OpenCyber AcademyWeb application compromise
A customer portal begins returning unexpected database errors after an unreviewed change to a search endpoint.
Fictional training scenario; no real system or person is described.
Safety and authority boundary
Do not use live exploitation to confirm the flaw; preserve query traces and involve the data owner before impact claims.
Preparation
GV · ID · PRA customer portal begins returning unexpected database errors after an unreviewed change to a search endpoint.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Yarrow Evidence team | Prepared an evidence route | Named read-only sources and custodians for: Application and database logs show malformed queries and an unusual read volume, but the affected record count is unknown. | The first alert needs a verifiable provenance and time. |
| Zenith Service team | Rehearsed safe continuity | Tested an isolated version of: Deploy a reviewed query fix and least-privilege database role, then run bounded functional tests. | A rushed recovery can worsen the service impact. |
| Amber Decision team | Set authority and escalation | Assigned owners and approval conditions around: Do not use live exploitation to confirm the flaw; preserve query traces and involve the data owner before impact claims. | Safety, privacy and communications need accountable decisions. |
Detection and analysis
DEApplication and database logs show malformed queries and an unusual read volume, but the affected record count is unknown.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Yarrow Evidence team | Triaged the signal | Preserved source, UTC time and a second independent check for: Application and database logs show malformed queries and an unusual read volume, but the affected record count is unknown. | One alert is a lead, not proof of cause or scope. |
| Zenith Service team | Measured user impact | Compared the actual service with the scenario baseline: A customer portal begins returning unexpected database errors after an unreviewed change to a search endpoint. | Technical alerts alone do not establish operational impact. |
| Amber Decision team | Declared a bounded case | Recorded confirmed facts, unknowns, owner and next review time. | The teams can coordinate without overstating the evidence. |
Response and containment
RSDo not use live exploitation to confirm the flaw; preserve query traces and involve the data owner before impact claims.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Yarrow Evidence team | Preserved and scoped evidence | Saved the original records and defined a bounded path for: Disable the affected search path through an approved feature flag, retain evidence and review database permissions. | Containment must not destroy the basis for later review. |
| Zenith Service team | Applied the approved control | Implemented: Disable the affected search path through an approved feature flag, retain evidence and review database permissions. | A reversible, owner-approved change reduces harm without expanding scope. |
| Amber Decision team | Authorized and communicated | Logged the approver, affected users and constraint: Do not use live exploitation to confirm the flaw; preserve query traces and involve the data owner before impact claims. | Response actions need clear authority and proportional notice. |
Recovery
RCDeploy a reviewed query fix and least-privilege database role, then run bounded functional tests.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Yarrow Evidence team | Checked for persistence | Compared new telemetry against: Normal searches work, malformed input is rejected, and an independent log review finds no continuing anomalous reads. | An apparently healthy service can still be compromised. |
| Zenith Service team | Restored in stages | Executed: Deploy a reviewed query fix and least-privilege database role, then run bounded functional tests. | A staged return tests dependencies before widening access. |
| Amber Decision team | Accepted the business outcome | Requested owner sign-off only after: Normal searches work, malformed input is rejected, and an independent log review finds no continuing anomalous reads. | Recovery is a service decision, not merely a green dashboard. |
Improvement
ID.IMAdd pre-deployment query tests, access review and a data-impact evidence checklist.
Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.
Reveal the worked team response
| Team | What | How | Why |
|---|---|---|---|
| Yarrow Evidence team | Turned uncertainty into a test | Documented the evidence gap and proposed: Add pre-deployment query tests, access review and a data-impact evidence checklist. | A lesson needs a measurable future check. |
| Zenith Service team | Rehearsed the changed control | Assigned an owner and date to test: Add pre-deployment query tests, access review and a data-impact evidence checklist. | An untested action item is not a verified improvement. |
| Amber Decision team | Closed the decision record | Approved resources, tracked the owner and checked the new control later. | Learning must feed Govern, Identify and Protect. |
Recovery acceptance test
Normal searches work, malformed input is rejected, and an independent log review finds no continuing anomalous reads.
Improvement to verify
Add pre-deployment query tests, access review and a data-impact evidence checklist.