Choose a proportionate control with a falsifier | Professional Incident response and cyber resilience

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Day 3 — Choose a proportionate control with a falsifier

Learning decision. Compare what a control might prevent with what it might break, given the evidence available now. A narrow control is not automatically harmless, and a broad control is not automatically more effective. At C02's 09:04 checkpoint, S42 is reported unavailable; cause, actor and authoritative state are unknown. It would be logically invalid to justify a session restriction using cards released in Chapter 3. Start with A, a bounded read-only state and owner question. Keep B and C as conditional alternatives. Escalate promptly if retention or ongoing harm is credibly time-sensitive, but do not convert urgency into authority.

For every option, write harm potentially avoided, legitimate harm introduced, precondition missing, and two falsifiable observations: one for the protective goal and one for legitimate service. The second observation matters because a control could block the suspected action while also blocking enrollment for all learners. State the measurement route. A tool's success response can confirm an API call returned; it cannot establish that the business effect occurred on every route. The later containment chapter will test route coverage, but Chapter 2's task is to demand an acceptable evidence and authorization plan before proposing that intervention.

Lesson table; scroll horizontally to read all columns →

Option at C02 only	Potential benefit	Presently missing	Protective check if ever approved	Legitimate-service check
A. Owner-approved S42 state check	Avoids blind disruption; may clarify scope	Custodian permission and authoritative result	Named state/version returned with source metadata	No service change requested; check that normal enrollment continues
B. Restrict one session	Could stop activity from that session	Identified relevant session, causal link, exact approval	Named session can no longer perform the prohibited action on tested route	Approved ordinary user and scheduled path still work
C. Disable shared account	Could stop all uses of that account	Evidence it causes harm, broad risk acceptance, rollback plan	All intended account uses blocked on tested routes	Critical enrollment and recovery dependencies have owner-accepted alternatives

Worked contrast. With only C02, a proposal to disable svc-enroll because its name sounds related to enrollment has no established causal path and threatens the shared write dependency. Select A and name the review trigger: a verified authoritative S42 state, relevant source receipts, or a confirmed imminent loss window. In a different W2 training branch, imagine a permitted audit actually joins lab-session-7 to repeated prohibited writes and the service owner confirms a safe alternative for scheduled work. B may then become a candidate, but it is still only a proposal until the exact session, expiry, identity/service approvals, operator and independent checks are recorded. The W2 evidence cannot be transferred into CTN's 09:04 decision.

There is no reliable single-number score here. If harm probabilities or dependencies are unknown, an unexplained “risk 7/10” disguises assumptions. Record the unknowns and a test that could change the choice. If the platform cannot restrict only the selected session, that is a new option, with new potential harm and approval scope; do not silently execute C under the label B. This follows the risk-management framing of NIST SP 800-61 Rev. 3, while the specific A/B/C analysis is OpenCyber Academy's fictional case work.

Practice. Complete EX008. Produce a four-cell comparison for each choice and add a protective and a legitimate-service check that could fail. Select an option for C02-only evidence, then name one new observation that would require a fresh comparison. Use the worked answer and its Week 2 result. Limit: a proposed test is not a pass, and one route does not establish whole-service protection. Previous: Day 2 · Week index · Next: Day 4.

Exercise for this lesson

EX008 — Option comparison. Input: choices A, B and C in §2.4. Produce the four-cell comparison for each and select the most defensible first step at 09:04. A 2-point result explains why a later checkpoint might change the selection.

EX008 — Model comparison. A, bounded triage: harm avoided = reduces mistaken disruption; harm introduced = analyst time; uncertainty = present S42 state; verify with owner-authorized read-only check. B, targeted session restriction: possible ongoing-use reduction; risk = breaks an automation session; uncertainty = session-to-harm relation; verify by scoped session status and service-health checks after approval. C, account/tenant change: broader possible restriction; risk = all enrollment writes or other services fail; uncertainty = whether shared account caused anything; verify broad policy state, service checks and rollback. At 09:04 select A because C02 alone supports a symptom, not an identified malicious session. A newly verified destructive action could change the balance, subject to owner approval.

Additional worked reasoning (EX008 — Alternative decision calculation.): Option A sacrifices a short analyst interval but improves service-truth evidence without service shutdown. Option B may affect one future named session, but C02 lacks its identifier and causal relevance. Option C affects all shared-account enrollment paths and carries the largest unknown blast radius. The correct choice can be provisional A while explicitly naming what new source and event would justify a different option. State separate protective and legitimate-service tests for B/C; a dashboard result alone is insufficient.

Week 2 applied result (EX008). Select A at C02-only 09:04, pending a custodian-authorized state result. Its potential protective result is a named S42 state/version with source metadata; a broad, unauthenticated screenshot would fail that requirement. For B, name the missing live session and causal link, and propose a route-specific prohibition test plus a normal-user and scheduled-path acceptance test after a real scoped approval. For C, name broad identity/service/change ownership, the expected loss of enrollment writes, and dependent-service/rollback checks; the account label alone cannot justify it. In a separately labeled W2 branch, a later validated lab-session-7 link could make B a candidate, but no candidate becomes an executed result. If the platform only offers account-wide scope, compare a new C rather than calling it B.