Lab Guide — Map the Attack Paths to a Principal
Facilitated mapping exercise · 45 minutes · Paper or whiteboard
What this lab is
Working from a fictional principal, participants map the realistic attack paths into that principal — through people, accounts, and trust chains, not just systems. The output is a one-page "path map." No real person is profiled.
The fictional principal
"Deputy Director R" leads operations in a sensitive agency. R has an executive assistant, a driver, a deputy, a spouse who runs a small business, two named suppliers, and a public speaking schedule. R uses corporate email, a personal email for recovery, and a consumer messenger to reach the assistant after hours.
Step 1 — List the nodes (8 min)
Prompt
On a whiteboard, place R in the centre. Around R, draw every person and every account that can legitimately reach R. Do not stop at the obvious; include the spouse's business and the personal recovery email.
Step 2 — Draw the paths (15 min)
Prompt
For each node, draw the path an adversary would take to reach R through it. Mark each path with: (a) how soft the node is, and (b) what the adversary gains by compromising it (impersonation, timing, a credible pretext, a recovery channel).
Step 3 — Rank and shut down (12 min)
Prompt
Rank the three paths you would close first. For each, name one realistic control — behavioural or technical — and say who owns the decision to apply it.
Debrief
- How many of the top paths run through people rather than systems?
- How many run through personal rather than corporate accounts?
- Which single fix protects the most paths at once? (Often: phishing-resistant auth + an assistant verification habit.)
✓ Self-check: your map has at least one path through a person, one through a personal account, and one through a supplier — and your top-three fixes each name a decision-owner.