GROUP ACTIVITY: Zero Hour at HealthOne – Scan or Be Hacked
Time: 60 minutes
Team size: 4 students
Format: Scenario-based investigation + decision-making + group report
Objective: Apply vulnerability scanning methods, evaluate compliance risks (PCI-DSS,
GDPR), and recommend mitigation steps using CySA+ Lesson 5 principles.
SCENARIO
HealthOne, a private hospital group operating across Southeast Asia, just discovered
suspicious activity on its internal network.
Billing systems were offline for 2 hours
Unauthorized access was detected to patient records
Unusual CPU spikes and traffic to unknown IPs were reported
The company is undergoing a PCI-DSS and GDPR compliance audit
Their infrastructure includes:
o SCADA-connected lab equipment
o Legacy Windows Server 2012 systems
o A partially migrated multi-cloud environment (AWS + Azure)
The CIO must testify before a government hearing in 90 minutes. Your team—the
Emergency Threat Assessment Unit—must deliver a credible, well-reasoned incident
analysis and scanning strategy within 60 minutes.
PHASE 1 – SCANNING STRATEGY (20 MINUTES)
Objective: Choose the right scanning approaches for the environment.
Given infrastructure:
Legacy patient billing servers (Windows Server 2012)
SCADA lab systems
Multi-cloud patient data storage
Endpoints with CPU spikes
BYOD tablets used by doctors
Network segmentation unknown
Your tasks (discuss and write your decisions):
1. Identify which scan types you would use for each asset group (credentialed,
non-credentialed, agent-based, passive, etc.)
2. Which systems must be scanned first (triage order)
3. Which systems must not be scanned with active tools, and why
Checkpoint Questions:
Which scan type would expose unpatched SCADA vulnerabilities safely?
How would you detect lateral movement to cloud resources?
What scan method gives you visibility into BYOD device security?
PHASE 2 – COMPLIANCE IMPACT (15 MINUTES)
Objective: Identify how PCI-DSS and GDPR apply and what scanning or controls are
required to meet them.
Assume:
3TB of patient data is stored across hybrid cloud
Credit card info used in billing system
Systems haven’t undergone a credentialed scan in 45 days
There’s no record of patch baseline comparison in the last 60 days
DNS logs show TXT record abuse to external IPs
Your tasks:
1. Identify which requirements of GDPR and PCI-DSS were likely violated
2. Match each to a specific scanning or logging gap
3. List 2 compliance artifacts you'd need to show auditors (e.g., vulnerability
reports, system hardening logs, etc.)
Checkpoint Questions:
What does PCI-DSS say about patch timelines?
Which scan outputs can help prove GDPR accountability?
What control type (technical, operational, managerial) failed?
PHASE 3 – MITIGATION & REPORTING PLAN (20 MINUTES)
Objective: Propose a credible path to containment and recovery.
Assume:
The attacker exploited a forgotten web application running on the same subnet
as billing
SIEM logs were misconfigured and missed the early activity
Antivirus failed to detect the reverse shell
DNS exfiltration succeeded due to weak egress controls
Your tasks:
1. Create a step-by-step containment plan (for next 24 hours)
2. Recommend at least:
o One new scanning schedule or policy
o One hardening or patch baseline approach
o One technical control to reduce future attack surface
Checkpoint Questions:
What scanning schedule should be applied to legacy servers?
How would you baseline the lab network without risking device failure?
What scanning limitation delayed detection in this case?
FINAL REPORT (5 MINUTES)
Prepare a 5-minute verbal or written debrief with:
Your timeline of the attack
The root cause
3 scanning or control failures
3 fixes you propose
Which compliance requirements were at risk
OPTIONAL TWIST
One of the doctors' tablets was jailbroken and used to pivot into the SCADA subnet.
Prove whether this was the original entry point, or a distraction. Back it with scanning or
logging evidence you'd expect to see.
KEY LEARNING OUTCOMES
Apply the right vulnerability scanning techniques
Understand how compliance standards influence security controls
Link technical symptoms to control and scanning failures
Recommend realistic mitigation steps using CySA+ knowledge
