T-C-half-B — Center, ½ day: evidence first

Lab guide · Isla Mercantile Group · 195m net (09:00–12:30)

Schedule

Time	Block	Minutes
09:00	C0 — Engagement kickoff	15
09:15	C1 — The consultancy craft	20
09:35	C4 — Inventory intake	45
10:20	Break	15
10:35	C5 — Outside-in view: register versus reality	50
11:25	C6 — Verify in the field	35
12:00	Wrap-up	30

Before you start

Log in

Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.

System	Address	Login	Used in
Eon Insights	`https://insights.edu.eoncore.net`	`traineeNN`	I-blocks, I-TAG, X1
Eon Center	`https://center.edu.eoncore.net`	`traineeNN` (`org_admin` of `team-NN`)	C-blocks, K-blocks, X1
Center, Kartis pages only	`https://center.edu.eoncore.net`	`kNN` (`kartis_only`)	K-blocks in the Insights + Kartis tracks
Isla public sites	`https://<vhost>.isla.edu.eoncore.net`	none	I-M2, K-1, C6, I-M11

In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.

Shared environment

One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
There is no personal reset. Do not delete data, uploads or tags you did not create.
Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.

Isla at a glance

Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.

App (team)	Internal hosts	Subnet	Public vhosts
webshop	`shop`, `api`, `db`, `pay` `.webshop.isla.test`	10.20.1.0/24	`www`, `shop`, `api`, `pay`
intranet	`sso`, `portal`, `cache` `.intranet.isla.test`	10.20.2.0/24	`intranet`
payments	`gw`, `vpn`, `hsm` `.payments.isla.test`	10.20.3.0/24	none
loyalty	`app`, `api`, `old` `.loyalty.isla.test`	10.20.4.0/24	`loyalty`, `loyalty-old`

Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.

Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.

Exercises

C0 — Engagement kickoff

09:00 · 15 min

Exercise	Task	Finding
C0.1	Read the client brief in pairs: the two engagement questions, one judging criterion per stakeholder, two statements you would not accept without evidence	F08, F11
C0.2	Log in to Center, open `Isla Mercantile Group (team-NN)`, copy its customer ID, set journey milestone "Maturity intake (CMB)" to In progress with a note	—

C1 — The consultancy craft

09:15 · 20 min

Exercise	Task	Finding
C1.1	Definition of done for D1 and D5 (standard/full: D1, D2, D5): who accepts, what it contains, what not; add as journey notes	—

C4 — Inventory intake

09:35 · 45 min

Exercise	Task	Finding
C4.1	Review `ckm-intake.xlsx` without Center: row, issue, proposed action, who at Isla answers; note what is already a finding	F03, F08
C4.2	Create Inventory design `Isla CKM intake`, upload the workbook, read the consolidation report: components per layer vs rows vs distinct systems	—
C4.3	Central registry: two entries (full: four) for assets that need an owner or a decision; owner unknown → `unknown — ask <name>`	F02, F03, F07
C4.4 (full)	Estimate the hours to turn the intake into D3, bottom-up per issue type; scale to 30 times the systems	—

C5 — Outside-in view: register versus reality

10:35 · 50 min

Exercise	Task	Finding
C5.1 (full)	Upload `register-flawed.xlsx`: which rows are rejected and why, is the rest accepted? Fix it	—
C5.2	Start a discovery for `isla.edu.eoncore.net` if needed, upload `register.xlsx`, compare registered hosts with Hosts: which external host is missing?	F08
C5.3	Run Crypto posture; list every finding with verdict, severity, subject, evidence; which one not to report yet?	F02, F03, F04, F08, F09
C5.4 (standard, full)	Set a status per finding, name the owner at Isla and the next action; unverified stays `open` with a note	F02, F03, F04, F08, F09

C6 — Verify in the field

11:25 · 35 min

Exercise	Task	Finding
C6.1	3DES check against `pay` (appendix B.1): protocol and cipher; does it confirm the Kartis drift? Which Insights finding matches?	F02
C6.2	TLS 1.0 and 1.2 against `intranet` (appendix B.2), with the TLS 1.0 control on `pay` (B.1b); what does the server say, what was the scan date?	F03, F04
C6.3	Set the `intranet` `weak_tls_version` finding to `false_positive` (leave `cert_expiring` open); add a Labels note (scan date, check, result, initials); leave `pay` open	F04
C6.4 (standard, full)	Two evidence-log lines: command, date and time, result, confirmed / refuted	F02, F04
C6.5 (full)	`testssl.sh -p -W` against `pay`, `-p` against `intranet`: does the second tool agree, what does it add?	F02, F04
C6.6 (full)	After C6.3, open Scorecard and Certificates: what else disappeared? Where must F03 be recorded?	F03, F04

Queries, live checks and templates

Live checks

Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.

B.1 3DES on `pay` (I-M2.3, K-1.6, C6.1)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/null

B.1b Control: can your client speak TLS 1.0? (C6.2, K-1.5, I-M11)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null

Handshake succeeds: your client can test TLS 1.0. no protocols available or a failure before any server answer: your client refuses TLS 1.0, and B.2 proves nothing.

B.2 TLS versions on `intranet` (K-1.5, C6.2, I-M11)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1_2 </dev/null

B.3 Certificate expiry (I-M11, C6)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net </dev/null \
  | openssl x509 -noout -enddate

Record every check you use as evidence: date, command, result.