Chapter 8 — Supervised case analysis
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 The case file"]
N2["8.2 Facts versus guesses"]
N3["8.3 Next steps inside ROE"]
N4["8.4 Escalation"]
N5["8.5 ATT&CK label"]
N6["8.6 Writing for the case file"]
N7["8.7 Time to escalate"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 The case file"]
N2["8.2 Facts versus guesses"]
N3["8.3 Next steps inside ROE"]
N4["8.4 Escalation"]
N5["8.5 ATT&CK label"]
N6["8.6 Writing for the case file"]
N7["8.7 Time to escalate"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 The case file]
|
v
[8.2 Facts versus guesses]
|
v
[8.3 Next steps inside ROE]
|
v
[8.4 Escalation]
|
v
[8.5 ATT&CK label]
|
v
[8.6 Writing for the case file]
|
v
[8.7 Time to escalate]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) analyse a synthetic HCU case file; (2) separate facts from guesses; (3) propose next authorized steps; (4) escalate when needed.
8.1 The case file
A synthetic packet holds: ROE excerpt, three validated findings, activity log, and a note that a staff member reused the VPN password on a personal email (reported by the staff member). The packet is labelled ENG-440 and held in the vault, and it holds facts, guesses and actions in labelled lines. The password-reuse note is marked as staff-reported, not as something Leo discovered by touching personal email, which stays out of scope. The report goes to the CISO as a staff-awareness issue, because the reuse concerns accounts outside the engagement.
8.2 Facts versus guesses
Fact: password reuse was reported. Guess: an attacker already has the password. Leo labels guesses clearly: his case file says Fact for the report and Guess for any claim that an attacker already has the password. Guesses may drive next steps, but they are never written as confirmed findings. The case note's Guesses line reads none about external abuse yet, which is all the evidence supports. If SOC log review later shows unusual VPN sessions, the guess can move to Fact with the log extract attached.
8.3 Next steps inside ROE
Force VPN password reset for that account; check VPN logs for unusual sessions; do not touch personal email (out of scope). Leo requests a VPN password reset for that account and asks the SOC to check logs for unusual sessions. The reset request goes through an IT service desk ticket linked to ENG-440, so the timeline stays in one place. Personal email is out of scope, so he does not contact the provider or request that inbox's logs. The staff member who reported the reuse changes the personal password themselves; HCU never touches that account.
8.4 Escalation
Member-data exposure risk and password reuse across personal services go to the CISO the same day. Same-day escalation gives the CISO time to order VPN resets and communications before the risk spreads beyond the staff-reported reuse case; waiting for the weekly finding meeting would be too slow for member-data exposure. The CISO receives the note by phone and email before the end of the working day. Leo escalates with a one-page timeline of facts, guesses labelled as guesses, and the next safe action, not frustration alone.
8.5 ATT&CK label
Password reuse enabling VPN access maps to T1078 Valid Accounts for the SOC's detection search. Leo adds T1078 to the case note so the SOC can search with a shared name. The label describes the behaviour; it does not prove an external attacker was involved. The SOC uses the technique name to pull its existing T1078 detections for the VPN rather than writing new ones in a hurry. If the hunt finds nothing, the report says no unusual sessions were seen in the reviewed range, not that the account was never misused.
8.6 Writing for the case file
Case notes use timestamps, ticket ids and labels Fact/Guess/Action. Free-form narrative is fine for the summary, but the labelled lines are what the CISO and auditors can scan in a minute during an incident. During the password-reuse incident, each labelled line starts with a timestamp and the ENG-440 ticket id, so the CISO can sort facts, guesses and actions at a glance without reading a long narrative first. Leo still writes a short summary for people who need the story; it runs to three or four sentences and sits above the labelled lines, never in place of them.
8.7 Time to escalate
Leo uses a simple rule: if member funds, large-scale personal data or safety systems might be affected, escalate within an hour. Lower-impact items follow the normal finding process. Password reuse that could open the VPN sits under that one-hour rule because member data might follow. The clock starts when Leo reads the staff report, and the CISO call is logged with its time against that start. The low-impact outdated banner on staging goes into the ENG-440 report with app-sec's normal due date, not to the CISO's phone.
8.8 SOC collaboration on the case
Leo shares the ATT&CK technique and account id with the SOC so they can hunt, but he does not paste member PII into the ticket. Hunt queries use the VPN account handle and time range from ENG-440. The SOC ticket holds the account handle, the time range and T1078, and nothing that identifies a member: names, national ids and full account numbers stay out of the SOC ticket and out of chat screenshots. Screenshots from the hunt are cropped to the session columns before they enter the vault.
Worked example (synthetic HCU)
Leo's case note: "Facts: staff report of VPN password reused on personal email; Findings F1–F3 validated. Guesses: none about external abuse yet. Actions: reset, log review, CISO brief. Out of scope: personal email content."
Synthetic case — Harborline Credit Union (HCU). The credit union, Leo Okonkwo and all figures are invented for teaching.
Errors and limits
Local policies and laws differ; follow HCU's authorization and your jurisdiction. This book never authorizes testing of real systems.
Exercises
- EX036 — Fact extract. List two facts from the case file. Rubric: 3 = two clearly factual items; 2 = one; 1 = guess as fact; 0 = none.
- EX037 — Guess label. Rewrite "attackers definitely have the password" as a labelled guess. Rubric: 3 = labelled uncertainty; 2 = partial; 1 = still certain; 0 = none.
- EX038 — Out of scope action. Why not read the staff member's personal email? Rubric: 3 = out of scope / no authorization / privacy; 2 = partial; 1 = should read; 0 = none.
- EX039 — Same-day escalate. What triggers same-day CISO escalation here? Rubric: 3 = credential reuse risk to VPN/member services; 2 = partial; 1 = vague; 0 = none.
- EX040 — ATT&CK. Which technique name helps the SOC search detections for this case? Rubric: 3 = T1078 Valid Accounts; 2 = name only; 1 = wrong; 0 = none.
Synthesis
Case work separates facts from guesses, acts only inside scope and escalates real risk the same day.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →