T-C-half-A — Center, ½ day: engagement fast-forward

Lab guide · Isla Mercantile Group · 195m net (09:00–12:30)

Schedule

Time	Block	Minutes
09:00	C0 — Engagement kickoff	15
09:15	C1 — The consultancy craft	20
09:35	C3 — Baseline assessment (CBA)	50
10:25	Break	15
10:40	C5 — Outside-in view: register versus reality	40
11:20	C6 — Verify in the field	20
11:40	C8 — Report & readout	40
12:20	Wrap-up	10

Before you start

Log in

Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.

System	Address	Login	Used in
Eon Insights	`https://insights.edu.eoncore.net`	`traineeNN`	I-blocks, I-TAG, X1
Eon Center	`https://center.edu.eoncore.net`	`traineeNN` (`org_admin` of `team-NN`)	C-blocks, K-blocks, X1
Center, Kartis pages only	`https://center.edu.eoncore.net`	`kNN` (`kartis_only`)	K-blocks in the Insights + Kartis tracks
Isla public sites	`https://<vhost>.isla.edu.eoncore.net`	none	I-M2, K-1, C6, I-M11

In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.

Shared environment

One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
There is no personal reset. Do not delete data, uploads or tags you did not create.
Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.

Isla at a glance

Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.

App (team)	Internal hosts	Subnet	Public vhosts
webshop	`shop`, `api`, `db`, `pay` `.webshop.isla.test`	10.20.1.0/24	`www`, `shop`, `api`, `pay`
intranet	`sso`, `portal`, `cache` `.intranet.isla.test`	10.20.2.0/24	`intranet`
payments	`gw`, `vpn`, `hsm` `.payments.isla.test`	10.20.3.0/24	none
loyalty	`app`, `api`, `old` `.loyalty.isla.test`	10.20.4.0/24	`loyalty`, `loyalty-old`

Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.

Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.

Exercises

C0 — Engagement kickoff

09:00 · 15 min

Exercise	Task	Finding
C0.1	Read the client brief in pairs: the two engagement questions, one judging criterion per stakeholder, two statements you would not accept without evidence	F08, F11
C0.2	Log in to Center, open `Isla Mercantile Group (team-NN)`, copy its customer ID, set journey milestone "Maturity intake (CMB)" to In progress with a note	—

C1 — The consultancy craft

09:15 · 20 min

Exercise	Task	Finding
C1.1	Definition of done for D1 and D5 (standard/full: D1, D2, D5): who accepts, what it contains, what not; add as journey notes	—

C3 — Baseline assessment (CBA)

09:35 · 50 min

Exercise	Task	Finding
C3.1	Interview the CISO (trainer). Short: the 10 marked questions; full: all 36, your pair's subcategories. Write her answers in her words; probe at least three	—
C3.2	Set a maturity level per question with a one-line reason; create assessment `Isla — PQC baseline` for `team-NN` and import the workbook	—
C3.3	Run the AI assessor on question 17 (full: also 33); compare its level with yours, edit, decide on Approve	F03
C3.4	Gap table per subcategory: current level, 12-month target, gap, driver (DORA / NIS2 article or PQC exposure)	F14

C5 — Outside-in view: register versus reality

10:40 · 40 min

Exercise	Task	Finding
C5.2	Start a discovery for `isla.edu.eoncore.net` if needed, upload `register.xlsx`, compare registered hosts with Hosts: which external host is missing?	F08
C5.3	Run Crypto posture; list every finding with verdict, severity, subject, evidence; which one not to report yet?	F02, F03, F04, F08, F09

C6 — Verify in the field

11:20 · 20 min

Exercise	Task	Finding
C6.1	3DES check against `pay` (appendix B.1): protocol and cipher; does it confirm the Kartis drift? Which Insights finding matches?	F02
C6.2	TLS 1.0 and 1.2 against `intranet` (appendix B.2), with the TLS 1.0 control on `pay` (B.1b); what does the server say, what was the scan date?	F03, F04
C6.3	Set the `intranet` `weak_tls_version` finding to `false_positive` (leave `cert_expiring` open); add a Labels note (scan date, check, result, initials); leave `pay` open	F04

C8 — Report & readout

11:40 · 40 min

Exercise	Task	Finding
C8.1	Generate the Kartis management report: which of F02, F03, F08, F09, F11, F12 appear, in which counter, which is missing and why?	F02, F03, F08, F09, F11, F12
C8.2 (standard, full)	Top five actions in the remediation tracker: title, domain, owner at Isla, priority, deadline	—
C8.3	One page per group: where we stand (Q1, Q2), what it costs (hours), what first (three actions, owner, date); read out to the CISO	—

Queries, live checks and templates

Live checks

Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.

B.1 3DES on `pay` (I-M2.3, K-1.6, C6.1)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/null

B.1b Control: can your client speak TLS 1.0? (C6.2, K-1.5, I-M11)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null

Handshake succeeds: your client can test TLS 1.0. no protocols available or a failure before any server answer: your client refuses TLS 1.0, and B.2 proves nothing.

B.2 TLS versions on `intranet` (K-1.5, C6.2, I-M11)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1_2 </dev/null

B.3 Certificate expiry (I-M11, C6)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net </dev/null \
  | openssl x509 -noout -enddate

Record every check you use as evidence: date, command, result.