OpenCyber AcademyLost field laptop
An engineer reports a missing laptop used for site visits; asset records say encryption is enabled, but the latest check is old.
Fictional training scenario; no real system or person is described.
Safety and authority boundary
Do not declare a data breach or safe encryption without evidence; limit collection of the engineer's personal information.
Preparation
GV · ID · PRAn engineer reports a missing laptop used for site visits; asset records say encryption is enabled, but the latest check is old.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Vale Evidence team | Prepared an evidence route | Named read-only sources and custodians for: Device management shows the last check-in two days ago and a cached service account whose scope is unclear. | The first alert needs a verifiable provenance and time. |
| Willow Service team | Rehearsed safe continuity | Tested an isolated version of: Issue a managed replacement device with scoped credentials and restore approved field tools. | A rushed recovery can worsen the service impact. |
| Xenon Decision team | Set authority and escalation | Assigned owners and approval conditions around: Do not declare a data breach or safe encryption without evidence; limit collection of the engineer's personal information. | Safety, privacy and communications need accountable decisions. |
Detection and analysis
DEDevice management shows the last check-in two days ago and a cached service account whose scope is unclear.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Vale Evidence team | Triaged the signal | Preserved source, UTC time and a second independent check for: Device management shows the last check-in two days ago and a cached service account whose scope is unclear. | One alert is a lead, not proof of cause or scope. |
| Willow Service team | Measured user impact | Compared the actual service with the scenario baseline: An engineer reports a missing laptop used for site visits; asset records say encryption is enabled, but the latest check is old. | Technical alerts alone do not establish operational impact. |
| Xenon Decision team | Declared a bounded case | Recorded confirmed facts, unknowns, owner and next review time. | The teams can coordinate without overstating the evidence. |
Response and containment
RSDo not declare a data breach or safe encryption without evidence; limit collection of the engineer's personal information.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Vale Evidence team | Preserved and scoped evidence | Saved the original records and defined a bounded path for: Revoke the cached credential, verify encryption attestation and preserve device-management and access records. | Containment must not destroy the basis for later review. |
| Willow Service team | Applied the approved control | Implemented: Revoke the cached credential, verify encryption attestation and preserve device-management and access records. | A reversible, owner-approved change reduces harm without expanding scope. |
| Xenon Decision team | Authorized and communicated | Logged the approver, affected users and constraint: Do not declare a data breach or safe encryption without evidence; limit collection of the engineer's personal information. | Response actions need clear authority and proportional notice. |
Recovery
RCIssue a managed replacement device with scoped credentials and restore approved field tools.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Vale Evidence team | Checked for persistence | Compared new telemetry against: The old credential fails, the replacement is managed and encrypted, and the data-risk assessment records its unknowns. | An apparently healthy service can still be compromised. |
| Willow Service team | Restored in stages | Executed: Issue a managed replacement device with scoped credentials and restore approved field tools. | A staged return tests dependencies before widening access. |
| Xenon Decision team | Accepted the business outcome | Requested owner sign-off only after: The old credential fails, the replacement is managed and encrypted, and the data-risk assessment records its unknowns. | Recovery is a service decision, not merely a green dashboard. |
Improvement
ID.IMRequire recent encryption evidence, least-privilege offline access and rapid loss reporting.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Vale Evidence team | Turned uncertainty into a test | Documented the evidence gap and proposed: Require recent encryption evidence, least-privilege offline access and rapid loss reporting. | A lesson needs a measurable future check. |
| Willow Service team | Rehearsed the changed control | Assigned an owner and date to test: Require recent encryption evidence, least-privilege offline access and rapid loss reporting. | An untested action item is not a verified improvement. |
| Xenon Decision team | Closed the decision record | Approved resources, tracked the owner and checked the new control later. | Learning must feed Govern, Identify and Protect. |
Recovery acceptance test
The old credential fails, the replacement is managed and encrypted, and the data-risk assessment records its unknowns.
Improvement to verify
Require recent encryption evidence, least-privilege offline access and rapid loss reporting.