Root Cause

A cyber incident investigation for Year 12/13 students University of Bradford · School of Computing and Engineering

Root Cause is an outreach activity that runs entirely in a web browser. It comes in two versions: the full version (one hour) and Root Cause Express (35–40 minutes). Students work in teams as an incident response unit. Their task is to find out how a fictional haulage firm, Tarn Valley Freight, lost £48,200 to a cyber attack, and to stop the attacker striking again.

What students do

The investigation has nine stages. Each stage uncovers the next part of the story and introduces a different area of computing:

Stage	Topic
1. Initial access	Phishing analysis
2. Sign-in trail	Log analysis and multi-factor authentication
3. Timeline	Digital forensics
4. The attacker's notes	Cryptography (Base64, Caesar and Vigenère ciphers)
5. How it was possible	Secure code review
6. Password vault	Hashing, salting and password strength
7. Close the door	Firewall rules
8. Catch it next time	Machine learning for attack detection
9. Respond	Incident response planning

Root Cause Express uses five of these stages (1, 2, 4, 5 and 8), covering phishing, log analysis, cryptography, secure code and machine learning.

Teams earn up to 100 points per stage. Hints and wrong answers cost points. When a team finishes, the final report screen gives them a code to hand to the facilitator for the leaderboard. It then links each stage to real careers and to computing degrees at the University of Bradford.

Running a session

• Audience: A-level or equivalent students (Year 12/13).
• Group size: 30–60 students, in teams of 3–5.
• Time: full version about 60 minutes (45 minutes of mission time); Express 35–40 minutes (25 minutes of mission time). Both include a short brief and debrief.
• Equipment: one laptop or tablet per team, plus a projector for the facilitator. Nothing needs to be installed and no logins are required.

Links

• Students, full version: the GitHub Pages URL for this repo.
• Students, Express: the same URL with short.html added to the end.
• Facilitator: the same URL with facilitator.html added to the end. Choose Full or Express on the Projector tab to set the countdown, run sheet and debrief prompts.

Notes

• Everything runs in the browser. No personal data is collected, and progress is saved only on each team's own device.
• The company and people are fictional. Every address uses the reserved .example domain and IP addresses reserved for documentation.
• Answers are stored in scrambled form. The answer key is not included in this repository.
• University details, courses and the countdown lengths can be changed in the CONFIG block at the top of the script in each page.

Contact

School of Computing and Engineering, University of Bradford