◇ OpenCyber Academy
Rapid course · Chapter 3 · English

Chapter 3 — Acting fast and calmly

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Acting fast and calmly

Lesson map

Lesson 03 published. Map, example, EX027.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Order of actions"]
  N2["3.2 Timing"]
  N3["3.3 Checking the money"]
  N4["3.4 Warning clients"]
  N5["3.5 Reporting"]
  N6["3.6 Recording"]
  N7["Telling staff"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX027"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Order of actions"]
  N2["3.2 Timing"]
  N3["3.3 Checking the money"]
  N4["3.4 Warning clients"]
  N5["3.5 Reporting"]
  N6["3.6 Recording"]
  N7["Telling staff"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX027"]

[Learning outcomes]
    |
    v
[3.1 Order of actions]
    |
    v
[3.2 Timing]
    |
    v
[3.3 Checking the money]
    |
    v
[3.4 Warning clients]
    |
    v
[3.5 Reporting]
    |
    v
[3.6 Recording]
    |
    v
[Telling staff]
    |
    v
[Worked example] --> [Exercise EX027]

Learning outcomes

You will (1) contain a compromised email account in the right order; (2) warn clients without causing panic; (3) check whether money was lost; (4) record actions and times.

3.1 Order of actions

BrightPath's playbook for a compromised mailbox, following the response ideas in NIST SP 800-61r3 (Nelson et al., 2025): sign out all sessions, reset the password, remove the forwarding rule, turn on MFA, then review sent items and rules. Doing the reset before signing out sessions can leave the criminal connected.

Turning on MFA comes after the reset because Elaine must set up the authenticator app on her phone, and that takes a few minutes. The rule is removed before the sent-items review so that no more client replies are forwarded while BrightPath works out which clients received the fake invoice.

3.2 Timing

Leo approves at 10:05 on Monday. Sessions are revoked at 10:08, the password reset at 10:09, the rule removed at 10:11 and MFA enabled at 10:20 once Elaine sets up the app on her phone.

Signing out all sessions at 10:08, before the reset at 10:09, follows the playbook's order, so the criminal could not stay connected with an old session. The full sequence took fifteen minutes from approval to MFA. In the eleven minutes between revoking sessions and enabling MFA, the account was protected by the new password only, which is why Elaine set up the app straight away.

3.3 Checking the money

Leo calls both clients who received the fake invoice. One had not paid; the other had paid £4,800 that morning. Leo tells that client to call their bank immediately; the bank attempts a recall.

Speed matters more than anything else here: a bank recall works best before the money is moved on. The client who had paid that morning called their bank at once, and the bank later recovered £3,100 of the £4,800. Leo also tells the client who had not paid to ignore the email and use the firm's known bank details.

3.4 Warning clients

A short email from the firm's main address to all clients, approved by the partners: "We will never change our bank details by email. If you receive such a request, phone us on our usual number." No technical details, no blame.

The message works because it gives clients a simple rule they can apply without understanding the attack: bank detail changes never come by email, and a phone call to a known number settles any doubt. Leo uses the firm's usual address, not Elaine's, and sends it after the forwarding rule has been removed, so the criminal cannot see or answer replies.

3.5 Reporting

The firm reports the fraud to the national fraud reporting service and, since client contact details in Elaine's mailbox may have been viewed, asks its data protection adviser whether the regulator must be told.

The data protection adviser decided the breach had to be reported because client financial details were in the mailbox, and the report was filed within the deadline. Leo's incident log, with the 23:47 sign-in, the 23:51 rule and the times of each fix, made the report quick to write.

3.6 Recording

Leo records each action with its time in a simple incident log.

Leo's log for the Monday reads: approval at 10:05, sessions revoked at 10:08, password reset at 10:09, forwarding rule removed at 10:11, MFA on at 10:20, and then each client call with its time. Each line names who did it: Leo or BrightPath. The data protection adviser used the log to write the breach report, and the lessons review used it to see which steps were quick and which were slow. Without it, both would have relied on memory a week later.

Telling staff

Staff get a short briefing the same day so they know what happened and what to watch for.

Worked example

The bank recovers £3,100 of the £4,800. The data protection adviser decides the breach must be reported because client financial details were in the mailbox; the report is filed within the deadline. Leo's incident log makes the report quick to write.

Synthetic case. Amounts and times are invented.

Errors and limits

Recovery of paid money is uncertain; speed is the best help.

Exercises

Synthesis

Contain in the right order, chase the money quickly, warn calmly and record everything.

Continue studying — chapter 03 of 04

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →