Scenario 03 / 10 · NIST SP 800-61 REV. 3

Cloud credential exposure

A deployment token appears in a public source commit and may authorize changes to a production cloud project.

Fictional training scenario; no real system or person is described.

Safety and authority boundary

Treat the token as exposed; preserve audit logs before rotation and avoid printing the secret in tickets or messages.

01 / 05

Preparation

GV · ID · PR

A deployment token appears in a public source commit and may authorize changes to a production cloud project.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Granite Evidence team	Prepared an evidence route	Named read-only sources and custodians for: Cloud audit logs show unfamiliar token use after publication, but the affected resource list is incomplete.	The first alert needs a verifiable provenance and time.
Harbor Service team	Rehearsed safe continuity	Tested an isolated version of: Reissue least-privilege credentials from a protected store and redeploy verified artifacts.	A rushed recovery can worsen the service impact.
Iris Decision team	Set authority and escalation	Assigned owners and approval conditions around: Treat the token as exposed; preserve audit logs before rotation and avoid printing the secret in tickets or messages.	Safety, privacy and communications need accountable decisions.

02 / 05

Detection and analysis

Cloud audit logs show unfamiliar token use after publication, but the affected resource list is incomplete.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Granite Evidence team	Triaged the signal	Preserved source, UTC time and a second independent check for: Cloud audit logs show unfamiliar token use after publication, but the affected resource list is incomplete.	One alert is a lead, not proof of cause or scope.
Harbor Service team	Measured user impact	Compared the actual service with the scenario baseline: A deployment token appears in a public source commit and may authorize changes to a production cloud project.	Technical alerts alone do not establish operational impact.
Iris Decision team	Declared a bounded case	Recorded confirmed facts, unknowns, owner and next review time.	The teams can coordinate without overstating the evidence.

03 / 05

Response and containment

Treat the token as exposed; preserve audit logs before rotation and avoid printing the secret in tickets or messages.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Granite Evidence team	Preserved and scoped evidence	Saved the original records and defined a bounded path for: Disable or rotate the token, search its use by time and resource, and bound any affected deployment with owner approval.	Containment must not destroy the basis for later review.
Harbor Service team	Applied the approved control	Implemented: Disable or rotate the token, search its use by time and resource, and bound any affected deployment with owner approval.	A reversible, owner-approved change reduces harm without expanding scope.
Iris Decision team	Authorized and communicated	Logged the approver, affected users and constraint: Treat the token as exposed; preserve audit logs before rotation and avoid printing the secret in tickets or messages.	Response actions need clear authority and proportional notice.

04 / 05

Recovery

Reissue least-privilege credentials from a protected store and redeploy verified artifacts.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Granite Evidence team	Checked for persistence	Compared new telemetry against: The old token is rejected, approved workloads function, and audit review finds no unexplained resource changes.	An apparently healthy service can still be compromised.
Harbor Service team	Restored in stages	Executed: Reissue least-privilege credentials from a protected store and redeploy verified artifacts.	A staged return tests dependencies before widening access.
Iris Decision team	Accepted the business outcome	Requested owner sign-off only after: The old token is rejected, approved workloads function, and audit review finds no unexplained resource changes.	Recovery is a service decision, not merely a green dashboard.

05 / 05

Improvement

ID.IM

Move deployment authentication to short-lived, scoped identities and test secret scanning.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Granite Evidence team	Turned uncertainty into a test	Documented the evidence gap and proposed: Move deployment authentication to short-lived, scoped identities and test secret scanning.	A lesson needs a measurable future check.
Harbor Service team	Rehearsed the changed control	Assigned an owner and date to test: Move deployment authentication to short-lived, scoped identities and test secret scanning.	An untested action item is not a verified improvement.
Iris Decision team	Closed the decision record	Approved resources, tracked the owner and checked the new control later.	Learning must feed Govern, Identify and Protect.

Recovery acceptance test

The old token is rejected, approved workloads function, and audit review finds no unexplained resource changes.

Improvement to verify

Move deployment authentication to short-lived, scoped identities and test secret scanning.