6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue

Security operations work is easier to explain when you start with three properties every defender is paid to protect. Those properties are the CIA triad: confidentiality, integrity, and availability. This independent study section covers CIA, least privilege, human factors, modern cybersecurity trends, and two major vulnerabilities named in SAL1 training content—Log4Shell (CVE-2021-44228) and EternalBlue (MS17-010 / SMB). The goal is analyst judgment: what broke, which property is at risk, and which artefacts belong in a case note. It is not exploit development.

The CIA triad with SOC examples

A SOC ticket is rarely labelled "CIA." You still have to name the property in the case, because containment and reporting change with the property at risk.

Confidentiality

Confidentiality is the property that information is readable only by authorized people and processes. A stolen session cookie, an open cloud bucket, a mailbox forwarding rule to a personal address, or a USB copy of a customer export are confidentiality failures. On an analyst shift, the questions are concrete: who accessed this file share in the last 24 hours, which API key sat in that Git commit, and whether the data that left was regulated. Identity telemetry (directory sign-ins, MFA events, OAuth grants) often answers confidentiality questions faster than a packet capture.

Integrity of logs

Integrity is the property that data and systems remain accurate and unaltered except by authorized change. If ransomware encrypts a file, integrity of business data is obviously broken. If an attacker clears Windows Security logs (Event ID 1102) or stops Sysmon, integrity of evidence is broken even when business files still look fine. Integrity of logs is a SOC requirement because your case report, your escalation, and any later review depend on trustworthy telemetry. Time-synced clocks, restricted SIEM admin roles, write-once log storage, and alerts on log-clearing events exist to protect that integrity. When you see a gap in the timeline, write the gap down. Do not invent the missing hours.

Integrity also covers silent tampering: a changed scheduled-task action, a swapped binary with a new hash, or fake events injected into a weakly authenticated syslog feed. If you cannot trust the evidence, say so explicitly in the ticket. That sentence is often more valuable than a confident but undefended timeline.

Availability of the SIEM

Availability is the property that systems remain usable when needed. Ransomware, DDoS, and a deleted production database are classic examples. For a security analyst, availability of the SIEM (Security Information and Event Management) platform is equally in scope. If forwarders stop, the license caps ingestion, a parser drops a sourcetype, or indexers fill their disks, you cannot detect or investigate. A quiet night might be a telemetry outage, not a safe network. Treat collector health, indexing lag, and dropped events as availability incidents for the SOC itself.

One ticket can wound more than one property. Credential phishing that leads to ransomware is confidentiality (stolen secrets) plus availability (encrypted shares), and it becomes an integrity problem if the attacker also tampers with logs.

Least privilege

Least privilege means each identity, service, and process receives only the rights required to do its job. A payroll clerk does not need Domain Admin. A Java application pool does not need to run as SYSTEM. A Tier-1 analyst should search and comment in the SIEM, not delete indexes or push unreviewed production detections.

Least privilege is a blast-radius control. Log4Shell was worse in shops where the vulnerable Java process could reach the internet and write files as a privileged user. EternalBlue spread farther on networks where everyone ran as local administrator and SMBv1 was everywhere. The bug opened a door; privilege decided how many rooms the intruder could walk through.

When you triage, record the privilege context next to the process name. "PowerShell.exe started" is incomplete. "PowerShell.exe started as SYSTEM after a service modification" is an escalation-ready sentence. Ask:

• What account ran the command?
• Is that account a human, a service, or a machine identity?
• Does the account have rights it never needs (interactive logon, debug privilege, unconstrained Kerberos delegation)?
• Would the same action have failed under a normal user?

Recommendations that belong in a ticket without turning you into a Windows engineer: separate admin and daily-driver accounts, remove local admin from standard workstations, use just-in-time privileged access, and monitor unexpected privilege-group changes.

Human factors and phishing as a CIA event

Human factors are the ways people become the path around technical controls: rushed clicks, reused passwords, approve taps on MFA fatigue prompts, over-helpful password resets, and exception processes that skip verification. SAL1 training content treats this as core security material because so many real intrusions start with a person, not with a protocol exploit.

Phishing is the worked example. A convincing invoice can steal credentials (confidentiality), trick someone into enabling a macro that changes files or mail rules (integrity), and set up ransomware that takes the file server offline (availability). The same human action therefore maps to the whole triad. Later chapters cover header analysis and email authentication. Here you only need the model: when a user reports "I clicked," start with which CIA properties are now in play and whether least privilege would have contained the click (for example, a user without local admin cannot silently install a kernel driver).

Other human-factor patterns in tickets include USB drops, vishing against the help desk, and a shared "team password" in chat. MFA, phishing-resistant authentication, and verified callback procedures are still CIA controls. They protect confidentiality of accounts, integrity of identity, and availability of the business that depends on those accounts.

Modern cybersecurity trends

Trends that change what a new analyst sees, without requiring you to chase every vendor slogan:

1. Identity-first attacks. Valid usernames plus stolen or prompted MFA often replace "exploit the VPN appliance" as the first step. Identity logs belong in the first hour of triage.
2. Living-off-the-land binaries and scripts (LOLBAS). Attackers reuse PowerShell, WMI, scheduled tasks, and signed operating-system tools so they look like administration.
3. Library and supply-chain risk. Log4Shell taught the industry that a logging dependency can become remote code execution. Expect vulnerable-component tickets that never touch port 445.
4. Hybrid telemetry gaps. Data can leave through a cloud API that never hits the on-premises proxy. Availability of cloud audit logs is part of CIA.
5. Double extortion. Availability attacks (encryption) often follow a confidentiality stage (data theft). Name both in the report.

These trends explain why two well-known CVEs remain in training labs: they still illustrate remote code execution, unpatched estates, and the difference between application-layer artefacts and network-protocol artefacts.

Log4Shell (CVE-2021-44228)

Log4Shell is the common name for CVE-2021-44228, a critical remote code execution weakness in Apache Log4j 2, a Java logging library embedded in a huge number of products. In December 2021 it became clear that a crafted string, once logged by a vulnerable application, could cause a JNDI (Java Naming and Directory Interface) lookup. The Java process would contact an attacker-controlled directory service (commonly LDAP or RMI) and could then load attacker-controlled classes.

Analysts do not need a proof of concept. They need a reliable story and artefacts:

• What it is: untrusted input (a username, User-Agent, chat message, or form field) is logged; Log4j interpolates a JNDI pattern and performs a network lookup.
• Typical artefacts: request headers or usernames containing a ${jndi: pattern; outbound LDAP/RMI from a Java process to an unusual host or port; the Java process spawning a shell or a download utility; WAF/IDS hits for JNDI lookup strings; follow-on malware, miners, or webshells on the application host.
• CIA impact: confidentiality of anything that process can read; integrity if webshells are planted; availability if miners or ransomware follow.
• Why labs still use it: it is a clean lesson in "data in a log becomes a code path," in third-party library risk, and in catching outbound callbacks from servers that should only speak HTTPS to known APIs. Nested Java applications were patched slowly, so the CVE still appears in scanners and in retro hunts.

Trap: internet-wide scanners spray JNDI strings constantly. A WAF hit alone is not proof of compromise. Look for a matching outbound connection, a suspicious child process, or a host change before you call it a true positive.

EternalBlue (MS17-010 / SMB)

EternalBlue is the public name for an exploit against a flaw in Microsoft SMBv1, addressed by bulletin MS17-010 in March 2017. After the Shadow Brokers leak, the technique was used in the WannaCry and NotPetya outbreaks. It allowed remote code execution on unpatched Windows systems by sending specially crafted SMBv1 traffic, typically toward TCP port 445.

Stay on the analyst side of the line:

• What it is: a memory-safety failure in SMBv1 that let a remote attacker run code with high privilege on unpatched hosts.
• Typical artefacts: inbound SMB from unexpected sources; host crashes or instability around the SMB service; worm-like east-west 445 traffic; historical WannaCry ransom notes on old lab images; IDS signatures labelled EternalBlue or MS17-010; no prior valid credential use for that jump.
• CIA impact: 2017 was dominated by availability (worm plus ransomware). Confidentiality and integrity follow because SYSTEM-level code can dump credentials and alter logs.
• Why labs still use it: it teaches wormable protocol bugs, the cost of leaving SMBv1 enabled, patch latency, and how a network artefact (SMB exploit traffic) differs from a web or application artefact (Log4Shell strings). Isolated labs still keep unpatched Windows targets on purpose.

Hardening language that belongs in a ticket: disable SMBv1, apply MS17-010 and later cumulative updates, segment port 445, and alert on unusual workstation-to-workstation SMB. None of that requires reproducing the exploit.

Comparing the two named vulnerabilities

Neither story is finished on the public internet. Your job is to recognize the class of evidence, the CIA properties at risk, and whether privilege made the incident larger—not to rebuild attack tooling.