Chapter 8 — Security operations and blue team: difficult cases
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Ambiguity"]
N2["8.2 Case one: the partner"]
N3["8.3 Conflicting evidence"]
N4["8.4 Actions"]
N5["8.5 Communicating uncertainty"]
N6["8.6 Revising"]
N7["8.7 Pressure"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Ambiguity"]
N2["8.2 Case one: the partner"]
N3["8.3 Conflicting evidence"]
N4["8.4 Actions"]
N5["8.5 Communicating uncertainty"]
N6["8.6 Revising"]
N7["8.7 Pressure"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 Ambiguity]
|
v
[8.2 Case one: the partner]
|
v
[8.3 Conflicting evidence]
|
v
[8.4 Actions]
|
v
[8.5 Communicating uncertainty]
|
v
[8.6 Revising]
|
v
[8.7 Pressure]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) handle ambiguous cases where evidence conflicts; (2) manage cases involving staff, partners or regulators; (3) make and revise judgements under pressure; (4) communicate uncertainty to decision-makers.
8.1 Ambiguity
Difficult cases are those where evidence points in several directions, stakes are high and time is short. The SOC must decide without certainty and revise as evidence arrives. The partner case is Meridian's example: its own logs were consistent with approved overtime, while the partner's SOC suspected misuse, and policyholder health data might already be outside Meridian. Daniel's team had to act before knowing which story was true, using the expected-cost reasoning from the contractor incident and written hypotheses to guide what to collect next.
8.2 Case one: the partner
A claims-processing partner reports that one of its staff may have copied Meridian policyholder data. Meridian's logs show the partner account accessed 2,300 records over a weekend, within its contract scope but at an unusual time. The access sat within contract scope, so nothing in Meridian's logs proved wrongdoing; the unusual weekend timing and the partner's own report raised the question. Meridian could see what its systems recorded but not what happened to the data once the partner's staff had it. The case therefore depended on the partner's evidence and the contract's incident clause.
8.3 Conflicting evidence
The partner says the weekend work was approved overtime; the partner's own SOC suspects misuse. Meridian cannot see the partner's internal systems. Daniel writes both explanations down as hypotheses and lists the evidence that would separate them: an overtime approval record from the partner's manager would support the first; an export copied to removable media would support the second. Meridian cannot gather the latter itself, so the request under the incident clause names exactly what the partner should provide and by when.
8.4 Actions
Daniel's team preserves Meridian's logs, suspends the partner account's export rights pending review, informs the DPO and legal, and asks the partner for its evidence under the contract's incident clause. Suspending export rights, not the whole account, follows the reasoning of the contractor incident: it limits further harm while leaving the partner's legitimate claims work running. Informing the DPO early starts the record of awareness time, which matters if the case becomes notifiable. The request for evidence cites the contract clause, so the partner knows its obligation and the deadline for meeting it.
8.5 Communicating uncertainty
To the CISO, Daniel writes: "We know the account accessed 2,300 records within scope at unusual hours. We do not yet know whether data was copied. Likelihood of misuse: moderate, based on the partner SOC's concern. Next update: 18:00." The message separates what is known from what is not, gives a likelihood with its basis, and sets a time for the next update. The CISO can act on it without having to ask what each phrase means. A fixed update time also stops repeated calls for news.
8.6 Revising
The partner's evidence shows a USB copy of an export. The case becomes a confirmed breach; notification begins. Because export rights had already been suspended, the confirmed breach did not grow while the evidence was gathered. The awareness time recorded when the DPO was first informed allowed legal to calculate notification deadlines accurately. Daniel's earlier message to the CISO had said moderate likelihood, which the outcome did not contradict, and the review later judged the suspension a sound decision made before certainty.
8.7 Pressure
Under pressure, teams jump to conclusions or freeze. Written hypotheses and update times keep thinking clear. In the partner case, Daniel's written hypotheses kept the team from settling on overtime simply because it was the comfortable explanation, and set update times stopped the team from waiting indefinitely for certainty. The CISO received updates on schedule even when there was little new, so leadership did not fill the silence with its own assumptions. The same habit applies on any night with a difficult alert.
Regulators
When a breach is confirmed, the DPO leads contact with the regulator. The SOC supplies a factual timeline and evidence list, and answers follow-up questions through the DPO so statements stay consistent.
Worked example
In the review, Daniel notes that suspending export rights early, before certainty, limited further harm with little cost to the partner's legitimate work — consistent with the expected-cost reasoning of chapter 1.
Synthetic case. The case is invented.
Errors and limits
Cross-organisation evidence is often incomplete; contracts determine what can be obtained.
Exercises
- EX036 — Defining difficulty. What makes a SOC case difficult? Rubric: 3 = conflicting evidence, high stakes, short time; 2 = two; 1 = one; 0 = none.
- EX037 — Initial actions. List the initial actions in the partner case. Rubric: 3 = preserve logs, suspend export rights, inform DPO and legal, request partner evidence; 2 = three; 1 = one; 0 = none.
- EX038 — Uncertainty message. What elements did Daniel's message to the CISO contain? Rubric: 3 = known facts, unknowns, likelihood with basis, next update time; 2 = three; 1 = one; 0 = none.
- EX039 — Revision. What evidence changed the case? Rubric: 3 = partner showed USB copy of export; 2 = partial; 1 = vague; 0 = none.
- EX040 — Early suspension. Why was early suspension justified in hindsight and at the time? Rubric: 3 = limited harm at low cost under uncertainty; 2 = partial; 1 = hindsight only; 0 = none.
Synthesis
Difficult cases demand early proportionate action, clear communication of uncertainty and willingness to revise.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →