise	Task	Finding
C9.1	DNS / Email and Technology: list every third party (SPF, DKIM, mail provider, CDN, cloud), match to the brief; who handles Isla data or keys and is missing?	F11
C9.2	Decision tree for the five suppliers in the brief plus the one you found: crypto role, tier, one-line reason (five minutes)	F11
C9.3	Per team one supplier (PayCarib, IdentiQ or Mailfuel): five questions before renewal (key custody, evidence, rotation, incidents, migration and exit) and the two clauses you would not sign without	—
C9.4 (full)	PayCarib refuses the agility clause T1.5.1. In pairs: what Isla loses, what it can accept instead, who decides	—

C7 — Design & policy

14:55 · 35 min

Exercise	Task	Finding
C7.1	Generate a Cryptography Baseline in Polgen for Isla (template Financieel EU, sector financial, English, NIS2 / DORA / ISO 27001 / NIST, Enterprise); download as Markdown	—
C7.2	Per gap from C3: the clause that covers it or "not covered"; then two clauses that answer no Isla gap	F01, F02, F03, F07, F08, F11, F14

A1 — Crypto agility

15:30 · 10 min

No exercise. Discussion question: NIST deprecates an algorithm Isla uses for card payments. Who at Isla knows how long replacing it takes, and where is that written down?

C8 — Report & readout

15:40 · 40 min

Exercise	Task	Finding
C8.1	Generate the Kartis management report: which of F02, F03, F08, F09, F11, F12 appear, in which counter, which is missing and why?	F02, F03, F08, F09, F11, F12
C8.2 (standard, full)	Top five actions in the remediation tracker: title, domain, owner at Isla, priority, deadline	—
C8.3	One page per group: where we stand (Q1, Q2), what it costs (hours), what first (three actions, owner, date); read out to the CISO	—

Queries, live checks and templates

Live checks

Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.

B.1 3DES on `pay` (I-M2.3, K-1.6, C6.1)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/null

B.1b Control: can your client speak TLS 1.0? (C6.2, K-1.5, I-M11)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null

Handshake succeeds: your client can test TLS 1.0. no protocols available or a failure before any server answer: your client refuses TLS 1.0, and B.2 proves nothing.

B.2 TLS versions on `intranet` (K-1.5, C6.2, I-M11)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1_2 </dev/null

B.3 Certificate expiry (I-M11, C6)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net </dev/null \
  | openssl x509 -noout -enddate

Record every check you use as evidence: date, command, result.