Contain or Keep Shipping
At a third-party logistics provider, EDR flags credential dumping on a domain controller three days before peak holiday shipping. Threat intelligence shared by a sector ISAC says the actor uses double extortion, dwells three to five days before encryption, and targets warehouse management systems. Isolating the identity tier would stop automated picking at three warehouses, halting about $4M per day in revenue and affecting 60 customers. Legal says notification is not required until exfiltration is confirmed; the cyber insurer requires its own forensic firm to approve any containment that affects operations. The CEO asks whether to shut down.
1. What should the incident commander do in the first hours, and who decides on operational shutdown?
Read the worked answer
Declare a major incident, assign an incident commander, and separate three decisions that are being collapsed into one.
- Security containment: isolate the compromised identity infrastructure, disable affected accounts, block command-and-control, reset privileged credentials including a double krbtgt reset, and hunt for persistence. Much of this can be done without stopping warehouse picking if local fallback procedures exist.
- Operational continuity: decide whether automated picking must pause. This is a business decision owned by the CEO or COO, informed by the CISO's assessment, not delegated to security.
- Evidence and coverage: preserve logs, engage the insurer's forensic firm, and notify the insurer - but do not let a coverage-approval process become the reason an active intrusion goes uncontained.
The commander should document the tradeoff: revenue per day against the probability of encryption within the actor's known dwell window. With three to five days of dwell, waiting for certainty is itself a decision to accept the ransom scenario.
2. How should the threat intelligence be used, and what are its limits?
Read the worked answer
Use the intelligence to set urgency and direct hunting, not as proof about this incident.
- Set the clock: a three-to-five-day dwell before encryption means containment and credential resets should be underway within hours, not after a full forensic review.
- Hunt for the actor's TTPs: credential dumping, lateral movement to backup infrastructure, and WMS-targeting behavior. If any appear, treat the intrusion as confirmed and escalate.
- Prioritize backups and WMS segmentation as the controls the actor is known to defeat.
Limits: sector reporting describes an actor, not this network. Attribution is uncertain and should not drive legal conclusions. Intelligence can justify action under uncertainty, but it cannot substitute for evidence of exfiltration when making notification decisions. The commander should record what intelligence informed which decision, so the reasoning survives after the incident.
3. Legal says notification is not required until exfiltration is confirmed, and the insurer wants approval before operational changes. How should the CISO handle both?
Read the worked answer
Treat both statements as inputs to a decision, not as commands that override risk.
Notification: confirm the actual obligations - contracts often require notice on suspicion or on a defined trigger, and some regulations use risk-of-harm rather than confirmation of exfiltration. Have legal document the analysis and the decision. Prepare customer communications in parallel so the 24- or 72-hour clock is not started from a standing position. Waiting for confirmed exfiltration can consume the entire dwell window.
Insurer approval: notify the insurer immediately and engage its forensic firm, but distinguish coverage conditions from safety-critical containment. If the forensic firm cannot respond in time, contain, preserve evidence carefully, and document why. A coverage dispute is recoverable; encryption of the WMS estate is not.
The CISO should escalate the conflict in writing to the CEO with a recommendation, so the tradeoff between revenue, coverage, and containment is owned at the right level.