Chapter 13 — Digital forensics and malware analysis: risk scenarios
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Scenarios"]
N2["13.2 Likelihood and impact"]
N3["13.3 Evidence needed"]
N4["13.4 Gaps to readiness tasks"]
N5["13.5 Prioritising"]
N6["13.6 Review"]
N7["13.7 Communicating"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Scenarios"]
N2["13.2 Likelihood and impact"]
N3["13.3 Evidence needed"]
N4["13.4 Gaps to readiness tasks"]
N5["13.5 Prioritising"]
N6["13.6 Review"]
N7["13.7 Communicating"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Scenarios]
|
v
[13.2 Likelihood and impact]
|
v
[13.3 Evidence needed]
|
v
[13.4 Gaps to readiness tasks]
|
v
[13.5 Prioritising]
|
v
[13.6 Review]
|
v
[13.7 Communicating]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) build risk scenarios relevant to forensic readiness; (2) estimate likelihood and impact; (3) identify evidence needed for each scenario; (4) prioritise readiness work.
13.1 Scenarios
Jonah writes four scenarios for Alder Falls: ransomware on file servers; insider data theft from the permits system; account takeover via phishing; compromised desktop used for lateral movement (as in the current case).
Each scenario is written as a short story with an entry point, what the attacker does and what the city would lose. The lateral movement scenario mirrors the current case: a desktop is controlled remotely, local admin access spreads to others and personal data is exported. Grounding one scenario in a real incident keeps the exercise honest, while the others cover risks the city has not yet faced.
13.2 Likelihood and impact
Each scenario is rated on a simple scale with reasons. Lateral movement: likely (shared local admin passwords, flat network); impact high (permits data reachable).
Jonah uses three levels for each, low, medium and high, and writes one sentence explaining every rating, such as the shared local admin passwords that make lateral movement likely. The reasons matter more than the labels: if the city rotates those passwords, the likelihood rating should fall, and the written reason shows why. Ratings without reasons cannot be updated sensibly.
13.3 Evidence needed
For lateral movement: desktop security logs with logon types and sources, firewall internal logs, memory from source and target. Currently, desktop logs are local only and firewall logs only cover internet traffic.
Listing the evidence each scenario needs exposes the gaps plainly. For lateral movement, two of the three sources are weak: desktop logs stay on the desktops and the firewall does not log traffic between internal machines. The current case shows the cost; the logons on CLERK-03 were visible only after the desktop itself was examined.
13.4 Gaps to readiness tasks
Each missing evidence source becomes a readiness task with an owner: forward desktop logs; enable internal firewall logging between VLANs; pre-install memory capture tooling on key desktops.
Each task has an owner, a target date and a short note of which scenario question it answers. Forwarding desktop logs serves lateral movement and insider theft; internal firewall logging serves lateral movement and ransomware; pre-installed memory tools serve every scenario. Tasks serving several scenarios rise naturally in priority. A gap without an owner tends to stay open until the next incident finds it again.
13.5 Prioritising
Tasks that close gaps in the most likely, highest impact scenarios go first.
Jonah adds cost to the comparison: a task that is cheap and closes a gap in a likely, high-impact scenario goes first, even if a more expensive task closes a slightly bigger gap. Forwarding desktop security logs scores well on all three. The resulting order is presented with its reasoning so managers can challenge it. Tasks that need new purchases are scheduled for the next budget cycle, while configuration changes the city can make now are started at once, so progress does not wait on funding.
13.6 Review
Scenarios are reviewed yearly and after incidents.
After the CLERK-03 case, Jonah revises the lateral movement scenario with what was learned: the entry was a remotely controlled desktop rather than a phishing email, and the data left through a file-sharing service. Updating the scenario keeps the readiness plan tied to how attacks actually happened here, not only to how they were imagined. He dates each revision and notes which incident or review prompted it. Scenarios nobody has revisited for a year are flagged in the review.
13.7 Communicating
A one-page summary for the IT manager: scenarios, gaps, tasks, costs.
The summary leads with the gap that most affected the current case, desktop logs held only locally, and its cost in investigation hours, before listing the other tasks. Managers decide on budgets, so each task shows a rough cost and the scenario it serves. Technical detail goes in an appendix for the IT team. The summary ends with a clear request: approval for the first three tasks and a date to review progress. Managers can say yes or no to that, whereas a long list of gaps invites delay.
Tabletop test
Jonah runs a 45-minute tabletop with the IT team on the ransomware scenario: who isolates, who captures memory, where logs are, who calls the data protection officer. The exercise reveals that nobody knows where the memory capture tool is kept. It is moved to a labelled drive in the IT office safe, and the scenario sheet is updated with its location.
Worked example
For insider theft, Jonah notes the permits application logs exports by user but keeps them only 30 days. The mfoster export would have been lost if discovered a month later. Task: extend application log retention to 12 months and forward centrally.
Synthetic case. The scenarios are invented.
Errors and limits
Scenario lists are never complete; include a generic "unknown" scenario served by broad logging.
Exercises
- EX037 — Lateral evidence. What evidence does the lateral movement scenario need? Rubric: 3 = desktop logon logs, internal firewall logs, memory; 2 = two; 1 = one; 0 = none.
- EX038 — Retention task. What insider-theft gap was found and fixed? Rubric: 3 = 30-day app log retention; extend to 12 months, forward; 2 = partial; 1 = vague; 0 = none.
- EX039 — Unknown scenario. Why include an "unknown" scenario? Rubric: 3 = lists incomplete; broad logging covers unforeseen; 2 = partial; 1 = no reason; 0 = none.
Synthesis
Risk scenarios turn evidence gaps into prioritised readiness tasks.
Continue studying — chapter 13 of 30
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →