OpenCyber AcademyDay 33 — Separate hold renewal, task authority and the expiry risk decision
Learning task. Reconstruct which authority enabled which change, then bound what C24 establishes through 10:07. A temporary protective control and a mechanism-specific correction have different targets, costs and verification questions. Keeping the hold active does not disable the scheduler; disabling one task does not remove a recovery method or prove all write routes safe. A reviewer must be able to follow each approval to its operator record without borrowing authority from a neighboring row.
Chronological C24 release. At 09:59 the response lead and service owner approve disabling only sync-override, after the application custodian preserves its configuration and bounded run record. At 10:03 the authorized application operator records the task disabled, a read-only scheduler status agrees, and no further run is observed through 10:07. These statements support a specific execution report, corroborating immediate state and a short quiet window. The cards do not supply a known next scheduled opportunity, fleet-wide inventory or a completed legitimate batch-17 functional test. Do not fill these fields with success because the disabled flag is visible.
The hold remains under its own C21 approval. At 10:06 the owner reviews current cost and risk: the task is disabled, no new S42 edits are observed since C19, and further hold time would continue to block legitimate enrollment. The owner chooses no renewal beyond 10:07, with read-only S42 monitoring and escalation for another unexpected edit. That is a documented acceptance of residual exposure under a monitoring/stop rule. It is not proof that recovery-method access, alternate writes or re-registration are impossible. A planned automatic expiry also needs the actual boundary behavior checked; the case's authorized end and monitoring decision should not become an invented all-route post-expiry test.
Lesson table; scroll horizontally to read all columns →
| Authority or observation | Supported transition | What it cannot authorize or prove |
|---|---|---|
| C17 09:37; expiry 09:47 | Initial S42-only hold approval. | Later extension, task disablement or account-wide action. |
| C18 09:39; C19 09:42 | Reported hold activation; one S42 denial and S40 acceptance. | Continuous enforcement or every route/S41 outcome. |
| C21 09:46:30 / 09:46:45 | New hold-extension approval / operator receipt to 10:07. | An eradication action or indefinite continuation. |
| C24 09:59 / 10:03 | Task-only approval after preservation / report and corroborating status. | Method removal, durable nonrecurrence or legitimate-job test success. |
| C24 10:06 / 10:07 boundary | No further hold renewal; read-only monitoring/escalation decision. | Universal safety or authority to alter business data. |
Worked interval example. 09:46:30 precedes C17's 09:47 expiry; the reported extension at 09:46:45 also precedes it. Thus the supplied sequence does not itself show an authorization gap at that boundary. It still does not demonstrate uninterrupted protective effect: receipts are not continuous route tests. The 10:03–10:07 observation lasts four minutes under the supplied clock. “Four minutes without a run” is not a recurrence-test pass unless a known invocation opportunity and reliable source coverage make absence informative. An hourly task could remain quiet while still capable of running later; that schedule is an illustrative possibility, not CTN schedule metadata.
Contrast. “C17 approved containment until the incident ends, C20 authorized the task shutdown and C24 eradicated all access” combines three unsupported expansions. The correct timeline assigns the extension to C21, the task-only operation to C24 and the unresolved identity/recurrence questions to pending work. Renewing or rolling back a control needs the applicable owner procedure, not an analyst's desire for a clean ending.
Offline practice. Build the five timeline rows above from cards, then hide their model text and reconstruct them. For each, mark authority, operator report and effect evidence in different cells. In a separate hypothetical version move the extension receipt after 09:47; identify a potential implementation continuity question without rewriting approval time or claiming a bypass occurred. The hypothetical receipt is not a case event. Complete EX033 and compare its worked answer.
Limits and decision. At 10:07, hand off task-specific improvement plus residual exposure. Preserve monitoring ownership and escalation on a new unexpected S42 write or task reappearance. No later recovery or identity action is available to justify this decision retrospectively.
Previous: Day 32 · Week 7 index · Course index · Next: Day 34.
Exercise for this lesson
EX033 — Time-bounded hold review. Objective: bind each authorization and receipt to its exact target and window. Inputs: C16–C24 through 10:07 and Day 33. Build the initial hold/activation/one-route timeline, C20 release, C21 new approval and g-23 receipt, C24 preserved task-only approval/execution/status, 10:06 nonrenewal and 10:07 boundary. Calculate the four-minute task observation and distinguish authority continuity from verified protective continuity. State remaining identity, recurrence and service-test gaps without a later result. Rubric: 0 = stretched expiry, borrowed task authority or invented all-route remediation; 1 = accurate events but incomplete scope/interval/residual risk; 2 = source-bound timeline and fixed expiry with every pending gate retained. Worked answer.