Chapter 9 — Handling incidents | Professional Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Handling incidents

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 A short procedure"]
  N2["9.2 A mailbox takeover"]
  N3["9.3 Deciding on notification"]
  N4["9.4 Learning afterwards"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 A short procedure"]
  N2["9.2 A mailbox takeover"]
  N3["9.3 Deciding on notification"]
  N4["9.4 Learning afterwards"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 A short procedure]
    |
    v
[9.2 A mailbox takeover]
    |
    v
[9.3 Deciding on notification]
    |
    v
[9.4 Learning afterwards]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) write a short incident procedure; (2) follow it during a synthetic incident; (3) decide when to notify clients or regulators.

9.1 A short procedure

Daniel writes a two-page procedure covering the first hours of an incident: who to call, how to contain the problem, what to record and who decides on notifications. It names Daniel as coordinator, the support company as technical responders and Mrs. Pike as decision maker for anything involving clients or regulators. Ms. Ashby reminds him that a procedure nobody can find is useless, so he prints copies for each office and saves one where it can be reached even if email is down, along with all the key phone numbers.

9.2 A mailbox takeover

Three weeks later, a partner's assistant reports that clients have received an odd message from her account asking them to open a document. Daniel follows the procedure. The support company resets the password, ends all active sessions, enables a second factor and removes a forwarding rule the attacker had added, which sent copies of all incoming mail to an outside address. Daniel records each step with times. He then asks the support company to check whether the attacker read or downloaded any client documents during the period the account was controlled.

9.3 Deciding on notification

The review shows that the attacker's forwarding rule copied about two weeks of incoming mail, including some messages with client identity documents attached. Mrs. Pike, with advice from the firm's data protection adviser, decides that the affected clients must be told and that the regulator must be notified within the legal time limit. Daniel prepares a factual list of affected clients and the type of documents involved. Ms. Ashby notes that the forwarding rule turned a nuisance into a reportable breach, which is why checking for such rules is a standard step.

9.4 Learning afterwards

A week later, Daniel holds a short review with the people involved. The cause was a stolen password on an account without a second factor; the assistant had been on the list for the next stage of the rollout. The firm brings forward the rollout for all remaining staff and adds a monthly check for forwarding rules to outside addresses. Daniel writes a one-page summary for the partners, without blaming the assistant, who reported promptly. Ms. Ashby praises the review for focusing on fixing the conditions that allowed the incident rather than on the individual.

Worked example

Daniel's procedure guides a synthetic mailbox takeover: sessions ended, a forwarding rule removed, clients and the regulator notified, and the second-factor rollout brought forward.

Synthetic case. The incident and clients are synthetic.

Errors and limits

Resetting a password without removing forwarding rules leaves the attacker still receiving mail.

Exercises

EX041 — Coordinator. Who coordinates incidents at Corbridge? Rubric: 3 = Daniel;; 2 = partly correct;; 1 = other;; 0 = none.
EX042 — Hidden rule. What had the attacker added to the mailbox? Rubric: 3 = a forwarding rule to an outside address;; 2 = partly correct;; 1 = vague;; 0 = none.
EX043 — Notify why. Why did the incident become reportable? Rubric: 3 = forwarded mail held client identity documents;; 2 = partly correct;; 1 = vague;; 0 = none.
EX044 — Root cause. What was the root cause? Rubric: 3 = stolen password without a second factor;; 2 = partly correct;; 1 = partial;; 0 = none.
EX045 — New check. What monthly check was added? Rubric: 3 = forwarding rules to outside addresses;; 2 = partly correct;; 1 = vague;; 0 = none.

Continue studying — lesson 09 (chapter 09 of 12)

← Chapter 08 · Course chapter index · Chapter 10 →

Continue to the next authored lesson.