Operation Ghost Access

The user is back in control. Prove which other doors are still open.

3LEVELS

5MISSIONS

110 MINEST. DURATION

Explore the operation

YOUR NEXT INSIGNIA

THE OPERATION

Every decision moves the story.

0 / 5 required missions passed

The password changed. The intruder's access did not. Follow the identity, the export and the permissions nobody checked.

What you’ll practise and what’s included

Five cloud-identity investigations across three progressive levels, about 110 minutes of deliberate practice. Join Vela Architecture's incident bridge on the morning an embargoed client design may have left its cloud workspace. Trace a misleading sign-in, an app that acts independently of its user, a versioned data export and sharing routes that survive account recovery. Correlate source records and effect receipts, choose useful investigative branches and defend a limited return or continued hold. The export variant changes the number of versions and unique documents actually served; memorising a single impact answer will not work. Each mission has its own badge, animated briefing and saved debrief. The final dossier includes a reusable access-eviction field worksheet. Level 2 requires both Level 1 passes; Level 3 requires both Level 2 passes. Basic access-control familiarity helps; required terms and fictional platform behaviour are supplied. All work stays in the HTML5 player, with no live cloud account, terminal, usable tokens or external tools required. Included in the existing €20/month Missions subscription and eligible Teams access. These are guided investigations, not a live tenant lab or certification. Each chapter supplies a fixed incident checkpoint rather than dynamically importing earlier branch outcomes. Duration is an estimate, not a timer.

LEVEL 1

Follow the borrowed identity

GA-0120 MIN

The Login That Looked Normal

09:10 UTC. Jules, a designer at Vela Architecture, approved a sign-in while trying to join a client call. The identity dashboard says MFA succeeded, but Jules never joined the meeting. Response lead Mara needs to know whether a real authentication concealed an unauthorised session. You may preserve this run's records, verify Jules through the staff directory and request the pre-approved account/session hold. Do not ask for a new code, replay the sign-in or treat a location as attacker attribution. This chapter supplies its incident checkpoint; earlier decisions remain in their own records and govern advancement. All evidence is synthetic. No countdown is enforced.

20 min · Practice & assessmentBegin case

GA-0222 MIN

The App That Stayed Behind

09:40 UTC. Vela's U17 user/session paths are held, yet the workspace audit shows an app reading without a user. You are the application-access investigator. Two entries share the name Document Helper; one is an approved integration. Technical owner Iman needs you to identify the actual authority and propose a scoped stop without breaking the wrong client. You may preserve scoped identity/grant records, use approved app/resource controls and request harmless effect probes. No account deletion, tenant-wide credential collection or unsupported attribution is authorised. This chapter supplies its incident checkpoint; earlier decisions remain in their own records and govern advancement. All evidence is synthetic. No countdown is enforced.

22 min · Practice & assessmentBegin case

LEVEL 2

Find the real exposure

GA-03LOCKED

The Export Behind the Success Badge

10:05 UTC. Vela's access paths are being contained, but privacy lead Mara still needs to know what export E61 actually delivered. You are the data-scope analyst. The supplied checkpoint holds U17/P31's tested paths and preserves the earlier 09:22 job. Its dashboard says success and 48 rows. Establish the difference between document versions, unique documents, job acceptance and completed delivery. You may inspect restricted receipts and request either supplied classification or lineage review; no live replay or legal notification decision is authorised. This chapter supplies its incident checkpoint; earlier decisions remain in their own records and govern advancement. All evidence is synthetic. No countdown is enforced.

24 min · Practice & assessment

Complete the previous level to unlock.

GA-04LOCKED

The Link That Outlived the Account

10:30 UTC. Vela has held the tested user and app paths, but a design-preview link still opens without a sign-in. You are the workspace-permissions lead. Client director Leon needs to stop unapproved sharing without silently locking out the contracted reviewers. You may preserve scoped sharing/invitation records, inspect either supplied lineage report, revoke the named unapproved routes and verify their effects. No deletion of project files, new public share or all-client compromise claim is authorised. This chapter supplies its incident checkpoint; earlier decisions remain in their own records and govern advancement. All evidence is synthetic. No countdown is enforced.

20 min · Practice & assessment

Complete the previous level to unlock.

LEVEL 3

Earn the return

GA-05LOCKED

The Return We Can Prove

11:00 UTC. Vela's current user, app and sharing holds have effect receipts, but the embargo review still needs a safe way to work. You chair the access-restoration review. The supplied checkpoint keeps P31, G6 and L9 held and historical impact work open. Identity owner Iman proposes a new sign-in policy for a small human-only read workflow. Challenge its actual enforcement and exceptions, then recommend a conditional return or a staffed hold. You cannot re-enable production access, waive client/privacy review or authorise new public links from this desk. This chapter supplies its incident checkpoint; earlier decisions remain in their own records and govern advancement. All evidence is synthetic. No countdown is enforced.

24 min · Practice & assessment

Complete the previous level to unlock.

Paid campaign · €20/month including VAT with Solo, or included with eligible TIL Teams. Compare memberships →Sign in before starting to save your advancement.