Chapter 2 — Digital forensics and malware analysis: service and stakeholder context
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Services in the case"]
N2["2.2 Stakeholders"]
N3["2.3 Continuity"]
N4["2.4 Communication levels"]
N5["2.5 Supplier contact"]
N6["2.6 Record of contacts"]
N7["Expectations"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Services in the case"]
N2["2.2 Stakeholders"]
N3["2.3 Continuity"]
N4["2.4 Communication levels"]
N5["2.5 Supplier contact"]
N6["2.6 Record of contacts"]
N7["Expectations"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 Services in the case]
|
v
[2.2 Stakeholders]
|
v
[2.3 Continuity]
|
v
[2.4 Communication levels]
|
v
[2.5 Supplier contact]
|
v
[2.6 Record of contacts]
|
v
[Expectations]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) map the services involved in an incident; (2) identify stakeholders and what they need; (3) balance investigation with business continuity; (4) communicate at the right level.
2.1 Services in the case
Marlow uses a cloud email and identity service, a web proxy for office traffic, a finance system for supplier payments, and a helpdesk. Each holds records the investigation may need, and each has an owner. In this case the email and identity service holds sign-in logs, mailbox audit records, inbox rules and message trace. The proxy shows Joy's visit to the look-alike page at 09:10. The finance system shows whether Kestrel's bank details were changed, and the helpdesk ticket records IT's reset at 10:05. Lena notes each owner beside the records she needs, so requests go to the right person.
2.2 Stakeholders
Joy needs her account back and reassurance. Finance needs to know whether any payment changed. Kestrel needs confirmation the email was fake. IT operations need clear actions. Management needs impact and risk. The data protection lead needs to know whether personal data was exposed. Lena writes these needs in her stakeholder table before contacting anyone, because each answer depends on different records. Finance's question is answered from the finance system at 10:40, Kestrel's by a phone call at 10:50, and the data protection lead's only after the eleven forwarded subjects have been listed from message trace.
2.3 Continuity
Accounts must keep paying suppliers. Dev agrees that Joy's account is secured immediately but a colleague handles her payments for the day, so business continues while evidence is gathered. Securing the account came first because the attacker's session could still send mail, but stopping supplier payments altogether would have harmed Marlow and its suppliers more than the incident had. The colleague who covers Joy's payments works from her own account, so none of the payment work touches the mailbox under examination. Dev records the arrangement in the ticket so finance knows who to call that day.
2.4 Communication levels
Technical detail goes to IT; plain summaries to managers; a short factual confirmation to Kestrel. Lena drafts; Dev approves anything sent outside the security team. In practice, IT receives the exact actions with times: reset at 10:05, the rule to remove only after export, and the address 203.0.113.50 and the look-alike domain to block. Managers receive what happened, whether money moved and when the next update will come. Kestrel receives only that the bank-change email was fake and should be ignored. Lena keeps each draft in the ticket alongside the time Dev approved it.
2.5 Supplier contact
Kestrel's finance team did the right thing: they phoned a known number to check. The response confirms by phone too, never by replying to the suspicious email. A reply to the 09:40 email would have gone to a mailbox the attacker had just used, and any confirmation could have been read before the reset. Marlow's finance manager therefore phones Kestrel at 10:50 on a number already held in the supplier record, not one taken from the email. Lena logs the call with time and caller, and the end-to-end review later names Kestrel's own check as the decisive defence.
2.6 Record of contacts
Every stakeholder contact is logged with time, person and content. Lena's contact log for 3 March holds entries such as finance confirming at 10:40 that no supplier record had changed, the finance manager's 10:50 call to Kestrel and the 11:30 briefing for the data protection lead. Each line says who spoke, by what channel and what was said or agreed. Recording contacts as they happen, not from memory at the end of the day, keeps the timeline accurate. The log also shows when promised updates were due, so a missed noon update would be visible to Dev. When the report is written, these entries support the actions-taken part without anyone reconstructing conversations.
Expectations
Lena tells each stakeholder when the next update will come. A promised update at noon, even if it says only 'no change', keeps trust better than silence.
Worked example
Lena's stakeholder table lists Joy (account restored, told what happened), finance (checked no supplier records changed — confirmed 10:40), Kestrel (phoned 10:50 by finance manager; email was fake), IT (reset and session revocation done 10:05), data protection lead (briefed 11:30 because the forwarded mail contained supplier contact names).
Synthetic case. Marlow's services and people are invented.
Errors and limits
Stakeholders may want answers before evidence supports them; say what is known and when more will follow.
Exercises
- EX006 — Services. List four services relevant to the case. Rubric: 3 = email/identity, proxy, finance system, helpdesk; 2 = three; 1 = one; 0 = none.
- EX007 — Stakeholder needs. Match three stakeholders to what they need. Rubric: 3 = e.g. finance – payment status; Kestrel – confirmation; DPO – personal data exposure; 2 = two; 1 = one; 0 = none.
- EX008 — Continuity choice. How did Marlow keep paying suppliers? Rubric: 3 = a colleague handled payments while Joy's account was secured; 2 = partial; 1 = stopped payments; 0 = none.
- EX009 — Confirming with Kestrel. Why phone rather than reply by email? Rubric: 3 = suspicious channel may be controlled by attacker; use known number; 2 = partial; 1 = faster; 0 = none.
- EX010 — Data protection. Why was the data protection lead briefed? Rubric: 3 = forwarded mail held supplier contact names (personal data); 2 = partial; 1 = routine; 0 = none.
Synthesis
Know the services and stakeholders, keep the business running and pitch each message to its reader.
Continue studying — chapter 02 of 12
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →