Facilitator Notes & Model Answers — Lesson 03
For instructors and self-study · Model reasoning, not the only correct answers
Lab — what a strong path map shows
- Most top paths run through people, not systems — the assistant and a trusted supplier usually rank above any technical route.
- Personal accounts (the recovery email, the consumer messenger) are frequently the softest, highest-value paths because they are outside corporate controls.
- The highest-leverage single fix is often a pair: phishing-resistant authentication on the principal and key staff, plus an out-of-band verification habit for instructions and payments.
| Path | What the adversary gains | Control & owner |
|---|---|---|
| Via executive assistant | Impersonation, calendar, timing | Verification habit + phishing-resistant auth (principal owns mandate) |
| Via personal recovery email | Account-reset channel into corporate identity | Separate, hardened recovery + MFA (principal owns) |
| Via trusted supplier | Credible pretext for payment/change | Out-of-band callback rule for any change (CFO/procurement owns) |
Homework — model answers
Task 1
Strong lists mix people and accounts and explicitly include at least one personal account. The realisation to aim for: your softest paths are usually human and personal, not corporate and technical.
Task 2
Good answers name a combination — e.g. "public conference schedule + assistant's travel posts + named hotel chain loyalty" — and break the pattern (vary or privatise the travel signalling) rather than chasing one fact.
Task 3
The model verification habit is specific and out-of-band: "For any payment, supplier change, or urgent request that appears to come from me, call me back on my known number before acting." Generic vigilance is not an answer.