A Beginner Security Exercise: Separate Evidence from Explanations

An alert says several login attempts failed and a later attempt succeeded. What happened?

There are possible explanations, but the short sequence alone does not settle them. A person might have corrected a mistake. An unauthorized person might have gained access. The events might not even represent one continuous attempt. A useful beginner exercise is to preserve those distinctions.

Start with what is actually given

In this fictional scenario, your entire starting record is five failed logins followed by one successful login. You have no confirmed device, location, travel or authentication context.

Write an observations section using only those supplied facts. Put explanations in a separate section. “The account was compromised” is a conclusion that requires further evidence; it should not silently replace the event description.

This separation makes your reasoning reviewable. Another reader can tell whether they disagree with the evidence, the interpretation or the proposed response.

Ask questions that change the decision

Avoid producing a long list of questions merely to sound thorough. For each missing detail, explain how it might affect the next step.

You might ask whether the events concern the same account and time window, whether the device is expected, and what additional authentication evidence is available. In a real organization, the appropriate team would obtain information through its authorized procedures. This exercise needs only your written questions.

Rank the questions. Which one would you want answered first, and why? Which answers would increase concern? Which would still leave an important uncertainty?

Write a conditional next step

A careful response can be useful without pretending to know the cause. Describe the next evidence check, who should perform it, and when the situation should be escalated under the organization's incident process.

Do not invent a universal threshold or claim that one reassuring detail proves the account is safe. State the conditions your recommendation depends on. If the exercise provides no incident policy, identify that as an input you need.

Leave a clear handoff

Combine your work into a short note: observed events, possible explanations, missing context, recommended evidence check, responsible role and escalation conditions. Avoid personal information and use invented names or identifiers.

Review the note by removing your favorite explanation. Does the proposed next step still make sense? If the note only works when one unproven story is true, revise it.

The goal is a disciplined evidence record, not a declaration that you resolved an incident. You can practise that distinction without accessing a real account or network.

Explore READY's cybersecurity introduction for more practice distinguishing security observations from explanations. The overview is public and lessons require a free READY account. The material is independently authored by READY and does not award Google or Coursera credentials.