02:10 on the Solo Shift: Forty Gigabytes Leaving the Building

Act on the two alerts as one incident. A 40 GB egress from a database server plus a privileged login from an overseas IP inside the same hour is far more likely to be one intrusion than two coincidences, and the combination raises confidence enough to justify containment without a finished investigation.

In order:

1. Write the timeline now. Timestamp, source host, destination IP, byte count, account name, VPN address, alert text, screenshots. Logs and recollection both fade, and the record of what he knew when is what will be judged.
2. Cut the exfiltration at the firewall for that host. Block outbound from the database server's address - not the whole estate - deny the destination IP, and kill the VPN session. Narrow, reversible, and it stops the clock on data loss.
3. Disable the admin account and revoke its sessions and tokens. An active foreign session on a rostered-off engineer's account is the highest-privilege risk in the picture.
4. Do not touch the server further. No reboot, no log deletion, no 'cleaning up' the process - memory and live connections are evidence.
5. Escalate down the whole list, not just the first name: IR lead, CISO mobile, deputy, service desk manager. Voicemail plus a written message with the ticket number and a one-line summary, then keep working containment while waiting.

Against blocking now: the policy says break-glass needs director approval and no director is reachable. There is a plausible benign explanation - a scheduled warehouse export can look exactly like this - and blocking a production database's egress could break an overnight batch and create its own outage. He is a helpdesk analyst holding firewall access he arguably should not have.

For blocking now: the runbook's own logic is containment-first. The harm from waiting is irreversible (data leaving); the harm from blocking is reversible (restore the rule). The overseas privileged login on a rostered-off account is independent corroboration, which is exactly what distinguishes this from a single ambiguous alert. At 40 GB per 22 minutes, deliberation has a measurable price.

Decision: block - narrowly and reversibly. Irreversibility should carry the most weight: a firewall rule can be undone in a minute; 40 GB cannot be un-sent. Narrow the action to one host and one destination rather than a blanket egress block, which keeps the blast radius of a wrong call small. Simultaneously attempt authorisation: message the CISO and duty manager in writing stating the action taken and its basis, so approval becomes ratification rather than a precondition. Never act silently - the failure mode that gets analysts punished is undocumented unilateral action, not documented containment under a documented emergency.

The real defect is the policy. A break-glass procedure that cannot be invoked at 02:10 on a Saturday is not a break-glass procedure.

Escalation design:

• Three named contacts with a deputy for each, an answer-time expectation (for example 15 minutes), and a fallback to the duty manager's manager. A single mobile number is a single point of failure, and voicemail is not an escalation.
• An out-of-band channel the analyst can trigger that rings several people at once - a paging tool, not a personal mobile.
• Pre-authorised containment in the runbook: exactly which actions a Tier-1 analyst may take alone (isolate host, block destination, disable account, revoke sessions) and which require approval. The current runbook says escalate, but never says what to do while waiting.

Staffing and authority:

• A solo night shift on a 500-person insurer's monitoring desk, staffed by someone who has never handled a live incident, is the root cause. Add a second person, contract an MSSP for out-of-hours triage, or restrict the shift to monitoring with a guaranteed callback.
• Firewall console access for helpdesk should run through a controlled break-glass account that alerts when used, not standing access.

Assurance:

• Test the on-call rota monthly with a live page and track response time as a metric.
• Run a tabletop on exactly this scenario - active exfiltration, unreachable management - and publish the decision rights that come out of it, so the next analyst does not have to guess.
• Hold a blameless after-action review that is specific: what the analyst did well, and what the policy made impossible. The team lead's 'just don't break anything' is a symptom of a culture where nobody has been told what good looks like at 02:10.