Saint-Jacques - SISR, November 2023 session

Mission A1 - Network access verification

The public accesses applications reserved for them via two channels (docs 3 and 6):

• Remotely, via the town hall's web portal (saintjacques.fr), from any device: checking school canteen menus, extracurricular registration/payments, grant applications, public directory, etc.
• On site, via workstations provided for the public on the premises (media library: 4 workstations, CCAS: 2, EHPAD: 2...), connected to the public VLAN, and via open Wi-Fi access points WF-SPEC and WF-MEDIAT.

1. Credential theft or impersonation (weak password, phishing, sticky note) enabling a legitimate session to be opened.
2. Physical access to an unlocked workstation or an active session left open, or plugging into an accessible network socket (reception, public room).
3. Pivoting from the public network to the town hall VLAN in the event of flawed segmentation (see A1.3), or via a poorly isolated open Wi-Fi access point.

VLAN assignment relies on the network card's MAC address. However, a MAC address:

• is not a secret: it travels in clear text across the network and can be intercepted (sniffing);
• is easily spoofed (MAC spoofing): any system allows it to be rewritten in a few seconds.

An attacker copies the MAC address of an authorised workstation and thereby switches into the town hall VLAN - exactly what happened with the 'Hacked by K' workstation in the media library, which was able to print via the internal VLAN. This membership criterion authenticates neither the workstation nor the user.

Implement port-based access control using 802.1X authentication (switches are already Layer 3, hence compatible). The workstation (or user) must authenticate to the switch via EAP / RADIUS server before gaining access; VLAN assignment becomes dynamic based on validated identity rather than a spoofable MAC address. In the absence of RADIUS, security can be reinforced using port-security (locking a learned MAC per port + disabling the port if an anomaly occurs), but 802.1X remains the robust response without additional hardware.

Mission A2 - Crisis infrastructure verification

No. Replication faithfully copies the source state, including corruptions: deletion, corruption, ransomware encryption, or human error are replicated immediately to the disaster recovery site. It ensures availability (failover in the event of a site hardware failure), not historical integrity. Only a versioned backup retained over time allows recovery to a prior healthy state.

Criterion	Reconfigured media library workstations	Dedicated workstations (backup technical room)
Availability / speed	Manual reconfiguration (VLAN change), delay during an active crisis	Immediately ready, preconfigured, and hardened
Security	Exposed public workstations (open Wi-Fi, malware, MAC spoofing - see A1) → high risk	Isolated from the public, hardened, up to date → controlled risk
Cost	Low (pooling existing hardware)	Higher (tied-up workstations, maintenance)

Conclusion: dedicated workstations should be prioritised for critical services; the media library solution is merely a cost-effective but insecure stopgap.

1. Incomplete scope: the NAS-VIDEO (video surveillance) is not replicated even though these files are critical in a legal investigation → permanent loss in the event of a disaster at the main site. School files are only replicated every six months → loss of several months of data.
2. Inconsistent frequencies: VMs are only replicated once a week (Sunday) while SAN-1 is replicated in real time → failover could switch to week-old VMs pointing to current data: application inconsistency, or even downtime when restarting critical services (civil registry, payment orders, payroll).

No. Doc. A1 indicates that only one full backup (the latest) remains available on SAN-2. However, the attack described was only discovered 3 days after the fraudulent modification: if the clean backup had been overwritten in the meantime, recovery would have been impossible. Multiple generations must be kept (retention): for example, a GFS strategy (daily over 7-14 days, weekly over 4-5 weeks, monthly over 12 months), easily covering a detection window of several days.

The town hall is a data controller under the GDPR:

• Storage limitation: data is only kept for as long as necessary, with retention periods recorded in the register of processing activities maintained by the DPO (active database → intermediate archiving → deletion).
• Appropriate security: technical and organisational measures protecting against destruction, loss, alteration, or unauthorised access, proportionate to the nature of the data (municipal police ≠ a newsletter).
• Right of access: provide all data relating to an individual, whether active or archived.
• Traceability: any access to the archives must be logged.

Implement an external off-site backup following the 3-2-1 rule (3 copies, 2 media types, 1 off-site). In practice: an offline/immutable copy (LTO tapes removed from the rack and stored off-site, or immutable WORM object storage with a GDPR-compliant sovereign hosting provider). Being disconnected from the network, it remains out of reach of an attack encrypting SAN-1 and SAN-2 simultaneously.

Recommend a second backup link, physically separate from the first. The town hall already operates radio frequency links (doc. 5: 64 Mb/s care home link, 32 Mb/s recreation centre link): a point-to-point wireless link between the two sites provides an alternative path bypassing the vulnerable technical cabinet, and an ADSL/SDSL connection from a separate ISP provides backup internet access to the backup site. This achieves both inter-site redundancy and internet connectivity.

Mission A3 - Availability of external links

a) Objective: render a service unavailable by saturating it. Principle: an attacker controls a botnet (distributed compromised machines) that simultaneously sends a massive volume of requests/packets (SYN flood, UDP flood, HTTP requests...) until the target's bandwidth or resources (CPU, connection table) are exhausted.

b) A firewall is not enough: it can filter and rate-limit certain traffic, but it has its own throughput and session limits and sits inline; a volumetric attack will saturate its upstream link (the ISP link) before its rules apply, or exhaust its state table. Effective protection must be upstream: carrier/ISP anti-DDoS, scrubbing, CDN/load balancing, and rate limiting. The firewall is a complementary component, not a fully sufficient countermeasure.

1. Preparation: test outside production (staging environment/maintenance window), define the success criteria (active/passive failover with no noticeable interruption), and notify stakeholders.
2. Failover test: simulate the failure of the active firewall (shutdown/unplugging) and verify that the passive unit takes over automatically, maintaining active sessions.
3. Controlled DDoS simulation: generate controlled attack traffic (hping3, or a stress tool in an isolated lab) towards a test IP and observe cluster resilience (monitoring, Stormshield logs).
4. Measurement & reporting: record availability, failover time, and packet loss; return to nominal state and document the results.

Mission B1 - Protection against ransomware

Any device running code and accessing files: staff workstations and public terminals, virtualisation servers (SRV-HYPERV1→4) and their VMs, file servers, NAS devices (NAS-ECOLES, NAS-VIDEO), SAN-1/SAN-2 via network shares, as well as removable media (USB drives). Any mounted/shared network volume is a propagation target.

• Town hall staff: unavailability of business applications (civil registry, payment orders, payroll), lasting up to a week during the 2nd attack, and loss of work in progress.
• Local residents / the public: inability to obtain official certificates, pay for after-school care, or access online services; potential breach of their personal data.
• IT department / management: remediation workload (isolation, recovery), reputational damage to the local authority, legal and financial risk.

1. Disable Autorun/Autoplay and block/control USB ports via policy (GPO, blocking unapproved storage devices).
2. Up-to-date antivirus/EDR with automatic scanning of all removable media before access.
3. Awareness training: ban the use of external USB drives and provide decontamination stations (isolated scanning kiosks checking media before transfer).

1. Email filtering (anti-spam/anti-phishing, URL rewriting and analysis, attachment sandboxing).
2. Web / proxy filtering blocking malicious domains (see B1.6) and EDR detecting attack tools (CobaltStrike, Mimikatz...).
3. Network segmentation + least privilege to limit lateral movement once a workstation is compromised.

a) Process:

• In the event of a breach, the data controller notifies the CNIL within 72 hours of becoming aware of it (unless there is an unlikely risk to rights and freedoms).
• If the breach creates a high risk, they must also inform the affected individuals (local residents) without undue delay.
• The breach is recorded in an internal breach register.

b) Objective for each stakeholder:

• CNIL: enable oversight and, where appropriate, guidance or sanctions; verify the adequacy of measures.
• Affected individuals: enable them to protect themselves (change their passwords, monitor for fraudulent use of their data).
• Town hall: demonstrate compliance and limit its liability.

Deploy a web filtering proxy server with whitelisting/blacklisting by URL category. Principle: all HTTP/HTTPS requests from workstations pass through the proxy, which compares the requested URL/domain against a reputation database and allows or blocks it according to policy (category, reputation). This can be supplemented with DNS filtering (blocking resolution of malicious domains), directly applicable on the Stormshield UTM firewall (built-in URL filtering).

Mission B2 - Securing inter-site links

For decision-makers, an IPSec VPN tunnel provides:

• Confidentiality: data exchanged between sites is encrypted (unreadable if intercepted);
• Integrity: any alteration of packets in transit is detected;
• Authentication: only legitimate gateways (certificates/PSK) establish the tunnel;
• Anti-replay: an attacker cannot replay previously captured packets.

In phase 2, two unidirectional channels are opened, each with its own key: ESP-SA1 and ESP-SA2 (IKEv1) / CHILD-SA1 and CHILD-SA2 (IKEv2). Each endpoint holds both keys: one to encrypt what it sends, the other to decrypt what it receives.

   PARE-FEU mairie (A)                            PARE-FEU site secours (B)
   ┌──────────────────┐                           ┌──────────────────┐
   │  chiffre avec     │ ── ESP-SA1 (sens A→B) ──▶ │  déchiffre avec   │
   │     ESP-SA1       │                           │     ESP-SA1       │
   │                   │ ◀── ESP-SA2 (sens B→A) ── │  chiffre avec     │
   │  déchiffre avec   │                           │     ESP-SA2       │
   │     ESP-SA2       │                           │                   │
   └──────────────────┘                           └──────────────────┘

• A → B: A encrypts with ESP-SA1, B decrypts with ESP-SA1.
• B → A: B encrypts with ESP-SA2, A decrypts with ESP-SA2.

The same key is therefore used for encryption at one end and decryption at the other (symmetric encryption), but one direction = one dedicated key, which isolates both streams.

a) Purpose of a PKI: guarantee the authenticity of a public key by issuing certificates signed by a trusted certificate authority (CA), and manage their lifecycle (issuance, distribution, revocation). Trust in the CA underpins authentication reliability (doc. B2/B3).

b) Why PKI rather than PSK (ANSSI recommendations, doc. B3):

• Rapid revocation of a compromised key (e.g. a stolen workstation) without needing to reconfigure every device;
• Simplified host addition/removal (no need to redeploy a secret everywhere);
• No single shared secret whose leak would compromise the entire fleet;
• PSK should be reserved for testing/diagnostics; a length under 100 bits is considered risky. For a production system, PKI is best practice.

Mission B3 - Implementing remote working

Restrict users Denis Barbier and Bruno Paillard to https://collab.saintjacques.fr only. The overly permissive rule must be replaced with an explicit and restrictive rule:

• Source: remote users Denis Barbier and Bruno Paillard (via the remote-access VPN tunnel);
• Destination: object collab.saintjacques.fr (Nextcloud server in DMZ);
• Service: HTTPS (TCP 443) only;
• Action: allow.

Then, in accordance with the default deny principle, remove or demote any broader rule allowing these users to other destinations, so that all other traffic is denied.

VPN authentication relies on a device-specific certificate (private key), rather than a simple shared secret. If the laptop is stolen, the administrator immediately revokes the certificate (published via CRL/OCSP): the firewall rejects any connection attempt presenting this revoked certificate, without needing to reconfigure other equipment or change a shared secret. Access from the stolen device is neutralised immediately and in a targeted manner.