Chapter 1 — Advanced security decision-making
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The senior examiner's problem"]
N2["1.2 Competing goals"]
N3["1.3 Decision under uncertainty"]
N4["1.4 Decision records"]
N5["1.5 Cognitive traps"]
N6["1.6 Delegation"]
N7["1.7 Communication"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The senior examiner's problem"]
N2["1.2 Competing goals"]
N3["1.3 Decision under uncertainty"]
N4["1.4 Decision records"]
N5["1.5 Cognitive traps"]
N6["1.6 Delegation"]
N7["1.7 Communication"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The senior examiner's problem]
|
v
[1.2 Competing goals]
|
v
[1.3 Decision under uncertainty]
|
v
[1.4 Decision records]
|
v
[1.5 Cognitive traps]
|
v
[1.6 Delegation]
|
v
[1.7 Communication]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) make forensic decisions under time pressure and uncertainty; (2) weigh evidence preservation against business recovery; (3) document decisions so they can be defended; (4) recognise cognitive traps in senior roles.
1.1 The senior examiner's problem
Marta Kowalczyk leads digital forensics at the fictional Corvane Financial Group. At 06:10 on a Monday, staff find that ransomware has encrypted 40 hosts, file servers and workstations among them. The operations director wants systems restored by noon. Marta must decide what to preserve before anything is wiped. The tension is concrete: every host rebuilt before preservation loses memory, local logs and file-system traces that could show how the attacker got in. Leaving hosts down costs Corvane trading and customer service hours. Marta has less than an hour to choose, and whatever she chooses will later be examined by the regulator.
1.2 Competing goals
Recovery wants clean rebuilds fast. Investigation wants memory, disks and logs preserved. Regulators may require an account of what data were affected. NIST SP 800-61r3 places these activities within organisational risk management: response decisions are business decisions informed by evidence needs. At Corvane all three goals are live at once on that Monday morning. The operations director owns recovery, Marta owns evidence, and legal counsel will answer to the financial regulator about customer data. None of them can simply override the others, so the choice is framed as a business decision with forensic costs stated in hours and lost answers.
1.3 Decision under uncertainty
Marta does not know the entry point or whether data were taken. She chooses actions that keep options open: capture memory from a sample of running affected hosts, snapshot virtual servers before rebuild, preserve central logs immediately, then release systems for recovery in waves. Each of these actions is cheap compared with what it protects. Memory from eight hosts takes minutes per host, VM snapshots take little longer, and central logs only need to be copied before rotation or retention removes them. Rebuilding in waves means the first systems return by 09:00 while the later ones wait for collection.
1.4 Decision records
Each decision is logged: time, options, choice, rationale, who approved. If a regulator or court later asks why a host was rebuilt without imaging, the record answers. Marta's 06:45 entry is the model: three options, the chosen one, the rationale tied to the entry-point and exfiltration questions, and the COO as approver. Writing the rejected options matters as much as the choice, because a later reviewer will ask why all 40 hosts were not imaged. The log is kept with the case records and closed only when the case closes.
1.5 Cognitive traps
Anchoring on the first theory, overconfidence in experience, and pressure to please executives. Marta assigns a colleague to argue alternatives at each briefing. In CF-21 the first theory at the morning briefing might easily have been 'a user opened an infected attachment on WS-07'. Anchoring on it would have hidden the phishing-compromised VPN account and the backup-server staging found later. The assigned challenger asks at each briefing what evidence would make the current theory wrong, and the answer is recorded.
1.6 Delegation
Experienced examiners run collection; Marta keeps the decision log and executive interface. Aiyana Brooks and the other examiners run the memory captures, snapshots and triage collection, each logging their own steps. Marta stays out of hands-on work so that she can track decisions, answer the COO and the director, and notice when a new finding means a decision has to be revisited. Splitting roles this way keeps the decision log complete while collection continues. Examiners bring her decisions that need approval, such as releasing a host for rebuild.
1.7 Communication
She gives the director a clear trade-off: two hours for preservation saves weeks of uncertainty later. The message to the director is stated in their terms: recovery starts at 09:00 rather than at once, and in return Corvane will be able to tell the regulator how the attacker got in and whether data left. Without that evidence, the regulator's questions could stay open for weeks. Marta gives the director one figure for delay and one for the risk avoided. The director agrees, and the approval is written into the 06:45 log entry.
Worked example
Decision log 06:45: "Options: (a) rebuild all now; (b) image all 40 first; (c) memory from 8 representative hosts, snapshots of 6 servers, central logs, then staged rebuild. Chosen: (c). Rationale: preserves evidence for entry point and exfiltration questions while allowing recovery from 09:00. Approved: COO."
Synthetic case. Corvane and the incident are invented.
Errors and limits
Sampling hosts risks missing the one that holds the key evidence; choose samples by role (first infected, servers, admin workstations), not convenience.
Exercises
- EX001 — Competing goals. Name the three competing goals in the Corvane incident. Rubric: 3 = recovery, investigation, regulatory account; 2 = two; 1 = one; 0 = none.
- EX002 — Option (c). Describe option (c) and why it was chosen. Rubric: 3 = sampled memory, server snapshots, logs, staged rebuild; keeps evidence and allows recovery; 2 = partial; 1 = vague; 0 = none.
- EX003 — Decision record. List five fields of a decision log entry. Rubric: 3 = time, options, choice, rationale, approver; 2 = three; 1 = one; 0 = none.
- EX004 — Trap control. How does Marta counter anchoring? Rubric: 3 = colleague argues alternatives at briefings; 2 = partial; 1 = experience; 0 = none.
- EX005 — Sampling rule. How should hosts be sampled for memory capture? Rubric: 3 = by role (first infected, servers, admin), not convenience; 2 = partial; 1 = random only; 0 = none.
Synthesis
Senior forensic decisions keep options open, balance business needs and are recorded for later scrutiny.