ISO 27035 LIM case studies
ISO 27035 LIM · Put your knowledge to work in context.
The PECB Certified ISO/IEC 27035 Lead Incident Manager credential is aimed at professionals who want to prove they can help an organization set up and run a process for managing information security incidents. The training course is built on the ISO/IEC 27035 series and other good practices, and it follows the whole incident lifecycle from planning through post-incident activities. The ISO 27035 LIM case studies are 5 cases and about 4,668 words.
1Blocked C2 beacon and a lost encrypted laptop: event, incident, or near miss?
A Norway-based online retailer (1,400 staff, 12 fulfilment sites) gets 14 SIEM alerts at 09:40: Windows hosts in the pick-and-pack VLAN attempting TLS sessions to an IP listed as Cobalt Strike command-and-control in the threat-intel feed. The egress proxy blocked every attempt; logs show no bytes returned beyond TLS negotiation failures.
948 words, about 5 min2A client-reported invoice fraud closed as spam: where the process broke
A Singapore-headquartered wealth manager (3,000 staff, S 14bn AUM) outsources level-1 triage to a service desk in Kuala Lumpur. On 3 March a client emails her relationship manager about an invoice 'from' the firm carrying the firm's logo, the correct supplier name, and a changed bank account number.
923 words, about 5 min3One framework, three regulators, three severity scales
A diversified group (EUR 6bn revenue) has three business units: German insurance, subject to works council co-determination and strict consultation before employee monitoring; a Brazilian retail bank under LGPD, where the local regulator expects notification within three working days; and Singapore logistics under the PDPA, with no general breach notification duty. Each unit runs its own severity scheme - P1 to P4, Sev1 to Sev5, and red/amber/green - and its own incident register in a different tool.
893 words, about 4 min4Ransomware at 02:10: the kiln, the backups, and the 72-hour clock
A German automotive supplier (6 plants, 11,000 staff) wakes at 02:10 to ERP and MES unavailability. A ransom note claims 400 GB exfiltrated and demands 90 BTC within 72 hours.
978 words, about 5 min5Twenty-two months of incident data that proves nothing
A UK utility has run an incident process for 22 months. Data on 214 incidents shows 58% were first detected by third parties - customers, a supplier, a national CERT - and the median time from first observable evidence to detection is six days.
926 words, about 5 min