OpenCyber AcademyLesson map
Lesson 13. Map, example, EX059.
flowchart TD
R["Rule removed"] --> A["Send from the usual address"]
A --> M["Two short sentences"]
M --> Q{"Does the text name a phone number or the attack?"}
Q -->|No| K["Keep the warning as written"]
The warning tells clients what to do. It does not brief them on the mailbox.
Logical drawing
when: after the rule is removed
from: the firm's usual address, not Elaine's
contains: no phone number, no blame, no attack steps
not the same document as: the regulator report or the fraud report
Learning outcomes
After this chapter, you should be able to:
- State when the warning was sent and from which address.
- Say what the warning refuses to include.
- Keep it separate from the regulator report.
13.1 The warning is a rule for clients. The reports are other documents.
Partners approved a short email from the firm's main address to all clients. Leo sent it after the forwarding rule had been removed, so a criminal still holding the old rule could not read or answer those replies. The address is the firm's usual address, not Elaine's. The text gives one standing rule: bank-detail changes do not arrive by email, and a doubt is settled by phoning the usual number. The words are already fixed in chapter 3. This chapter does not reprint them as a new draft, and it does not add a digit.
No phone number is printed. Adding one would invent a contact the book does not contain. No technical detail is included, and no one is blamed. An attack description would turn the warning into a report. The national fraud report and the regulator report are separate acts. The regulator report used the incident log because client financial details were in the mailbox. Clients do not receive that log.
The warning also depends on order. If it had gone out before 10:11, replies could still have matched the rule and left the firm. Removal first is why the send is safe enough to attempt. "Safe enough" here means the known forwarding path is gone. It does not mean the firm has nothing left to watch.
Lesson table; scroll horizontally to read all columns →
| Choice | Warning | Incident log |
|---|---|---|
| Audience | Clients | Adviser, partners, lessons review |
| Address | Firm's usual address | Not an email |
| Attack detail | Absent | Times and actions |
| Phone number | Absent | Absent |
13.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered addition | Why it fails or stands | Decision |
|---|---|---|
| Usual address, after the rule is gone | Matches the send conditions | Keep |
| The standing rule about bank details | The warning's job | Keep |
| A printed phone number | None is in the book | Refuse |
| A description of the Brazil sign-ins | That belongs in the log, not the warning | Refuse |
Synthetic case. The warning is not a client-facing incident report.
Errors and limits
Do not invent a telephone number to make the warning look complete.
Apply
- EX059 — What stays out. From where is the warning sent, what must already have happened to the rule, and which details stay out of the text?
Show marking criteria
Rubric: 3 = firm's usual address, not Elaine's; sent after the rule is removed; no phone number, no blame, and no attack description;; 2 = the address and the timing stay, and the phone number stays out;; 1 = one condition;; 0 = none.