OpenCyber Academy
Bachelor's · Chapter 20 · English
Course code: OCA-108Chapter 20: OCA-108-C020

Chapter 20 — Comparative cases in detection and response

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 20 published. Map, example, EX057.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["20.1 Why compare cases"]
  N2["20.2 Case selection"]
  N3["20.3 Chronology and source quality"]
  N4["20.4 Facts versus teaching inference"]
  N5["20.5 Transferability"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX057"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["20.1 Why compare cases"]
  N2["20.2 Case selection"]
  N3["20.3 Chronology and source quality"]
  N4["20.4 Facts versus teaching inference"]
  N5["20.5 Transferability"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX057"]

[Learning outcomes and connection]
    |
    v
[20.1 Why compare cases]
    |
    v
[20.2 Case selection]
    |
    v
[20.3 Chronology and source quality]
    |
    v
[20.4 Facts versus teaching inference]
    |
    v
[20.5 Transferability]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX057]

Learning outcomes and connection

You will be able to (1) select cases for comparison with explicit criteria; (2) build a chronology from public sources and grade source quality; (3) separate sourced facts from teaching inference; and (4) judge what transfers from a public case to a different organization. Chapter 19 compared models; here you compare real events. The method recurs in Chapter 28 (missed signals) and Chapter 37 (case critique).

20.1 Why compare cases

A single case invites storytelling; two or more cases, compared on the same dimensions, reveal which factors mattered. Comparative case analysis is standard in safety science and public administration. In cybersecurity, public review bodies now produce detailed reports — for example the US Cyber Safety Review Board (CSRB), established in 2022 under Executive Order 14028, published reviews of the Log4j event (July 2022) and of the Summer 2023 Microsoft Exchange Online intrusion (2024). In January 2025 the Department of Homeland Security ended the terms of the board’s advisory-committee members; the reports remain public.

20.2 Case selection

Choose cases that differ on the factor you want to understand and are similar enough elsewhere to compare. State selection criteria; acknowledge that public cases are biased toward large, disclosed, often US-based events.

The two CSRB cases differ in the factor of interest, who could act. With Log4j every organization running the library had to find and fix it; with Exchange Online most of the remedy lay with the provider. Both concern widely used technology and both were reviewed by the same board with similar methods, which makes the comparison fairer. A selection that differed in many factors at once would leave you unable to say which difference mattered.

20.3 Chronology and source quality

Build a timeline with each entry sourced. Grade sources: primary official reviews and vendor post-incident reports (high, but check for interest); regulatory filings (high for facts they must state); reputable journalism (moderate, check for corroboration); social media (low unless primary). Record uncertainty in dates.

For the CSRB cases, the board's own reports are the primary sources; a vendor's later statement about the same events is also primary but comes from an interested party, so grade it accordingly. When two sources give different dates, record both with their sources rather than choosing one silently.

20.4 Facts versus teaching inference

Mark each statement as sourced fact (with citation) or inference (yours). Synthetic additions for teaching must be clearly labelled.

In the worked comparison, the descriptions of Log4j and Exchange Online are summaries of sourced facts, and the paragraph about Harbourline is marked as fiction and teaching inference. Keeping these apart lets a reader verify the real cases against the reports without being misled by the synthetic extension. If a reader cannot tell which sentences came from the reports and which from the author, the case study has failed as evidence, however good its lessons. Put the label next to the sentence, not only in a heading.

20.5 Transferability

A lesson transfers when the mechanism behind it exists in the target setting. "Keep detailed audit logging available" transfers broadly; "rotate a specific cloud provider's consumer signing keys" does not.

Ask of each lesson: what mechanism made it matter, and does that mechanism exist here? Harbourline does not run its own identity provider for the booking platform, so lessons about key management at a provider apply only through its vendor contract. The inventory lesson from Log4j applies directly, because Harbourline, like anyone, needs to know which components its systems depend on.

20.6 Worked example: two public cases and a synthetic organization

Sources: CSRB, Review of the December 2021 Log4j Event (July 2022); CSRB, Review of the Summer 2023 Microsoft Exchange Online Intrusion (2024). Read both reports before using these summaries; the summaries are deliberately brief and should be checked.

Case 1 — Log4j (sourced, summarized): a critical remote-code-execution vulnerability (CVE-2021-44228) in the widely used open-source Log4j library was publicly disclosed in December 2021. The CSRB report described it as an "endemic vulnerability" likely to remain in systems for years, and highlighted the difficulty organizations had in finding where the library was used.

Case 2 — Exchange Online (sourced, summarized): an actor tracked as Storm-0558 used a Microsoft consumer signing key to forge authentication tokens and access email accounts at a number of organizations. The intrusion was first detected by a US government customer using audit logging it had access to. The CSRB found the intrusion preventable and criticized the provider's security culture.

Comparison dimensions: | Dimension | Log4j | Exchange Online | |---|---|---| | Detection trigger | Public disclosure of a vulnerability | Customer anomaly in audit logs | | Main response difficulty | Finding affected components (inventory) | Visibility into a provider's identity system | | Who could act | Every organization running the library | Mostly the provider; customers limited | | Transferable lesson | Software inventory and dependency knowledge | Access to adequate logging; supplier accountability |

Synthetic extension (fiction, labelled): Harbourline's vendor-hosted booking platform resembles Case 2 in dependency (Harbourline cannot see inside the vendor's identity system) and Case 1 in inventory (Harbourline does not know which libraries the vendor uses). Teaching inference: Harbourline should negotiate log access and software-component disclosure in its contract (Chapter 19, EX057).

20.7 Common errors and limits

Exercises — chapter 20

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX058 — Source grading. Steps: for one of the two CSRB reports, list three facts from it with page or section references and grade each source type. Rubric: 3 = accurate facts with references, grade reasoning includes the reviewer's position; 2 = facts without references; 1 = from memory; 0 = none.

EX059 — Add a dimension. Steps: add two rows to the comparison table (for example "time from first malicious activity to detection" and "role of logging"), filling them only with sourced facts or "not stated". Rubric: 3 = rows filled with sourced values or honest "not stated"; 2 = some unsourced; 1 = invented; 0 = none.

EX060 — Transfer test. Steps: take one lesson from each case and argue whether it transfers to a small municipal government with on-premises email. Rubric: 3 = mechanism-based argument for each (inventory transfers; provider key management does not directly, but logging access and supplier contracts do if any cloud services are used); 2 = one argued; 1 = asserted; 0 = none.

Chapter synthesis

Compare cases on explicit dimensions, source every fact to primary reports, label inference and fiction, and transfer only lessons whose mechanisms exist in the target setting.

Worked answers

EX057. (1) A contract clause requiring the vendor to notify Harbourline of security incidents affecting its data within a defined time, with content requirements. (2) Rights to obtain relevant logs (sign-ins, data access) on request, with retention periods. (3) Named contacts on both sides with a 24×7 escalation path, tested in a joint tabletop exercise.

EX058. Answers depend on the report chosen; a good answer quotes, for example, from the Log4j report's executive summary the "endemic vulnerability" finding and its recommendation themes (software bills of materials, open-source security investment), each with a section reference. Grade: official review (high for process facts, but the CSRB relied on voluntary information from participants, so some facts are as reported to it). Check that every quotation matches the report text.

EX059. Example rows: "Role of logging" — Exchange Online: the detecting customer used audit logs available in its licence tier (sourced to the report); Log4j: "not the primary issue; the difficulty was identifying vulnerable components" (inference — mark it so). "Time from first malicious activity to detection" — record what the report states, or "not stated in the summary read" rather than inventing dates.

EX060. Log4j's inventory lesson transfers: the municipality runs software with dependencies it may not know; mechanism present. The Exchange Online signing-key lesson does not transfer directly to on-premises email (no provider key), but the underlying lessons — that you need logs adequate to detect misuse of authentication, and contractual accountability for any cloud supplier — transfer to the extent the municipality uses cloud identity or services.