OpenCyber AcademyDay 13 — Assign response effort separately from causal confidence
Mechanism and assumptions. A priority label selects a workload and coordination path under a local policy. It is not a measured probability of compromise. Keep four judgments visible: reported/verified service impact, confidence in a particular causal explanation, time sensitivity of useful evidence, and the cost of a proposed action. Combining them into an unexplained score would conceal why a low-confidence case can still require urgent preservation. The chapter's P1/P2/P3 definitions are classroom choices. NIST SP 800-61 Rev. 3 places response within cybersecurity risk management; it does not assign these CTN labels or authorize an account change.
Evidence at 09:14. The S42 symptom and C05 edit make meaningful service harm plausible, but no authoritative state or affected-user count has been supplied. C06 shows a retrieved approval for S40/S41, not a complete search of every approval. C07 weakens human attribution because the account has multiple uses. C08 reports a 10:00 evidence-expiry condition. From 09:14 to 10:00 there are 46 minutes of nominal remaining time under that statement. This is not a guaranteed retrieval budget: approval, export execution, delivery and checking all take time, and the claim may need clarification.
Worked contrast. Analyst A writes “low confidence; defer until tomorrow.” That ignores the reported evidence window. Analyst B writes “urgent; disable the account.” That ignores service impact and permission. A defensible decision is P2 provisional: request a narrow authorized IdP preservation and a separate current-state S42 comparison now, while keeping disruptive controls behind their own service-owner gate. The decision preserves options without declaring a cause. It remains a request until the proper custodian approves and performs it.
Make the reassessment operational. For this exercise, select 09:25 as an analyst-proposed supervisor checkpoint, not a new case event or a deadline dictated by policy. At that checkpoint ask whether the authorized request has an accepting custodian and an execution/receipt plan before 10:00. If blocked, escalate the authority gap and document what may be lost. Reassess sooner upon a verified state change, a usable source receipt or evidence of major service impact. Merely scheduling a review does not preserve data.
Lesson table; scroll horizontally to read all columns →
| Change in supplied evidence, hypothetical | Decision it could change | Conclusion it would not establish |
|---|---|---|
| Owner verifies major enrollment disruption meeting the classroom P1 threshold | Escalate coordination and priority | Which person caused it |
| Custodian confirms a bounded export is received and checkable | Advance preservation status and review its contents | Whole-case closure or complete source coverage |
| Owner verifies correct state and a scoped approved job | Reconsider impact and benign explanation | That all signals were false or no other path exists |
Practice. Complete EX013 with the four judgments, chosen priority, named roles and an event/time trigger. Compare the worked answer. An alternative priority needs evidence and the stated rubric, not invented policy. Limit: the priority record allocates attention; it cannot measure business impact, authenticate an export or grant emergency powers.
Continue studying — course Day 13: Previous: Day 12 · Week 3 index · Course index · Next: Day 14.
Exercise for this lesson
EX013 — Priority decision. Objective: allocate response effort under uncertainty. Input: C02–C08 at 09:14 and the classroom P1–P3 rubric. Choose a provisional priority; separately state impact, causal confidence, reported expiry urgency and decision cost. Name the roles for the bounded preservation request and S42 state check, their pending authorization, a concrete proposed review time and an earlier evidence trigger. State what would justify raising priority. Rubric: 0 = unsupported compromise/impact or expiry treated as permission; 1 = defensible provisional label but missing owner, action-state distinction or review trigger; 2 = all four judgments support the label, requests remain pending, and the next review can be acted on. A different label needs evidence fitting the supplied classroom rubric; do not invent CTN policy. Worked answer.