Everest - SISR, 2025 session

Mission A1 - Authentication audit (Active Directory)

1. Excessive / poorly controlled privileged accounts (administrative group members) → large attack surface across the domain.
2. Weak password policy (old passwords, never expiring, inactive accounts not disabled) → easily compromised accounts.
3. Weak Kerberos / authentication mechanisms (e.g. accounts with delegation, weak encryption, Kerberoasting possible) → credential theft. (Each point is justified using the report score/finding.)

If all machines share the same local administrator account and password, compromising a single workstation (retrieving the hash) allows an attacker to log in as administrator on all other machines (lateral movement, pass-the-hash attack). A single weak link compromises the entire fleet.

LAPS assigns each machine a unique local administrator password, automatically renewed and stored in AD. Settings to configure: enabling password management, complexity (uppercase/lowercase/digits/special characters), sufficient length, lifetime/expiry (regular rotation), and restricting authorised readers (only authorised administrators can read the password). Justification: each workstation has a separate secret → stops lateral movement.

Mission A2 - IPsec VPN interconnection

• Direct Internet access from KliK: lower latency, does not load the VPN link or the Lyon Internet link (better performance).
• Browsing via VPN to Lyon: centralised filtering and control (single secure breakout point, consistent logging and security policy).

a) To control/restrict Internet access: deploy a filtering proxy (allow/block lists) and log activity via the firewall.

b) CNIL recommendation: employee Internet monitoring must remain proportionate, include prior notice to employees (and CSE consultation), and avoid permanent, excessive individual surveillance.

Mission A3 - Network administration (Cisco Meraki)

1. Reliance on the Cisco cloud: administration (and configuration) goes through the Meraki cloud; an outage or compromise of the cloud impacts the management of all devices.
2. External attack surface: configuration data is hosted by the vendor and accessed via the Internet → additional exposure, loss of control compared to an isolated, locally managed device.

According to the CERT-FR alert, exploitation could allow taking control of the device, unauthorised access to the Everest network (pivoting to internal resources), configuration data leaks, and/or a denial of service (loss of Internet access for affected sites).

Mission B1 - Managing risks (Syslog)

a) A replay attack on the log server has significant severity (compromises forensic integrity), but low likelihood if ANSSI recommendations are applied → criticality is assessed using the AFNOR scale by combining these two factors.

b) The resulting AFNOR risk level is moderate (high severity × low likelihood).

Native Syslog (often UDP, plaintext) is vulnerable:

• Log tampering / injection → integrity breach (an attacker can cover their tracks or inject fake events).
• Message loss / flooding → availability impact (missing logs, collector saturated).

Certificates provide:

• authentication (client and log collection server prove their identity);
• confidentiality (logs are encrypted in transit via TLS);
• integrity (any tampering with the stream is detected).

a) If all logs are forwarded: risk of saturation (volume, bandwidth, storage) and noise drowning out important events.

b) If only errors are forwarded: context is lost along with valuable security events (logins, privilege escalations) → blind spots in analysis.

a) Kernel operating error: facility kern (0), severity err (3) → PRI = 0 × 8 + 3 = 3. Selector: kern.err.

b) Privilege escalation (critical security event): facility authpriv (10), severity alert (1) → PRI = 10 × 8 + 1 = 81. Selector: authpriv.alert.

Mission B2 - Log server placement

In Bordeaux: transmitting equipment (devices: firewalls, switches, servers) and a local relay that aggregates and forwards. In Lyon: the central collector (NEPTUNE server) that receives and stores. The relay ensures resilience if the link to Lyon goes down.

Place the collection server in a dedicated VLAN (management/log network), partitioned by filtering: only inbound Syslog (TLS) traffic and secure administration are authorised.

Use source-based filtering (hostname / sender IP address): create a rule (template) sorting each message into a folder by branch according to the source host. Justification: a directory structure by branch simplifies operations and attribution.

a) The monitoring (SIEM) server processes and correlates logs provided by the logging server → they work together (collection ↔ analysis/alerting).

b) Two arguments to separate both functions: security/evidentiary integrity (a dedicated, hardened log server preserves forensic value independently of monitoring) and load balancing (high log volumes → does not degrade monitoring).

On Cisco IOS, a severity strictly below 5 corresponds to warnings (level 4) and below:

configure terminal
 logging host <IP_NEPTUNE>        ! collecteur central à Lyon
 logging trap warnings            ! niveaux 0 à 4 (gravité < 5)
 logging on
end

Mission B3 - Backups

• 2 different media: if one media type is corrupted, the other remains intact.
• 1 off-site copy: protects against a local disaster (fire, theft).
• 1 offline / immutable copy: protects against ransomware (the disconnected backup cannot be encrypted).
• 0: zero errors after a restore test (the backup is verified).

These elements limit the risk of corruption to backup media and ensure reliable restoration.

Logs containing user identifiers, connection timestamps and user actions are personal data: they require a limited and proportionate retention period, notification of individuals (purpose of logging), restricted and secure access, and data minimisation.