✳ Learn / Thirty days to Halcyon
Case file
Meridian launches Halcyon in thirty days, and the board will not say go until every case is closed. Each lesson you pass adds one entry here. There are 68 entries in 11 cases.
Launch readiness board
Pass a lesson's closing question to earn your first entry.
Case 1 of 11 · 16 entries to find
Four seconds at 03:12
Why did the antenna move?
Path: Cybersecurity foundations
Episode 1
Assets and the CIA triadFour seconds, nobody's order
At 03:12 the Station North antenna sat two degrees off target for four seconds with no order on record, so name the asset first, then how it failed.
Not found yet.
Episode 2
Threat, vulnerability, and riskNot a glitch
A shared maintenance password exists on Station North, so someone other than its owner could have sent the command.
Not found yet.
Episode 3
How one request crosses the networkA hop off the diagram
Walking the four steps in order showed the 03:12 command reaching the controller from
10., not through the command gateway on the diagram.4. 0. 77 Not found yet.
Episode 4 · side episode
The first hop: ARP and DHCPAn address with no owner
10.held a valid lease on Station North, and a lease proves only that something asked for an address, not what it was.4. 0. 77 Not found yet.
Episode 5 · side episode
Three packets to open a roadA real address at 03:11
The 03:11:52 handshake completed, so a machine that could receive replies at
10.opened the connection, whoever was using it.4. 0. 77 Not found yet.
Episode 6 · side episode
Two sides, one secret: the TLS handshakeEncrypted is not authorized
The 03:11 session was encrypted and reached the real server, but TLS does not say who sent the command or whether they were allowed to.
Not found yet.
Episode 7
Identity, proof, permission, and recoveryA password, not a person
The 03:12 command came from
maintwith the correct password, but four people share that account, so the login proves a password and not a person.Not found yet.
Episode 8 · side episode
Phishing and social engineering under pressureThe helpful call
The service desk call was real, but the contractor could not check that, so a stranger with the same script would have got the same answer.
Not found yet.
Episode 9 · side episode
Roll out DMARC: monitor, fix, then enforceWatch before you block
Meridian's mail policy went to
p=nonewith reports, because enforcing before you know your senders drops real mail.Not found yet.
Episode 10
Logs, alerts, and evidenceThree clocks, one timeline
Corrected for clock drift, the connection, the
maintlogin, and the command fall within eight seconds, so cross-check sources before believing any single log.Not found yet.
Episode 11
Least privilege and layered defensesCould steer, needed to read
The
maintaccount only ever needed to read temperature, but it held station admin, so one shared password was enough to steer the antenna.Not found yet.
Episode 12
Trust boundaries: the server decidesThe server never asked
The control application hid the Steer button from maintenance, but its server accepted any command that came from inside Station North.
Not found yet.
Episode 13
Encryption is not a backupEncrypted is not recoverable
Station North's telemetry was encrypted and replicated, but the one copy nobody could delete had never been restored until today.
Not found yet.
Episode 14
What you still own in the cloudRented building, our door
The provider secured the building, but the policy on the telemetry archive was Meridian's own, and it let anyone read.
Not found yet.
Episode 15
Outcomes first, then controlsThree ordinary gaps
The antenna moved because of a contractor's laptop, a shared password, and a flat network, so the board got three outcomes with owners and dates.
Not found yet.
Episode 16 · side episode
Product categories are capabilities, not outcomesA label is not coverage
The vendor's suite could not see a laptop with no agent or line up three clocks that disagreed, so it would not have stopped 03:12.
Not found yet.
Case 2 of 11 · 5 entries to find
The quiet guest
Who is using Priya’s account at 02:00?
Path: SOC operations and incident response
Episode 1
Which finding to patch firstScore is not order
Kael patched the exploited, internet-facing gateway before the 9.8 that nobody can reach, and Priya's account was active at 02:00 while she slept.
Not found yet.
Episode 2 · side episode
How an intrusion unfoldsA middle stage
Priya was asleep, so the 02:00 activity is a middle stage, with an earlier step already behind it and later ones possibly ahead.
Not found yet.
Episode 3
Triage an identity alertIssued here, used there
Priya's session was issued on her laptop at 18:52 and used from an unregistered device at 02:00, so someone else holds her session token.
Not found yet.
Episode 4
Contain, then prove it workedSent is not applied
The revoke returned 504, so Nyx read live state: 0 sessions, no rogue factor, and a 401 for the guest at 03:31.
Not found yet.
Episode 5
What a SOC agent may do aloneCase closed: the quiet guest
A stolen session, traced, contained, and verified gone, and the guest's last trick failed because the bot could read but not act.
Not found yet.
Case 3 of 11 · 5 entries to find
The helpful bot
Why did the operations assistant book antenna time nobody asked for?
Path: AI application and agent security
Episode 1
Prompt injection: when a document gives ordersThe bulletin gave the order
At 01:52 the assistant retrieved a supplier bulletin with hidden text telling it to book Station North, and it read that text as an instruction.
Not found yet.
Episode 2
Excessive agency: an assistant with too much powerBuilt to read, able to write
The assistant only needed to read the schedule, but it held an administrator key and nothing checked its bookings before they took effect.
Not found yet.
Episode 3 · side episode
Whose authority does an agent use?One key, no caller
Every booking ran under the assistant's own key, so a read-only request borrowed booking rights and the log could not name who asked.
Not found yet.
Episode 4
Human approval that means somethingIt proposes, a person decides
The assistant now only proposes: a signed-in person sees the exact station, start, and length, and the approval covers that booking and no other.
Not found yet.
Episode 5 · side episode
Where AI agents fit in security workThree lanes, one rule
Agents fit where they read, draft, and propose, while credentials, policy decisions, and approvals stay with deterministic code and people.
Not found yet.
Case 4 of 11 · 5 entries to find
The borrowed package
Can we trust the flight-planning build?
Path: Application & software supply-chain security
Episode 1
Threat model a service before you build itStart with the drawing
Flight planning's diagram has a box for code Meridian did not write, and nobody had drawn a trust boundary around it.
Not found yet.
Episode 2
The code you inherit with one importThree levels down
The lockfile pins
parse-three levels down, but a pin proves what was installed, not who published it.lite Not found yet.
Episode 3
Who can write and who can shipTwo people, one signature
The flight planner's test job held the production key, so one push could ship. Now it takes a reviewer and a signed digest.
Not found yet.
Episode 4 · side episode
A coding agent is an untrusted authorThe bot is an author
dev-may propose changes to the flight planner, but it cannot approve them, edit workflow files, or ship.bot- 02 Not found yet.
Episode 5
An SBOM is evidence about one buildThe build ships with evidence
A package three levels down changed owners, and the fixed build shipped with an SBOM bound to the digest production runs.
Not found yet.
Case 5 of 11 · 1 entries to find
A letter from the launch director
Who really sent that email?
Path: Mailbox literacy: what SPF, DKIM, and DMARC prove
Episode 1
What email authentication proves, and what it cannotNot the launch director
The letter failed DMARC, but
chronos.publishedorbital p=none, so the receiver delivered a From line that no check had backed.Not found yet.
Case 6 of 11 · 3 entries to find
The go or no-go memo
What exactly is the board being asked to accept?
Path: Governance, risk, and compliance (GRC) in practice
Episode 1
Write the risk sentenceThree sentences, not eleven labels
A risk the board can accept names a threat event, a gap, an asset, and a bounded impact, and has an owner who holds the budget.
Not found yet.
Episode 2
Choose the control and its evidenceWhat ran, not what was written
A control counts only with evidence that it ran: 35 of 37 contractor accounts were revoked on time, and the query shows the two that were not.
Not found yet.
Episode 3
Governance is a calendar, not a binderThree sentences, signed and dated
The board accepted three risks, each with an owner and an expiry date that the monthly review will check, so none of them can go quiet.
Not found yet.
Case 7 of 11 · 1 entries to find
The crew medical file
The data is encrypted. Why is the crew still upset?
Path: Privacy engineering vs security controls
Episode 1
Why secure data can still break privacySecure is not appropriate
The crew file was never breached, but it was collected, shared, and kept beyond its one purpose, so access was narrowed to flight clearance.
Not found yet.
Case 8 of 11 · 4 entries to find
The partner badge
How does Kestrel staff sign in to Meridian systems?
Path: OAuth 2.0, OIDC, and SAML federation security
Episode 1
Who holds the ticket, and what it opensA ticket, not a password
Kestrel's dashboard carries a short-lived ticket, and the telemetry API checks issuer, audience, expiry, and scope on every call.
Not found yet.
Episode 2 · side episode
Code on the front, token on the backCode in front, token behind
The browser now carries only a one-time code bound by PKCE, and the access token comes back over a direct server call.
Not found yet.
Episode 3
A signed assertion is not admin permissionVouched for, not promoted
Kestrel's assertion proves who signed in, Meridian's own mapping decides the role, and no mapping means no role.
Not found yet.
Episode 4
Five ways federated sign-in breaksFive envelopes, five refusals
Kestrel staff sign in through a federation that passes claims, not admin rights, and refuses any sign-in that fails a check.
Not found yet.
Case 9 of 11 · 12 entries to find
The new control room
What does the control room need before anyone is allowed in?
Path: Security architecture, cryptography, and governance
Episode 1
Who decides: the policy hierarchyWho decides is written down
The board policy says what must be protected and who decides; cipher names live in standards and baselines that change without a board vote.
Not found yet.
Episode 2
Law, due care, and ethicsThe contract is one track
Kestrel's seats touch civil, regulatory, and criminal law at once, and no schedule outranks the duty to act legally.
Not found yet.
Episode 3
Personnel security from hiring to offboardingCheck, sign, then access
No Kestrel engineer gets a control room account until the background check is back and the AUP and NDA are signed.
Not found yet.
Episode 4
Risk in dollars, recovery in hoursWorth it, in dollars
The second link controller costs $30,000 a year and removes $140,000 of expected yearly loss. Expected, not guaranteed.
Not found yet.
Episode 5
Data owners, labels, and the data lifecycleThe owner sets the label
Thruster telemetry is
Restrictedbecause the VP of Propulsion, its owner, says so; Kael runs the controls and cannot relabel it.Not found yet.
Episode 6
Deleted is not gone: sanitizing mediaEmpty consoles, shredded drives
The old room's flash drives were shredded, not wiped or degaussed, because deleting leaves the data and the media was leaving Meridian's custody.
Not found yet.
Episode 7
Formal security models and what each protectsTwo rules, not one
Reading a flight command is a confidentiality rule and writing one is an integrity rule, so the control room needs both, and they point in opposite directions.
Not found yet.
Episode 8
What the hardware and hypervisor must guaranteeTrust runs downhill
Each console check depends on the layer under it, so the consoles boot measured, seal disk keys in a TPM, and keep command-signing keys in an HSM.
Not found yet.
Episode 9
Symmetric and asymmetric encryption, and why bothThe key is the secret
The command link uses published ciphers: a fresh AES-256-GCM key for each pass, wrapped with Halcyon's public key, so only the keys need guarding.
Not found yet.
Episode 10
Hashes, signatures, and the certificates behind themSigned, then sealed
Every Halcyon command is signed with the control room's private key in the HSM, and the relay checks the certificate chain before it trusts the signature.
Not found yet.
Episode 11
Physical security from the fence to the rackOne badge, one person
The control room gets a two-door mantrap that admits one badged person at a time, and every exit door unlocks when power fails or the fire alarm sounds.
Not found yet.
Episode 12
Air, power, and fire in a server roomThe room survives a bad day
Air in band, power carried by UPS and then generator, and ceiling pipes that stay dry until smoke is detected: the board approves the control room.
Not found yet.
Case 10 of 11 · 7 entries to find
The flat network
Why could a laptop in the lobby reach the antenna?
Path: Network architecture, protocol defense, and access models
Episode 1
Network layers and where attacks liveOne network, lobby to antenna
The lobby jack and the antenna controller share one local network, so their traffic never crosses the firewall that was meant to stand between them.
Not found yet.
Episode 2
Segmentation: zones, firewalls, and admissionFour zones, not one box
Station South now has four zones, and a device at a lobby port must prove who it is before the switch forwards a single frame.
Not found yet.
Episode 3
IPsec VPNs: protecting a link you rentSealed between the gateways
The carrier link now carries ESP in tunnel mode, so an observer sees two gateway addresses and no trace of what is inside.
Not found yet.
Episode 4
Wi-Fi, voice, and the shared networkNo passphrase to share
Station South Wi-Fi now signs in each device with its own certificate, so one leaked passphrase no longer opens the air to everyone.
Not found yet.
Episode 5
Kerberos: signing in with ticketsA ticket anyone can request
Any domain account can request a service ticket and guess the service password offline, so the antenna scheduler's password is now 64 random characters.
Not found yet.
Episode 6
Measuring identity trust and keeping it currentLowest crossover, strictest door
Compare readers by crossover error rate, tune the control room door against false acceptance, and remove access the day its reason ends.
Not found yet.
Episode 7
Access control models and who decidesDecided per request. Case closed.
The lobby laptop now reaches nothing, and every antenna command is permitted or denied on who asks, from what device, and when.
Not found yet.
Case 11 of 11 · 9 entries to find
Prove it
The auditors arrive in five days. What can we actually show?
Path: Security assessment, forensics, and software assurance
Episode 1
What an audit report actually provesRead past the seal
The archive vendor's first report covered finance on one day; its SOC 2 Type 2 shows security controls working across twelve months.
Not found yet.
Episode 2
Penetration testing starts with permissionSigned before the first packet
The CEO signed the rules of engagement before any scan ran; the testers then chained three medium findings into a telemetry relay.
Not found yet.
Episode 3
Why passing tests still miss bugsGreen is not covered
The parser had 100 percent statement coverage and an untested false branch; five layered gates and a branch coverage number now watch it.
Not found yet.
Episode 4
Digital forensics: collect evidence before it vanishesMemory first, then the disk
The relay's only trace lived in memory; Nyx captured it before shutdown, because a reboot would have erased the proof of what it was.
Not found yet.
Episode 5
Recovery sites and backups: buying back timeTwo tiers, two promises
The collision ledger runs on mirrored sites; the build cluster restores at a warm site from one full backup and one differential.
Not found yet.
Episode 6
RAID, and testing the recovery planA plan nobody had run
RAID covers a dead disk, not a deleted file; the recovery site proved itself by processing live transactions in a parallel test.
Not found yet.
Episode 7
Security in every phase of developmentA check in every phase
Both booking bugs passed design and implementation with no security activity; every phase now has one, and the process is rated honestly at level 2.
Not found yet.
Episode 8
Database integrity and what answers revealWhole bookings, leaky totals
A half-finished booking rolls back whole, yet two permitted totals still gave away a restricted maneuver date: integrity held and inference leaked.
Not found yet.
Episode 9
Classic application attacks and their root fixesCheck and debit, one step
The fuel check and debit now run as one locked transaction, the search query is parameterized, and the readiness review is clean: fix the cause, then prove it.
Not found yet.