Time: 60 minutes Outcome: Learners will identify and prioritize security weaknesses in a sanitized configuration excerpt.
Materials
- Fictional configuration sheet
- Risk-ranking cards
- Recommendation template
Safety and Privacy
No live system access is required. The configuration is invented and contains no operational target information.
Activity
The fictional configuration includes:
- Shared administrator account
- Unused account still active
- Logging disabled for account changes
- Overly broad access rule
- Unprotected backup share
- Missing owner and review date
Teams identify evidence, risk, recommendation, operational consequence, test, and rollback for each issue.
Assessment
Use accuracy, prioritization, consideration of operational impact, and verification plan.
Debrief
- Why can a technically stronger setting still create operational risk?
- What should happen before a configuration is changed?
- Which finding should be addressed first, and what evidence supports that decision?