Facilitator Notes & Model Answers — Lesson 01
For instructors and self-study · Model reasoning, not the only correct answers
How to use this
This lesson grades reasoning, not recall. The answers below are strong examples of the thinking you want, not a key to mark against. A participant who reaches a different conclusion with defensible reasoning has succeeded.
Lab table-read — model debrief
| Stage | Cheapest missed intervention | Behavioural / technical |
|---|---|---|
| Recon | Reduce the public calendar/travel pattern and over-detailed bio | Behavioural |
| Resource dev | Out-of-band verification habit for unexpected "logistics" mail | Behavioural |
| Initial access | Phishing-resistant authentication so a clicked lure cannot harvest a usable credential | Technical (enabling a behaviour) |
| Credential access | Replace OTP MFA with phishing-resistant factors (covered in Lesson 04) | Technical |
| Collection & exfil | Anomaly detection on mailbox access; least-privilege on assistant accounts | Technical |
The intended realisation: the cheapest, highest-leverage interventions cluster at the start of the chain and are largely behavioural, while teams instinctively look for technical fixes at the end.
Stage questions — what good answers contain
- Stage 1: A specific fragment (calendar cadence, named itinerary) and an owner who is a person/role, not "IT."
- Stage 2: Recognises that catching the lookalike depends on a habit and a verification channel, not on the assistant being cleverer.
- Stage 3: Best answers say "leadership failure" — leadership chose the controls and the culture that made the click consequential.
- Stage 4: Names that legacy OTP MFA is phishable by real-time relay; the control "worked" as designed and was still insufficient.
- Stage 5: Identifies Stage 1 as cheapest, and explains the cognitive bias toward end-of-chain technical fixes.
Homework — model answers
Task 1
Strong example: "Initial Access against my deputy via a spear-phish impersonating our board portal. Control category: phishing-resistant authentication (FIDO2/passkey). Decision owner: me, as risk owner, with the CIO executing — because mandating it across executive accounts is a risk-acceptance and budget decision, not a help-desk task."
Task 2
Strong pairs:
- "We have antivirus." → "What would we have detected in an intrusion that used a valid login and no malware?"
- "IT owns cyber." → "Which of the decisions that actually reduce our risk require my signature, not IT's?"
- "We passed an audit." → "What has changed in our threat exposure since the audit snapshot, and what did the audit not test?"
Task 3
Any explicit decision is acceptable. The teaching point is that knowingly accepting a residual risk is a legitimate, defensible leadership act — and is different from never having considered it.