Facilitator Notes & Model Answers — Lesson 12
For instructors and self-study · Model analysis and rationale
Model kill-chain & intervention
| Stage | Cheapest control |
|---|---|
| Initial access | Phishing-resistant auth (L04), patching, closing exposed services — the cheapest place to stop everything |
| Escalation / lateral | Least privilege, segmentation (L06, L10) |
| Exfiltration | Monitoring, egress controls; assume data is taken in double extortion |
| Encryption | Immutable, tested backups; segmentation to limit blast radius |
Model containment sequence (first hour)
- Order isolation of affected systems; do not power everything off blindly (preserve evidence where possible).
- Convene the pre-named crisis team; confirm who holds decision authority.
- Engage legal and, if retained, incident response; begin the communications plan.
- Do not contact the attacker or consider payment before legal and sanctions checks.
Why the poll answer is C (policy, backups, legal position)
- A — ransom size: the attacker's framing; irrelevant to whether you should pay.
- B — decryption promise: unverifiable and self-serving.
- C — prior preparation: policy, tested backups, and legal/sanctions position are the only sound basis for a response.
- D — press exposure: a consequence to manage, not the decision driver.
Teaching point: everything the attacker and the moment push at you is designed to force an improvised decision. Prior preparation is the antidote.
Homework — what good looks like
Task 1
A strong policy pre-assigns the decision, states a backup posture honestly, and mandates a legal/sanctions check — removing improvisation.
Task 2
The valuable outcome is often discovering that restoration has never been tested; naming the gap and its owner is the point.
Task 3
Good answers give every crisis role a named person and an out-of-hours contact path.