SSCP case studies
SSCP · Put your knowledge to work in context.
The SSCP (Systems Security Certified Practitioner) is ISC2's certification for hands-on security operations professionals - ISC2 markets it as "The Premier Security Administrator Certification." Unlike entry-level credentials that test foundational knowledge, the SSCP is built to validate operational capability: the demonstrated ability to implement, monitor and administer IT infrastructure using cybersecurity best practices, respond to incidents, and keep security infrastructure in a ready state. ISC2 states that candidates should have at least one year of work experience in security operations, and positions the credential for roles such as network security engineer, systems administrator, security analyst, systems engineer, security administrator, security consultant/specialist, and systems/network analyst. The SSCP case studies are 5 cases and about 2,311 words.
1Shared Admin Credential at a 120-Person Firm
A 120-employee logistics company has 18 contractors who rotate monthly. The help desk uses one shared local administrator account, "admin2," to fix workstation issues; its password is stored in a ticket template visible to all 11 help-desk staff.
457 words, about 2 min2Ransomware on a Backup-Connected File Server
At 02:14, EDR alerts on a file server encrypting documents at a small manufacturer. The backup NAS is mounted as a drive on that server, and the last nightly backup completed 26 hours ago.
469 words, about 2 min3Legacy Encryption and Key Management in a Retail Tax System
A retailer's tax-reporting application stores 1.2 million customer Social Security numbers in a database encrypted with AES-128. The key is in a plaintext configuration file on the application server and is the same for production and test.
465 words, about 2 min4Flat Branch Network with Guest Wi-Fi and Split-Tunnel VPN
A 60-person branch office uses one flat /24 subnet for point-of-sale terminals, VoIP phones, employee laptops, and a guest Wi-Fi network. The guest Wi-Fi password is posted at reception and has not changed in two years.
468 words, about 2 min5Alert Fatigue at a Two-Analyst Security Operation
A managed security provider sends about 5,000 alerts per day to an internal team of two analysts. Roughly 40% are duplicates from a recurring vulnerability scanner, and the critical-asset inventory is incomplete.
452 words, about 2 min