Chapter 26 — Digital forensics and malware analysis: operational handoff
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Handoff scope"]
N2["26.2 Runbooks"]
N3["26.3 Ownership"]
N4["26.4 Training"]
N5["26.5 Support"]
N6["26.6 Acceptance"]
N7["26.7 Known issues"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Handoff scope"]
N2["26.2 Runbooks"]
N3["26.3 Ownership"]
N4["26.4 Training"]
N5["26.5 Support"]
N6["26.6 Acceptance"]
N7["26.7 Known issues"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Handoff scope]
|
v
[26.2 Runbooks]
|
v
[26.3 Ownership]
|
v
[26.4 Training]
|
v
[26.5 Support]
|
v
[26.6 Acceptance]
|
v
[26.7 Known issues]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) hand a forensic capability over to operations staff; (2) write runbooks and ownership records; (3) train and assess operators; (4) define support after handoff.
26.1 Handoff scope
Triage Kit 2, the log forwarding configuration, the nightly integrity job and the evidence store procedures move from the student team and Renata to the IT operations team for day-to-day ownership.
The student team and Renata built and ran these components during the project; after handoff, operations staff will use and maintain them daily. The scope lists exactly what moves and what stays: Renata keeps responsibility for analysis and decisions about cases, while operations owns the kit, the pipeline, the integrity job and the store procedures. A clear boundary prevents tasks from falling between the two groups.
26.2 Runbooks
Each runbook: purpose, trigger, steps, expected outputs, checks, what to do on failure, contacts. Written for someone competent but unfamiliar.
Writing for someone competent but unfamiliar means no shortcuts that only the author understands. Each step says what to do, what should happen and how to tell if it did not. The failure guidance matters most, because that is when an operator is under pressure. The walk-through showed the integrity-job runbook lacked exactly this detail at the mismatch step. Each runbook carries a version and a review date.
26.3 Ownership
Named owners for kit maintenance, log pipeline, integrity job and evidence store, with backups.
Every component has a primary owner and a backup, named in the handoff document and in the inventory. Owners keep their component working, review its logs and approve changes. Without named owners, a failing integrity job or a stale kit drive is everyone's concern and therefore nobody's task. The backup ensures cover during leave or illness. Owner changes are recorded in the inventory the same day, and the outgoing owner briefs the new one on open issues.
26.4 Training
Operators complete a supervised run of each runbook on synthetic machines; Renata signs off competence.
A supervised run on synthetic machines shows whether an operator can follow the runbook without help, not just whether they have read it. Renata watches, notes where operators hesitate or deviate, and signs off only when each runbook is completed correctly. Hesitations often reveal unclear wording, which is fixed in the runbook rather than explained verbally. Training records list each operator, each runbook and the date of sign-off, and refresher runs are scheduled twice a year.
26.5 Support
For three months the student team answers questions; after that, Renata is the escalation point.
The three-month period covers the first real uses, when questions are most likely. Questions and answers are recorded and, where useful, added to the runbooks so the knowledge outlasts the students' involvement. After the period, Renata is the single escalation point, which keeps support predictable and avoids operators relying on students who have moved on. Questions that reveal a gap in a runbook are fixed in the runbook itself within a week.
26.6 Acceptance
Operations accept the handoff once runbooks pass a walk-through and all operators are trained.
Acceptance is a test, not a date. If a runbook fails the walk-through or an operator has not been trained, the handoff waits. Recording acceptance in the handoff document, signed by both sides, makes clear from which moment operations owns the components and who to ask when something goes wrong. Any condition left unmet is listed with a date, and acceptance is revisited when it is met, rather than signed with promises attached.
26.7 Known issues
Open issues (eight old desktops, USB logging) are handed over in a list with owners.
Handing over known issues openly prevents the new owners from discovering them in the middle of an incident. Each issue in the list has an owner, a planned action and a date, and the list is reviewed at the monthly service meeting. Issues closed after handoff are marked with the evidence of closure, such as a replaced desktop now forwarding its logs. Nothing known is left off the list, even if it seems minor.
Metrics after handoff
Operations report monthly: kit checks done, integrity job results, log sources reporting, exercises run. Renata reviews the figures and visits quarterly to observe one exercise. A falling figure triggers a conversation, not blame, and the reasons are recorded alongside the numbers so trends can be understood later by anyone reviewing the capability.
Handoff document
A single handoff document lists components, owners, runbooks, training records, open issues and support arrangements, signed by both sides.
Worked example
During the walk-through, an operator follows the integrity-job runbook and reaches "investigate mismatch" without knowing what to do. The team expands that step: check backup status, compare with manifest, restore from write-once backup, notify Renata, record actions.
Synthetic case. The handoff is invented.
Errors and limits
Handoffs fail when knowledge stays in people's heads; test runbooks with people who did not write them.
Exercises
- EX076 — Runbook parts. List the parts of a runbook. Rubric: 3 = purpose, trigger, steps, outputs, checks, failure action, contacts; 2 = four; 1 = two; 0 = none.
- EX077 — Walk-through gap. What gap did the walk-through reveal and how was it fixed? Rubric: 3 = vague mismatch step; expanded with specific actions; 2 = partial; 1 = vague; 0 = none.
- EX078 — Acceptance criteria. When do operations accept the handoff? Rubric: 3 = runbooks pass walk-through; operators trained; 2 = one; 1 = date; 0 = none.
Synthesis
A clean handoff transfers runbooks, owners, training and known issues — tested by people who did not write them.
Continue studying — chapter 26 of 30
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →