NCCSA case studies
NCCSA · Put your knowledge to work in context.
The NCCSA is an entry-level cybersecurity certification. Its published blueprint is organized into seven domains, each carrying a stated weight: Security Principles and Concepts, Network Security Fundamentals, Endpoint and System Security, Identity and Access Management, Threats, Vulnerabilities, and Risk Management, Security Operations and Incident Response, and Governance, Risk, and Compliance. The NCCSA case studies are 5 cases and about 3,609 words.
1The Unpatchable PACS Host
A 210-bed regional hospital runs its PACS on a Windows Server 2012 R2 host that is years past end of support. The imaging vendor's contract states the application is certified only on that OS build, and an upgrade is scheduled 14 months out.
731 words, about 4 min2One Flat Network and a Vendor Who Wants RDP
A 340-employee freight-forwarding company runs everything on a single flat /16: corporate laptops, warehouse Wi-Fi serving 180 handheld barcode scanners, the WMS application and database servers, and the domain controllers. A penetration test last quarter found SMB signing disabled, LLMNR enabled, and 14-year-old switches with no VLAN support at the two smaller depots.
723 words, about 4 min3Big-Bang Identity Consolidation Before Peak Season
Following an acquisition, Northwind (1,100 staff, identity provider A) now shares a parent with Harrow Logistics (480 staff, identity provider B). Both issue SAML assertions to the same CRM, expense platform and HR system, and 60 percent of Harrow's staff need access to both.
695 words, about 3 min4Three Findings, One Patch Window
The vulnerability management team scanned 2,400 assets and produced 1,900 findings, 61 rated critical. The patch window is four hours on the second Saturday of each month, staffed by two administrators.
740 words, about 4 min502:14 on a Tuesday: LSASS, SMB and a Foreign Logon
At 02:14 on a Tuesday, EDR on an accounts-payable workstation raises a high-severity alert for LSASS access by a signed but unusual binary, followed 90 seconds later by creation of a scheduled task named WinUpdateCheck and outbound SMB to 12 hosts, three of which are file servers holding finance data. At 02:19 the same user account authenticates from an IP in another country.
720 words, about 4 min