Leader track 🛡️ · six sessions, no SQL
For whoever funds security and signs the questionnaire. What is worth stealing, which of the six functions get starved, and the three numbers that replace a control count.
The attacker's view of a warehouse
What is worth the trip, the three doors every path goes through, and why a control list coexisted with nine open paths at Ironwood.
🧭 Leader session 2Six functions, one estate
NIST CSF 2.0's Govern, Identify, Protect, Detect, Respond and Recover on a data estate, and why two of the six get no money.
⛓️ Leader session 3The kill chain through a data stack
ATT&CK version 19.2's fifteen tactics mapped onto warehouse events, and which stages you would actually see.
🗄️ Leader session 4Backups are attack surface too
Time travel goes with the account. Immutable, restore-tested copies, and the Monday question answered with a date.
👁️ Leader session 5Detect what you cannot prevent
What the audit log sees and misses, the export bucket that never touches the warehouse, and undetected paths from three to zero.
⏱️ Leader session 6The first hour, and the report
Containment decisions, who to tell, what to fund, and the questionnaire answer rewritten as three numbers.
Builder track 🔧 · eight sessions, one defended graph
One estate, Ironwood's warehouse, inventoried and defended control by control. Session 8 counts every path that remains and every one that crosses no log.
Attack-surface inventory of one warehouse
Five lanes, nodes and edges, three doors, and Ironwood's nine baseline paths written down as a file.
🔑 Builder session 2Credential paths
Keys in git history, phished logins, the Friday admin grant. MFA takes nine paths to six; rotation to five.
🪣 Builder session 3Misconfiguration
Public buckets, open shares, permissive network policy. The private export bucket takes five paths to four.
📦 Builder session 4Supply chain in the data stack
Packages, dbt packages, connectors and the CI runner that holds the ETL key. Pinning takes four paths to three.
📤 Builder session 5Exfiltration detection
Query history and egress logs, COPY INTO an external stage, and the alert that makes a read visible without blocking it.
🧯 Builder session 6Destructive events
Immutable backups and restore drills. Recoverable tables from zero to twelve with the path count unchanged.
🔬 Builder session 7Detection engineering
Turning ATT&CK techniques into log queries. Undetected paths from three to zero.
🎛️ Builder session 8The attack-path bench
Nine paths to one, the firewall that closes one door, and prevention without detection.
Choose your path 🗺️
Three doors into the same defended graph. Both tracks start at their own session 1.
Your passport 🎫
Clear all three quiz questions in a session and it gets stamped. Fourteen stamps across both tracks, and they live in this browser only.
What is real here 🧾
A course about defence should be exact about which of its own numbers are counted.
| Claim | Status |
|---|---|
| Ironwood's estate | A written inventory of twelve nodes and the edges an attacker could use, each with the control that closes it or the log that sees it. Visible on the bench as the paths themselves |
| Nine paths, all undetected, backups reachable | A real path enumeration from the internet and from an insider, with the warehouse-to-table edge role-aware so a path only counts if it arrived through a role that can read the table |
| The ladder: 9, 6, 5, 4, 3, 3, 3, 1 | Computed in the browser as controls remove edges. Logging takes undetected 3 to 0 and immutable backups take recoverable 0 to 12 with the path count unchanged, which is the point of those two rungs |
| Perimeter firewall only: 7 paths, 7 undetected, 0 recoverable | Arithmetic. The allowlist closes a leaked key used from outside and nothing else |
| The one remaining path | The insider's own legitimate support session. No control removes it without stopping the work; it is logged |
| Nothing on the bench is modelled | Every number is a count over the graph. There is no human behaviour to estimate |
| NIST CSF 2.0 and ATT&CK v19.2 | Six functions and their descriptions extracted from the CSF 2.0 PDF (26 February 2024); fifteen tactic IDs and names read from the ATT&CK site, including the v19 split of Defense Evasion into Stealth and Defense Impairment |
| Defensive throughout | Every page stops at the door, the control and the log. No exploitation steps or tooling anywhere |
| Ironwood | A fictional mid-size retailer. The paths are ordinary ones; the company is not real |
The knowledge map 🧠
Both tracks at a glance - hover a session to spotlight its concepts, click any node to jump in.