System Portal Access
Yourname@safestart.orgPhillyTechWeekYour systems are encrypted and we have your data. Pay $15,000 in Bitcoin within 2 hours or it leaks.
⏰ TIME REMAINING: 02:00:00
📦 IT notice: off-site backups are intact. A read-only forensic environment is up for investigation.
💡 Prove how we got in — rebuild the attack timeline and IR plan — and we'll hand over the key for free.
Access forensic systems to investigate:
Incident ID: 2026-03-24-RANSOMWARE | ⚠️ Systems Encrypted | ⏰ 02:00:00
Mission: Prove you understand the attack by building the complete timeline and submitting an incident response plan
Systems restored from backup. Email archive accessible for investigation.
Read-only forensic snapshot. Navigate and investigate system files.
Complete list of system accounts and permissions at time of breach.
🔍 Your Task:
Click on any user accounts that look suspicious to you. You'll be asked to identify what makes them suspicious.
Note: Too many incorrect guesses will reduce your points. Use the terminal to help you complete this section.
| Username | Full Name | Role | Permissions | Last Login | IP Address | MFA |
|---|
Drag events into the correct chronological order. You must investigate emails, logs, and user data to determine when each event occurred.
Use this space to organize your findings before building the timeline:
Based on your investigation, select the best incident response plan.
🔒 TIMELINE + REFLECTION REQUIRED
Complete the Attack Timeline first, then answer the Reflection Questions. Once both are done, you can submit your incident response plan.
Three questions to wrap up the investigation. 15 points each.
Total Points
Discuss these with your team — there are no wrong answers here, just honest conversation about what you'd take back to your own work, training program, or organization.
1. The cheapest fix
Which single control would have probably stopped this attack cold? (Hint: it's not the most expensive one.) Would the organizations you work for, volunteer with, or learn at have it in place?
2. Least Privilege in action
A volunteer at SafeStart was given full admin rights "temporarily" and it was never revoked. How did ignoring the principle of Least Privilege directly harm the organization in this attack? Where could "temporary" access be lingering in places you know?
3. The first 30 minutes
Whether at a job, workforce training program, club, or volunteer role: if you discovered a cyber incident right now, who would you tell first? Would they know what to do?
4. Making the case
If you had to convince a small-business owner or a workforce training program administrator to spend $500 this quarter on cybersecurity, what would you tell them based on what you saw today?