Measure your readiness instead of asserting it

short · 50 min · Objective 3.2

Task

Turn the readiness list from the lesson into numbers and dates for your own lab, including the two that most often decide an incident: how far back your logs actually go, and whether a restore has ever been performed.

Steps

  1. Retention, per source. For every log source, find the oldest record actually present. Not the configured policy -- the oldest record.
  2. Telemetry coverage. Hosts reporting, over hosts in the independent inventory from the discovery lab.
  3. Restore test. Back up the collector's data, delete a portion on a snapshotted VM, and restore it. Time it. Record the date.
  4. Backup isolation. Answer honestly: could an attacker with administrative access to the lab reach and destroy the backup? If yes, that is the finding the ransomware lab will make concrete.
  5. Time synchronisation. Compare the clocks on both VMs and the collector. Record the offsets, because a timeline built across hosts that disagree by minutes cannot say what happened first.
  6. Plan availability. Write a one-page response plan for the lab, then confirm you can read it with the collector switched off.
  7. Put all six numbers in one table with today's date. That table is your readiness statement, and every row is a measurement rather than a claim.

Verify

for f in /var/log/collected/*; do printf "%-36s oldest %s\n" "$(basename "$f")" "$(head -1 "$f" | cut -c1-15)"; done
comm -23 /tmp/active.txt /tmp/agents.txt | wc -l
ls -l /tmp/collector-backup.tar.gz && tar -tzf /tmp/collector-backup.tar.gz | wc -l
for h in 10.10.10.10 10.10.10.20; do printf "%s %s\n" "$h" "$(ssh "$h" date -u +%s 2>/dev/null)"; done; date -u +%s

Per-source retention, uncovered hosts, a backup that lists its contents rather than merely existing, and the three clock readings. The clock readings must be within a second or two of each other; anything larger is an offset you must record and correct for in every timeline you build.

Notes

The restore test is the row people skip and the row that decides outcomes. "Backups run nightly" and "a restore completed on the 14th in 22 minutes" are different claims, and only the second is evidence.

Re-run this table monthly. Readiness decays quietly -- a source stops, a credential expires, a clock drifts -- and none of those produces an alert.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.