Three Endpoints and a Domain Admin
At 02:10 on a Sunday the security operations centre detects ransomware behaviour on three servers. EDR isolates all three within eleven minutes. Nothing is encrypted and no service is down. Investigation shows the attacker harvested domain administrator credentials roughly a week earlier, and no persistence mechanism has yet been ruled out. Backups are immutable and offline. One business unit provides a data feed to a regional hospital partner over the same MPLS circuit that carried the attacker's command-and-control traffic. The operations manager argues that no escalation is needed because containment succeeded and there is no business impact. The next scheduled crisis team meeting is Thursday.
1. Is this an incident or a crisis? On what basis would you decide?
Read the worked answer
Decide from a definition, not from adrenaline or from visible damage. A crisis is an event that requires strategic-level decisions, exceeds the authority of the operational layer, threatens multiple stakeholders or viability, and is time-compressed under uncertainty.
Apply it here. No downtime, so there is no realised impact - but the triggering conditions are not damage, they are:
- Unresolved persistence. Contained endpoints do not mean contained intrusion. Harvested domain admin credentials imply the ability to act elsewhere, and 'not yet found' is not 'not there'.
- Third-party exposure. A hospital partner dependent on the same circuit converts a single-company event into a multi-stakeholder one, with contractual and possibly regulatory notification duties.
- Time compression. Notification clocks for personal data may already be running on awareness, not on confirmation.
The commonest failure mode is the bias the operations manager is displaying: no visible harm means no crisis. Escalate on uncertainty and stakeholder spread, not on the damage count. It is cheaper to stand a crisis team down than to convene one late.
2. Who should be able to declare, and what is wrong with the current arrangement?
Read the worked answer
The current arrangement has no out-of-hours route and a four-day gap before the next team meeting - that is a structural defect regardless of this event.
Declaration authority should sit with several named people, any of whom can trigger it alone: the incident commander or duty manager, the CISO or head of security, and the on-call executive. Each needs a named deputy and a documented contact path at 02:10 on a Sunday. A model in which only the CEO can declare a crisis means the organisation is one unavailable person away from paralysis.
The second defect is cultural. Nobody wants to be the person who overreacted and interrupted a board member's weekend. A workable model says: declare early on defined triggers, and the executive can formally stand the team down with a logged rationale. Explicit cover for false alarms is not soft governance - it is the mechanism that makes early declaration rational for the person holding the phone at 2am.
3. What should the first 30 minutes look like?
Read the worked answer
Four workstreams in parallel, all logged with timestamps and a single incident log owner:
- Stand up and scope. Convene the crisis team by the out-of-hours route; state the trigger explicitly ('domain admin compromise, persistence unconfirmed'). Assume breach as the working assumption.
- Contain and preserve. Keep the three servers isolated; do not reimage before forensics. Reset privileged credentials and review domain admin group membership. Check for the same indicators on the hospital-facing systems and the MPLS path specifically.
- Assess obligations, not just harm. Determine whether personal data is in scope and start the breach assessment clock now. Check the hospital partner contract for security-incident notification terms and whether the partner needs warning to protect its own operations.
- Communicate inward. Brief the executive on-call with what is known, unknown, and the next decision point - resist drafting an external statement until scope is better understood, but set a time by which you will return with one.
Decide on the Thursday meeting question immediately: it is superseded.