15.02 D5: A Current Security Failure

Week 15 · 30 points · about 60 minutes · Canvas discussion board

Objectives assessed

• 7.5: Recommend a defensible incident response structured by the NIST SP 800-61 incident response phases. (TLO 7)

Time estimate

Find and read a source	15 min
Initial post	30 min
Two replies	15 min
Total	60 min

Before you start

• CyBOK §8.7 (printed pages 283-286), incident management: prepare, handle, follow up.
• NIST SP 800-61r3, which maps incident response onto the CSF 2.0 functions: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
• You will have written a memo in Lab 10 this week. This discussion applies the same structure to a real organization, and you may reuse what you learned there.

Find an incident

Find one publicly reported security incident from the last twelve months where enough has been disclosed to say something about how the organization responded, not only about what happened to them.

Signals that there is enough material: a published post-incident report, regulatory filings, a CISA advisory, sworn testimony, or detailed reporting that includes a timeline.

Check the board first and pick something nobody has taken.

This is the last full discussion of the semester, and it is deliberately the one that asks you to use the whole course. Pick something you find genuinely interesting.

Initial Post Directions

Due: Thursday of week 15. About 450-550 words.

Four labeled parts.

1. The timeline

Give a timeline with whatever dates are known: initial compromise, first detection, containment, public disclosure, recovery. Link your source.

Then state the two numbers that matter most in incident response, or say that they are not known:

• Dwell time: how long between initial compromise and detection?
• Time to containment: how long between detection and the attacker losing access?

If reporting does not give them, say so and say what would establish them.

2. How it was found

What detected it, and was that detection internal or external?

A substantial fraction of breaches are discovered by somebody outside the organization: a customer, a researcher, a payment processor, a ransom note. If this one was found externally, say what that tells you about the organization's monitoring, using CyBOK §8.2 on data sources.

If it was found internally, say which data source did it, and whether the alert was acted on promptly. If there was a missed earlier signal (as there was in the week 12 incident report), identify it.

3. The response, judged against the incident response life cycle

Take the response as reported and lay it against the four phases below. They come from NIST SP 800-61r2. CyBOK §8.7 groups the same work into three activities (prepare, handle, follow up), and SP 800-61r3 maps each phase onto the CSF 2.0 Functions in its Table 1. For each phase, say what the organization did, what it appears to have gotten right, and what it got wrong or you cannot tell:

• Preparation: what was in place beforehand? Backups, a plan, a retainer, logging?
• Detection and analysis: covered in part 2; add anything about how they scoped it.
• Containment, eradication, and recovery: what did they cut off, and when? How did they decide systems were clean?
• Post-incident activity: what did they change afterwards, and did they say so publicly?

Be fair. Incident response is done under time pressure with incomplete information by people who have not slept. Criticize decisions, not the fact that decisions had to be made quickly.

4. Two changes

Name two specific changes that would have most improved the outcome, and for each:

• Which phase it belongs to.
• What it would have changed about the timeline in part 1. Be concrete about which interval gets shorter.
• What it costs, and whether an organization of this size would realistically have had it.

At least one of your two must be about preparation, because preparation is the phase that decides how the other three go, and it is the phase organizations skip.

Reply Post Directions

Due: Friday of week 15. Two replies, about 150 words each.

Reply to two classmates who chose different incidents. Do one of these:

• Question a judgment. If you think they were too harsh or too generous about a decision made under pressure, say so and make the case from what the responders knew at the time.
• Test a recommendation against the timeline. Would their change actually have shortened the interval they claim? Work it through.
• Connect two incidents. If their incident and yours share a root cause or a failure mode, name it and say what that suggests about the class of problem rather than the individual organization.

Rubric

Row	What is assessed	Points
1	Initial post: timeline with dwell time and containment time or a stated evidence gap; how it was detected and what that implies about monitoring; all four life cycle phases assessed with what is known separated from what is not; two changes, at least one about preparation, each tied to a specific interval in the timeline and each with a stated cost	18
2	Two substantive replies to classmates with different incidents, each questioning a judgment, testing a recommendation against the timeline, or identifying a shared root cause	12
	Total	30

What loses points in row 1: treating "they should have had better security" as a change, recommendations that are not tied to an interval in the timeline, and hindsight criticism that does not distinguish what responders knew at the time from what came out later.

Discussion Guidelines

The discussion guidelines from D1 apply. In particular: analyze published reporting only, and do not name or blame individual employees of the organization, even where reporting does.

AI disclosure

You may use AI tools. If you do, add a sentence saying which and what for, per the AI policy.

The same caution as D4: AI tools invent timelines and invent details. Every factual claim in parts 1 and 2 must be supported by your linked source.