OpenCyber AcademyDomain routing hijack
A nonprofit's public domain intermittently resolves to an unfamiliar address while donation pages remain reachable for some users.
Fictional training scenario; no real system or person is described.
Safety and authority boundary
Treat affected donations and possible impersonation as unknown until logs and payment provider evidence are checked.
Preparation
GV · ID · PRA nonprofit's public domain intermittently resolves to an unfamiliar address while donation pages remain reachable for some users.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Beacon Evidence team | Prepared an evidence route | Named read-only sources and custodians for: Authoritative DNS records differ from the approved zone change log; registrar access history shows a new session. | The first alert needs a verifiable provenance and time. |
| Cedar Service team | Rehearsed safe continuity | Tested an isolated version of: Restore the approved zone, rotate registrar access and coordinate cache propagation with the DNS provider. | A rushed recovery can worsen the service impact. |
| Dawn Decision team | Set authority and escalation | Assigned owners and approval conditions around: Treat affected donations and possible impersonation as unknown until logs and payment provider evidence are checked. | Safety, privacy and communications need accountable decisions. |
Detection and analysis
DEAuthoritative DNS records differ from the approved zone change log; registrar access history shows a new session.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Beacon Evidence team | Triaged the signal | Preserved source, UTC time and a second independent check for: Authoritative DNS records differ from the approved zone change log; registrar access history shows a new session. | One alert is a lead, not proof of cause or scope. |
| Cedar Service team | Measured user impact | Compared the actual service with the scenario baseline: A nonprofit's public domain intermittently resolves to an unfamiliar address while donation pages remain reachable for some users. | Technical alerts alone do not establish operational impact. |
| Dawn Decision team | Declared a bounded case | Recorded confirmed facts, unknowns, owner and next review time. | The teams can coordinate without overstating the evidence. |
Response and containment
RSTreat affected donations and possible impersonation as unknown until logs and payment provider evidence are checked.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Beacon Evidence team | Preserved and scoped evidence | Saved the original records and defined a bounded path for: Freeze registrar changes with the owner, preserve zone history and replace unauthorized records through the controlled process. | Containment must not destroy the basis for later review. |
| Cedar Service team | Applied the approved control | Implemented: Freeze registrar changes with the owner, preserve zone history and replace unauthorized records through the controlled process. | A reversible, owner-approved change reduces harm without expanding scope. |
| Dawn Decision team | Authorized and communicated | Logged the approver, affected users and constraint: Treat affected donations and possible impersonation as unknown until logs and payment provider evidence are checked. | Response actions need clear authority and proportional notice. |
Recovery
RCRestore the approved zone, rotate registrar access and coordinate cache propagation with the DNS provider.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Beacon Evidence team | Checked for persistence | Compared new telemetry against: Authoritative and sampled recursive resolvers return the approved destination; donation completion is independently tested. | An apparently healthy service can still be compromised. |
| Cedar Service team | Restored in stages | Executed: Restore the approved zone, rotate registrar access and coordinate cache propagation with the DNS provider. | A staged return tests dependencies before widening access. |
| Dawn Decision team | Accepted the business outcome | Requested owner sign-off only after: Authoritative and sampled recursive resolvers return the approved destination; donation completion is independently tested. | Recovery is a service decision, not merely a green dashboard. |
Improvement
ID.IMAdd registrar MFA, dual approval for zone changes and external DNS drift monitoring.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Beacon Evidence team | Turned uncertainty into a test | Documented the evidence gap and proposed: Add registrar MFA, dual approval for zone changes and external DNS drift monitoring. | A lesson needs a measurable future check. |
| Cedar Service team | Rehearsed the changed control | Assigned an owner and date to test: Add registrar MFA, dual approval for zone changes and external DNS drift monitoring. | An untested action item is not a verified improvement. |
| Dawn Decision team | Closed the decision record | Approved resources, tracked the owner and checked the new control later. | Learning must feed Govern, Identify and Protect. |
Recovery acceptance test
Authoritative and sampled recursive resolvers return the approved destination; donation completion is independently tested.
Improvement to verify
Add registrar MFA, dual approval for zone changes and external DNS drift monitoring.