Chapter 8 — Difficult cases
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Ambiguous scope"]
N2["8.2 Insider-sensitive"]
N3["8.3 Vendor refusal"]
N4["8.4 Record under stress"]
N5["8.5 Time"]
N6["8.6 Support"]
N7["8.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Ambiguous scope"]
N2["8.2 Insider-sensitive"]
N3["8.3 Vendor refusal"]
N4["8.4 Record under stress"]
N5["8.5 Time"]
N6["8.6 Support"]
N7["8.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 Ambiguous scope]
|
v
[8.2 Insider-sensitive]
|
v
[8.3 Vendor refusal]
|
v
[8.4 Record under stress]
|
v
[8.5 Time]
|
v
[8.6 Support]
|
v
[8.7 Narrative]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) handle ambiguous scope; (2) handle insider-sensitive findings; (3) handle vendor refusal; (4) keep records under stress.
8.1 Ambiguous scope
When a hostname might be participant-owned, Amira pauses and seeks written clarification; guessing is not a specialist skill. Participant-owned hostnames are the usual cause of these pauses, because they can look identical to Meridian Clearing House systems. In the worked case, related methods stopped within four minutes and the white team received the question by email. The pause is logged with the time and the question asked, and written clarification from the white team or the participant contact is filed before any further probe; until someone with authority answers in writing, the probe waits.
8.2 Insider-sensitive
Findings that imply staff misconduct go through HR paths with the minimum necessary detail; testing is not a witch hunt. The finding names the control that failed, such as a shared admin account, and leaves out who used it. Staff names appear only in the HR case file, which examiners can request through legal rather than read in FindingsDesk. Amira's one-page HR liaison script is rehearsed, so staff do not overshare in tickets that examiners might later read. Minimal detail protects the people involved and keeps the finding about controls.
8.3 Vendor refusal
Vendors who refuse reasonable authorized testing of their components trigger risk acceptance or replacement decisions — not silent hope. Amira brings the refusal to the CISO as a decision object with three options written: accept the residual risk with an expiry, demand contractual testing rights, or replace the component. Hoping the vendor will cooperate next year without a date is drift under another name. The chosen option, its owner and its expiry are filed in the decision log, so the refused component does not drop out of view until the next contract renewal.
8.4 Record under stress
Difficult cases generate more pressure emails, and all of them go to the CISO alias with factual headers. Amira does not debate findings in side threads that examiners will never see. Any disagreement about a finding is answered on the alias, with the evidence attached. The alias creates a record that survives staff changes and mood, and the factual headers keep that record useful: a successor can follow each thread without the original authors. When an examiner later asks why a finding was not softened, the answer is already on the alias.
8.5 Time
Difficult cases get explicit time boxes so they cannot starve ordinary catalogue work forever. A typical box is two weeks, set when the case opens and written beside the case owner's name. Time boxes appear on the same board as product findings, so infinite investigations are visible debt. Amira renews a box only with a written reason and a new end date; silent starvation of catalogue work is refused. When a box expires without renewal, the case closes with its findings so far instead of drifting on.
8.6 Support
Amira pairs juniors with a senior on any case that involves HR or participants, because solo juniors under that stress invent process that later fails challenge. Pairing is scheduled with the senior's name on the case file, not left to whoever happens to be free. The senior attends every HR or participant call, the junior speaks from the rehearsed liaison script, and the senior signs off each ticket entry the junior writes, so oversharing is caught before an examiner could read it. Juniors leave each case having practised the script under supervision.
8.7 Narrative
The maybe-participant host case shows the difficult-case pattern in one morning: four minutes to stop related methods, an email to the white team, and resumption only on a written scope update. Insider-sensitive playbooks include the one-page HR liaison script that Amira rehearses with her team. Time boxes for difficult cases sit on the same board as product findings, and juniors always pair with a senior when HR or participants are involved. Each step leaves a record that an examiner can follow later without asking anyone what happened.
8.8 HR script control
HR script versioning follows the same change control as ROE templates; freelanced empathy is not a control. Every version of the script carries a number, an effective date and two signatures, exactly as each ROE template does, so a well-meant wording change cannot reach an employee unreviewed. Retired versions stay in the archive, so legal can show which wording an employee actually heard on a given date. Amira has rejected a same-morning edit that lacked HR's countersignature; the afternoon interview waited rather than bending the process.
8.9 Same-day countersignature
HR script changes require HR and Amira countersignatures on the same day, so a script edited in the morning cannot reach an afternoon interview without both owners' approval. A missing signature is a stop, not a delay to negotiate; employees deserve reviewed words. The countersignature is recorded on the script's version line, next to the effective date and HR's initials. An edit that is still waiting for a signature stays a draft, and the interview uses the last signed version until both owners have approved the new one.
Worked example (synthetic MCH)
A maybe-participant host appears mid-window; Amira stops related methods in 4 minutes, emails the white team, and resumes only on written scope update.
Synthetic case — Meridian Clearing House (MCH). The clearing organisation, Amira Hassan and all figures are invented for teaching.
Errors and limits
Threat-led and clearing-system tests require specialised legal authorization. This book uses synthetic scenarios only and never supplies exploit code or live targeting advice for market infrastructures.
Exercises
- EX036 — Pause rule. What does Amira do on ambiguous ownership? Rubric: 3 = pause; written clarification; 2 = pause; 1 = guess; 0 = none.
- EX037 — HR path. How are staff-misconduct-implying findings handled? Rubric: 3 = HR path; minimal detail; 2 = partial; 1 = public channel; 0 = none.
- EX038 — Vendor refuse. What decisions follow vendor refusal to allow testing? Rubric: 3 = risk acceptance or replacement; 2 = one; 1 = ignore; 0 = none.
- EX039 — Pressure email. Where do pressure emails go? Rubric: 3 = CISO alias with factual header; 2 = partial; 1 = delete; 0 = none.
- EX040 — Stop time. How fast did Amira stop in the worked example? Rubric: 3 = about 4 minutes / minutes; 2 = same day; 1 = next week; 0 = none.
Synthesis
Difficult cases pause for writing, protect people and leave records.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →