Chapter 5 — Digital forensics and malware analysis: design alternatives
Lesson map
Lesson 05 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["5.1 The design question"]
N2["5.2 Criteria and weights"]
N3["Lab — weighted decision matrix"]
N4["5.3 Reading the result"]
N5["5.4 Sensitivity"]
N6["5.5 Decision"]
N7["5.6 Communicating"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 The design question"]
N2["5.2 Criteria and weights"]
N3["Lab — weighted decision matrix"]
N4["5.3 Reading the result"]
N5["5.4 Sensitivity"]
N6["5.5 Decision"]
N7["5.6 Communicating"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX021"]
[Learning outcomes]
|
v
[5.1 The design question]
|
v
[5.2 Criteria and weights]
|
v
[Lab — weighted decision matrix]
|
v
[5.3 Reading the result]
|
v
[5.4 Sensitivity]
|
v
[5.5 Decision]
|
v
[5.6 Communicating]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) compare collection strategies with a weighted decision matrix; (2) test sensitivity of the choice to weights; (3) combine options; (4) justify the design to stakeholders.
5.1 The design question
For the 40 ransomware-affected hosts, Marta compares three strategies: image every host fully; targeted triage collection from all; or triage everywhere then full images of hosts that triage marks as significant. Each strategy answers the entry-point and exfiltration questions in a different way and at a different cost. Full imaging gives the most evidence but would keep all 40 hosts offline for most of a day. Targeted triage is fastest but loses any artefact not on the list. The hybrid keeps fast scoping and adds full images where triage shows they are worth the cost.
5.2 Criteria and weights
Evidence coverage (0.35), time to answer (0.25), business disruption (0.20) and cost (0.20). Weights are agreed with the COO before scoring, so they are not tuned to a preferred answer. The weights reflect Corvane's position: coverage carries the most because the regulator will ask about customer data, time matters because recovery is waiting, and disruption and cost share the rest. Writing the weights first, with the COO, means nobody can later claim the matrix was arranged to justify a choice made beforehand. The COO's agreement to the weights is recorded in the decision log.
Lab — weighted decision matrix
"""Weighted decision matrix: collection strategy for 40 ransomware-affected hosts."""
w = {"evidence_coverage": 0.35, "time_to_answer": 0.25, "business_disruption": 0.20, "cost": 0.20}
opts = {"full_image_all": {"evidence_coverage": 5, "time_to_answer": 1, "business_disruption": 2, "cost": 1},
"targeted_triage": {"evidence_coverage": 3, "time_to_answer": 5, "business_disruption": 4, "cost": 4},
"triage_then_image": {"evidence_coverage": 4, "time_to_answer": 4, "business_disruption": 4, "cost": 3}}
for name, s in sorted(opts.items(), key=lambda kv: -sum(w[c]*kv[1][c] for c in w)):
print(f"{name:18} {sum(w[c]*s[c] for c in w):.2f}")
Run with python3 lab_matrix.py. Verified output:
targeted_triage 3.90
triage_then_image 3.80
full_image_all 2.60
5.3 Reading the result
Targeted triage scores 3.90, triage-then-image 3.80, full imaging of all hosts 2.60. Full imaging is clearly worst on time and cost. The top two are within 0.10 — too close for the matrix alone to decide. The gap of 0.10 is smaller than the likely error in any single score, since a one-point change on time to answer moves an option by 0.25. Marta therefore treats the matrix as showing that two options are close and one is clearly worse. The choice between the top two needs an argument the matrix cannot supply.
5.4 Sensitivity
Raising evidence coverage's weight to 0.45 (taking 0.10 from time) puts triage-then-image ahead. Because the regulator may ask detailed questions about data exfiltration, Marta judges coverage the more defensible priority. With those weights, triage-then-image scores 3.80, targeted triage drops to 3.70 and full imaging rises to 3.00. The ranking of the top two flips on a modest shift, which confirms the near-tie. Marta records the sensitivity run and the regulator argument in the decision log. The rerun takes minutes, because the lab script only needs the weights changed.
5.5 Decision
Triage-then-image: triage all 40 hosts, then fully image the first-infected host, the domain controller, file servers and any host showing exfiltration tooling. The choice follows the coverage argument: triage everywhere answers scoping quickly, and full images of the hosts most likely to hold evidence of entry and exfiltration protect the regulator's questions. The hosts not marked significant return to IT for rebuild once triage completes. The criteria for 'significant' are written down before triage results arrive. Imaging of the significant hosts runs in parallel with recovery of the others.
5.6 Communicating
The COO sees the matrix, the near-tie and the reason for choosing coverage. The COO also sees the sensitivity result: with coverage weighted at 0.45 the hybrid leads, and with the original weights targeted triage leads by 0.10. Presenting the near-tie honestly lets the COO agree to the coverage argument knowingly, instead of being shown a single winning score. The COO approves the hybrid with the trade-off in view, and the approval is logged. The record shows the decision rested on stated priorities, not on a hidden tuning of scores.
5.7 Reuse
The matrix becomes a template in the incident playbook. The template keeps the four criteria, the rule that weights are agreed before scoring and the three-person scoring panel. Each new incident fills in its own scores, because a small incident with two hosts may favour full imaging. Keeping old matrices with their outcomes lets the unit check later whether its scoring was realistic. The playbook also notes when the matrix is not worth using, such as a single-host incident with an obvious answer.
Scoring panel
Three people score each option independently — Marta, Aiyana and the infrastructure lead — and the average is used. Where their scores differ by two points or more, they discuss and record the reasons. This reduces the influence of any single person's preference and exposes assumptions, such as how long imaging a file server really takes.
Worked example
Triage marks six hosts as significant; with the domain controller and two file servers, nine are imaged. Imaging runs in parallel with recovery of the other 31, finishing by 14:00.
Synthetic case. Scores are generated by the lab script.
Errors and limits
Scores are judgements; record who scored and invite challenge, especially when options are close.
Exercises
- EX021 — Lab scores. Report the three scores. Rubric: 3 = 3.90, 3.80, 2.60 with names; 2 = two; 1 = one; 0 = none.
- EX022 — Near tie. Why can the matrix not decide alone? Rubric: 3 = top two within 0.10; judgement errors exceed gap; 2 = partial; 1 = it can; 0 = none.
- EX023 — Sensitivity. What weight change reverses the top two? Rubric: 3 = coverage 0.45, time 0.15; 2 = partial; 1 = wrong; 0 = none.
- EX024 — Weights first. Why agree weights before scoring? Rubric: 3 = prevents tuning to preferred answer; 2 = partial; 1 = speed; 0 = none.
- EX025 — Imaged hosts. Which hosts were fully imaged? Rubric: 3 = first-infected, DC, file servers, exfiltration hosts (nine total); 2 = partial; 1 = all; 0 = none.
Synthesis
Decision matrices clarify trade-offs; sensitivity checks and stated priorities settle close calls.
Continue studying — chapter 05 of 12
← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →