OpenCyber Academy
Postgraduate · Chapter 12 · English
Course code: OCA-155Chapter 12: OCA-155-C012

Chapter 12 — Final review and transfer

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 12 published. Map, example, EX056.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Final investigation report"]
  N2["12.2 Regulator report"]
  N3["12.3 Knowledge transfer"]
  N4["12.4 Programme review"]
  N5["12.5 Succession"]
  N6["12.6 Continuing development"]
  N7["12.7 Closing records"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX056"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Final investigation report"]
  N2["12.2 Regulator report"]
  N3["12.3 Knowledge transfer"]
  N4["12.4 Programme review"]
  N5["12.5 Succession"]
  N6["12.6 Continuing development"]
  N7["12.7 Closing records"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX056"]

[Learning outcomes]
    |
    v
[12.1 Final investigation report]
    |
    v
[12.2 Regulator report]
    |
    v
[12.3 Knowledge transfer]
    |
    v
[12.4 Programme review]
    |
    v
[12.5 Succession]
    |
    v
[12.6 Continuing development]
    |
    v
[12.7 Closing records]
    |
    v
[Worked example] --> [Exercise EX056]

Learning outcomes

You will (1) review the CF-21 investigation and programme as a whole; (2) transfer knowledge to others; (3) write a final report for regulators; (4) plan continuing development.

12.1 Final investigation report

The CF-21 report answers: entry via a phishing-compromised VPN account; lateral movement to the domain controller; data staged via the backup server and about 18 GB exfiltrated; ransomware deployed at 03:12 from WS-07. Each answer cites its evidence and states limits, including the two rebuilt servers: the VPN logs for entry, domain controller evidence for lateral movement, the NAT table and backup-server logs for staging, and WS-07 triage data for deployment. Where the rebuilt servers leave lateral movement partly unclear, the report says so. Calibrated wording follows the same pattern as the exfiltration statement.

12.2 Regulator report

The regulator receives facts on affected data, timeline, containment and remediation. Legal counsel reviews wording; Marta ensures technical accuracy. For CF-21, the regulator's central question is whether customer data were taken, answered with the 18 GB transfer, the 02:35 read of the customer share and the 4,200 accounts whose files were on it. Technical claims are not softened by legal review, and legal wording is not allowed to change what the evidence shows. Marta checks the final wording against the evidence before it is sent, and keeps the version that went to the regulator.

12.3 Knowledge transfer

Aiyana leads a session for the SOC on artefacts that would have shown the intrusion earlier. Playbooks, the decision matrix and the retention model are added to the knowledge base. Aiyana's session shows the SOC the VPN sign-in, the staging reads on the backup server and the log-cleared event on WS-07, all of which were visible before 03:12. Analysts can then write and test detections for similar patterns in their own tooling. The knowledge base entries link each artefact to the CF-21 evidence that showed it.

12.4 Programme review

Improvements delivered: forensic gate, faster preservation, central logging, proficiency programme changes. Open items: mobile extraction capacity, similarity hashing validation. Each delivered item maps to a CF-21 gap: the gate to the rebuilt servers, faster preservation to the 3.5-hour median, central logging to the rotated workstation logs and proficiency changes to the cloud timestamp error. The open items stay on the programme list, each with an owner, a target date and a measure of done. Mobile extraction capacity matters because the phone case showed what a logical extraction alone would have missed.

12.5 Succession

Marta documents decision principles so deputies can lead the next incident. The principles include keeping options open under uncertainty, logging every decision with rationale and approver, agreeing matrix weights before scoring and stating uncertainty in calibrated terms. Deputies practise them in exercises, so the next incident does not depend on Marta being present at 06:10. The principles are written as short statements with a CF-21 example for each, so deputies can see how they were applied. They are reviewed and, where needed, revised after every major incident. A deputy leads the next tabletop exercise using them, and Marta observes rather than directs.

12.6 Continuing development

Each examiner sets learning goals tied to gaps found in CF-21. For example, an examiner who missed the UTC display issue in the proficiency test might set a goal on cloud audit logs, while another might focus on mobile file-system extraction. Goals are reviewed at the next proficiency cycle against evidence of progress. Marta funds training linked to each goal, as she does for proficiency results. The goals sit in each examiner's competence record beside the methods they are authorised to use. A goal is closed only when a test or case shows the skill in practice.

12.7 Closing records

Evidence retention is set according to legal advice; custody records are closed and archived. For CF-21 that includes the nine full images, the memory captures, the triage packages, the phone extractions and the decision log. Custody records are closed with a final entry for each item showing where it is stored and under what retention. The archive stays ready in case regulators or courts reopen questions. Retention periods differ by item, since the phone case may go to a tribunal while CF-21 evidence follows regulatory needs. The closing entries name who approved each retention decision and on what legal advice.

Lessons for the profession

With legal approval, Marta presents an anonymised account of CF-21 at a regional forensic practitioners' meeting: the forensic gate, the retention model and the backup-server staging pattern. Sharing lessons helps other organisations prepare, and peers' questions sharpen the team's own understanding.

Worked example

The regulator asks whether customer data were taken. Marta's statement: "Approximately 18 GB was transferred from the backup server at 02:40; the backup server read the customer share at 02:35. Records from the share suggest that customer files for 4,200 accounts were among the data read; we cannot confirm which of those were included in the transfer."

Synthetic case. The report is invented.

Errors and limits

Final reports close an investigation but may need revision if new evidence appears; keep the archive ready.

Exercises

Synthesis

Close investigations with bounded, sourced reports, transfer what was learned, and prepare others to lead.

Continue studying — chapter 12 of 12

← Chapter 11 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →

Worked answers

EX056. A VPN account compromised through phishing gave entry; the attacker moved to the domain controller, staged data through the backup server and then deployed ransomware.

EX057. Legal counsel reviews the wording and handles the regulator; Marta guarantees the technical accuracy.

EX058. Expanding mobile extraction capacity, and validating similarity hashing on the team's corpus.

EX059. It states that 18 GB was transferred and that the customer share was read, but does not claim to know which specific customer files left.

EX060. So deputies can lead the next incident consistently if Marta is unavailable.