Chapter 23 — Incident basics for endpoints
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 What counts"]
N2["23.2 First steps"]
N3["23.3 Escalation"]
N4["23.4 Practising"]
N5["Lessons learned and preserving information"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 What counts"]
N2["23.2 First steps"]
N3["23.3 Escalation"]
N4["23.4 Practising"]
N5["Lessons learned and preserving information"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 What counts]
|
v
[23.2 First steps]
|
v
[23.3 Escalation]
|
v
[23.4 Practising]
|
v
[Lessons learned and preserving information]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) recognise endpoint incidents; (2) take first steps; (3) escalate.
23.1 What counts
An incident is something that harms or may harm systems or data: malware detected and not blocked, a lost laptop, a suspicious sign-in, or an account used after its owner left. NIST SP 800-61 describes preparation, detection, containment, eradication, recovery and lessons learned.
The list deliberately includes events that are not attacks, such as a lost laptop, because they still need the same quick steps and records. The supply teacher's account that outlived the contract would have counted too, had anyone known whether it had been used after the teacher left.
23.2 First steps
For a suspected infected laptop: disconnect it from the network or isolate it through the console, do not switch it off if the outside company may need to examine it, record what was seen and when, and contact Dev.
Isolating rather than switching off keeps the laptop's memory and running state available if the outside company needs them, and stops it reaching other devices. The record of what was seen, when and by whom is written on paper or a phone if the laptop itself is the problem.
23.3 Escalation
Dev escalates to the outside company and the head teacher if pupil data may be affected. The data protection officer decides whether the regulator must be told.
The escalation order is written down so the school office does not have to decide who to call during an incident. The data protection officer's decision is recorded with its reason, whether or not the regulator is told, so the trust can show later that the question was considered. The contact card in each school office lists the same order, including the outside company's out-of-hours number added after the exercise.
23.4 Practising
Tomás runs a tabletop exercise with Dev and the school business manager using a made-up lost-laptop scenario, finding that nobody knew the out-of-hours contact for the outside company.
The exercise took an hour around a table, with Dev, the business manager and Tomás talking through who would do what at each step. Finding the missing out-of-hours contact cost nothing during the exercise, whereas finding it during a real loss on a Friday evening would have meant hours of delay.
Lessons learned and preserving information
After any real incident, Dev writes a short blameless note: what happened, what went well, what was slow and what will change. NIST SP 800-61 treats this step as part of the incident cycle, because improvements are easiest to agree while the event is fresh, and blame makes people report less. During an incident, preserving information matters too. When the outside company may need to investigate, Dev keeps the affected laptop powered and isolated rather than switching it off, exports its endpoint protection timeline and records who handled it and when. These simple steps keep useful evidence without any specialist forensic tools.
Worked example
The exercise adds a contact card to each school office with the escalation order.
Synthetic case. The scenario is synthetic.
Errors and limits
Switching off or wiping an affected device too early can destroy information needed to understand what happened.
Exercises
- EX067 — Incident examples. Give three endpoint incident examples. Rubric: 3 = three distinct;; 2 = two;; 1 = one;; 0 = none.
- EX068 — First action. What is the first action for a suspected infected laptop? Rubric: 3 = isolate and record;; 2 = isolate;; 1 = wipe;; 0 = none.
- EX069 — Exercise value. What did the tabletop exercise reveal? Rubric: 3 = missing out-of-hours contact;; 2 = a gap;; 1 = vague;; 0 = none.
Synthesis
Simple first steps and clear escalation matter more than advanced skills in a small organisation.
Continue studying — chapter 23 of 30
← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →