LDR553: Cyber Incident Management

Overview

In Section 1 we will focus on understanding the incident, gathering information from different groups, and standardizing our language. To assist in this, students will review some common terms, abbreviations and incident types to ensure we mean communicate accurately. From there we will define what the Incident Management (IM) group will seek to achieve, so we can state and focus on our objectives. The cornerstone of this phase is the Cyber Incident Management Tool Kit (CIMTK), specifically a key component called "The Grid." This comprehensive set of questions and core Incident Management (IM) tasks expedites our response. Identifying these tasks early allows for concurrent activities within support teams (Incident Response, Information Technology, Human Resources, Legal, etc.) and the IM team.

Defining objectives early is important, as retaining focus can be hard when our work gets busy. Once defined, we will leverage the “Commander’s Intent” as a method to brief teams, as we look at how to inform the wider group what our short- and medium-term goals are.

We segway into IM Platforms as we consider what we need to be able to do and where is safest to operate from as we review how attackers access defenders’ infrastructure to prevent their removal from the network.

Recognizing that effective Incident Management hinges on a strong team, we delve into assessing team composition and the unique contributions required from different groups to fulfill the mission. New for 2025, we are then including GenAI on the team bench, and throughout the course we will show how GenAI can augment and support the team. As we close off Section 1, we will consider the contribution from GenAI as we also build our first GPT for class use.

Note: The class uses a SANS provided OpenAI ChatGPT UI for the student’s use. We will extensively leverage this during the course. Students may use their own or different GenAI tools, but we will focus on and support ChatGPT.

Full Lab Details

• Initial Setup at the Start of the Course
• Initial incident briefing
• CIMKT: The Grid and AIM-RADAR
• Setting Objectives and Developing the Commander’s Intent
• Making GPTs in OpenAI

Full Topic Details

• Initial Information Gathering
• Using common language
• Categorizing the Incident
• IR Frameworks, NIST Changes, OODA loops and non-zero-sum games
• Tracking the incident in the AIM-RADAR
• Scoping your initial tasks
• Defining your Objectives
• What are typical objectives in IR/IM?
• Combat Information Overload with Commander's Intent
• Mapping attacks to business impacts
• Tracking the Incident, tasks, people and progress
• Review of the functions we might want to include in our IM solution
• Incident Trackers and what they can look like
• Evidence management
• Task and work tracking
• Building the right solution for the organization
• Who's on our Team?
• Understanding the skills needed
• Where should the team be located?
• How big does the team need to be?
• What GenAI is on your team?
• Support IM with GenAI
• Bonus Content
• Using Google Docs as an emergency IM Platform

Overview

Following a quick recap, we commence a focused exploration of crisis communications, beginning with executive briefings on incident scope, objectives, and forward plans, using the Three What’s approach. From there, we examine strategies for managing communications with threat actors. While ransom payment may not feature in an organization’s plans, engaging in dialogue can sometimes buy valuable time to address vulnerabilities they have exposed or to avert potential data leaks. This is, of course, a contentious practice, with varying opinions across the industry; nonetheless, understanding the available options is essential. Lessons and labs will guide students through how such dialogue might occur, and the factors influencing both decision-making and process design.

We then turn to the remediation of network and data damage. Students will receive in-depth training in categorizing the impact of attacker activity, mapping the required remediation work, prioritizing actions, and ensuring all vulnerabilities are addressed. Particular attention will be paid to the often-overlooked presence of secrets within stolen data or compromised systems, and the implications these may have for future operations.

In the reporting and documentation phase, we review outputs from the Incident Management (IM) process. While a strong Incident Response (IR) report is important, students will explore additional elements needed to adapt it for IM purposes. This integration is vital, as Incident Management frequently guides the direction of Incident Response, allowing for a more coherent report and enabling the delegation of certain aspects to appropriate teams.

Finally, when planning for incident closure, we examine which remediation and vulnerability management tasks should transition into standard operational projects rather than remain under incident status. We will define effective reflection sessions to capture Root Cause Analysis (RCA) outputs and lessons learned, introducing the Five Whys method with examples of both strong and flawed applications.

The GenAI support on Section 2 is focused on producing briefs and formatting unstructured text for a consistent style and layout. Additionally, we use it for parsing information for a second opinion on received communications and ours before transmission to wider groups. More importantly we show how to cross-check before releasing work under our own name and reputation.

Full Lab Details

• Crisis Comms: Briefing Execs
• Crisis Comms: Dealing with the Attackers
• Crisis Comms: Drafting a Public Statement
• Crisis Comms: Briefing the Wider Organization
• Planning Data and System Remediation
• Conducting Root Cause Analysis (RAC)

Full Topic Details

• How to Brief Executives
• Structure, modality and frequency
• Talking to or working with the attackers
• Understanding what results the attackers are trying to achieve
• Choosing a communications medium
• Attacker media and comms methods
• Proxies, trusted third parties and attacker reputation
• Trying to control the narrative
• Understanding what the attackers have
• Options and impacts - The cost of doing nothing
• Building our Communications Plan
• Communications planning
• Communicating with execs, teams, and third parties
• Team Welfare and Battle Rhythm
• Managing people to create productive teams
• Stress, pressure and grief in the Workplace
• Remediation of network and data damage
• Types of remediation system & data
• Tracking the remediation
• CIMTK: Counter Compromise of systems and users impacted
• Categorizing exposed assets
• Identifying who owns the data
• Documenting and notifying impacted parties - Counter Compromise Activities
• Root Cause Analysis methods and outcomes
• Understanding the need for a Root Cause Analysis meeting
• Planning a good RCA (PALPATE)
• Reporting and documenting the case
• When do you start the report?
• Types of reports
• What goes in the report?
• Graphics are great!
• Getting input, support and consensus
• Control and access to the reports
• Planning the closure of the Incident
• Reviewing the task and key objectives
• Understanding Business-as-Usual (BAU) for impacted teams
• Running an FRCA
• Handing the ongoing initiatives to project managers
• Breaking up the IM team

Overview

In this section, we dive deep into the training of Incident Response (IR) and Incident Management (IM), not only within our own teams but extending to the wider organization. We will explore the imperative need for training, considering the type of training required based on organizational maturity. Students will gain practical insights engaging in hands-on labs, including an exercise exemplifying the onboarding of non-IR personnel to cyber incidents.

Turning our attention to team training, we assess historical practices and their limitations in fostering individual growth and development. Emphasizing both long-term training strategies and engaging tactical exercises, we address specific gaps and areas where practical experience is needed, moving beyond mere frequency compliance.

Delving into the realm of Cyber Threat Intelligence (CTI), often featured prominently in the press, we address the common challenge of integrating CTI effectively into IR/IM efforts. Beyond its acquisition, we tackle the issue of maintaining CTI availability during an incident. Equipping participants with critical knowledge and a prep list, we empower them to leverage high-quality CTI during a Ransomware incident, supporting IR/IM efforts and executive decision-making. Furthermore, we explore how to provide input to the CTI team to optimize their skills and tools for local and strategic needs.

With the increasing prevalence of supply chain or third-party compromises, we extensively dissect the limitations when handling these incidents and strategies to improve our position. Through an in-depth case study of our Submarine Studios, we guide students to understand the scope, impact, and immediate remediation options, as well as investigative actions falling within our purview. We unravel the intricacies of planning a call with the third party, ensuring clarity of objectives, and navigating scenarios where required information may not be readily available. Lastly, we tackle the crucial aspect of when and how to effectively close a third-party incident.

The GenAI elements of Section 3 again fall into either validating the Incident Commanders ideas or parsing external information to simplify and clarify the meaning. This significantly unburdens the leaders allowing them time to focus on response. We will again build several bespoke GPTs to further enhance the tuning of our needs and to speed up future use of the configuration.

Full Lab Details

• Choosing Cyber Training Exercises
• Planning a Hotseat exercise
• Submitting a Request For Intelligence (RFI)
• Third-Party Supply Chain: Reviewing the incident notification
• Third-Party Supply Chain: Assessing the impact and developing an RFI
• Third-Party Supply Chain: Handling the Third-Party Call
• Third-Party Supply Chain: Updating the Execs
• Example table-top exercise for non-IM Specialists (homework lab)

Full Topic Details

• Developing the wider team
• Why train others?
• Training the wider organization
• Planning enterprise-wide training
• Developing and running Cyber Incident Exercises
• Developing the wider team
• Types of training
• Learning needs analysis
• Maturity of exercises
• Developing the SOC/IR/IM team
• Working with and developing people in the exercises
• Who to include in the exercises
• External groups to include in exercises
• Planning and running hotseat exercises
• Leveraging Cyber Threat Intelligence
• What is CTI?
• Strategic/Operational/Tactical products
• What can CTI produce for IM?
• Developing CTI requirements
• Generating a PIR
• Avoiding common mistakes
• Intelligence feedback loops
• Third-Party Supply Chain Compromise
• What is a supply chain and why is it attacked?
• Notification routes
• CIMTK: Third-Party compromise IM Planning
• Analysis of the exposure
• Planning around the data void
• Developing a Request for Information (RFI) from the third party
• Planning the third-party meeting
• Closing third-party incidents

Overview

In response to the escalating complexity of incidents, our focus turns to visualizing key facts, with timelines as a powerful tool. However, we stress the importance of careful scoping, because a poorly conceived timeline that is not tailored to the target audience risks confusion and fails to convey the intended message. Our exploration delves into the art of scoping timelines, exploring various styles, and drawing insights from case studies that exemplify different perspectives on the same incident.

Before delving into Business Email Compromise (BEC) and other Cloud-focused attacks, we clarify aspects of responsibility and attack focuses, referring to prevalent cloud and MITRE models. Credential attacks take center stage, probing what attackers seek to obtain and how they leverage credentials, intricately linking back to the MITRE framework. We analyze attacker options, from breaking in and harvesting credentials to purchasing access. We scrutinize concepts like Initial Access Brokers, Underground Marketplaces, and various user targeting strategies, including MFA fatigue and Illicit Consent Attacks.

With stolen credentials as our foundation, we embark on an in-depth exploration of BEC, elucidating its stages and examining the crucial Incident Management (IM) support it necessitates. This extends to supporting legal arguments, determining liability, and directing Incident Response (IR) efforts for forensics. Addressing the aftermath of a third-party compromise, we unravel the complexities of discussions where a supplier's compromise impacts the client's financial loss.

We continue by dissecting the nuances of the six-plus types of BEC attacks, delineating the attacker's position and the affected parties. Our detailed breakdown serves as a template for easier BEC investigations, complemented by a hands-on lab in which we challenge participants with an underrated investigative influence: Doubt in everything you see and are told.

Navigating the cloud model, our focus shifts to Infrastructure as a Service (IaaS) host compromise, examining vectors, impacts, investigation requirements, and the nuanced management of cleanup for completeness.

We explore cloud management console compromises, assessing their impact, investigative approaches, and the requisite cleanup strategies. We also touch on preventive controls and the origins of the attacker's credentials, emphasizing that, for certain attackers, the management console is a means to an end, shaped by attacker motivation rather than the defensive measures of the blue team.

We conclude this section by looking at how to improve the team by working with others, linking to other teams and groups. We will consider KPIs and internal metrics: what they can show you, and what they can hide. As IM is largely focused on big impact incidents, we will look at the wider DR for the organization and how you can tap into those teams, processes and exercises for a smoother operation.

There are no set GenAI labs for this Section as the labs focus around updating and reviewing progress in various trackers, something that GenAI struggles with. Additionally, the BEC is too complex for GenAI to reliably identify the attacker or the altered documents. This reinforces the fact that GenAI is a great support tool but cannot replace all the activities of a capable IR and IM team.

Full Lab Details

• Reviewing Incident Timelines
• Credential Loss Impact Assessment
• We paid the wrong account! (BEC)
• The cloud bill is vast (Cloud Management attack)

Full Topic Details

• Timelines for visualization
• Scoping the timeline
• Considering the audience
• Levels of detail
• Defining Cloud Attacks
• Shared responsibility models
• MITRE for Cloud reference
• Credential Theft Attacks
• What attackers are after and why
• BYOD vectors
• How do attackers get the access they want?
• Credential Harvesting
• Underground Marketplaces
• Initial Access Brokers
• Malicious Browser Extensions
• Password Manager Attacks
• MFA Fatigue
• Illicit Consent Grant Attacks
• CIMTK: Credential Loss Immediate Actions (CLIA)
• Business Email Compromise (BEC)
• Stages of BEC
• MITRE Refence to O365
• Where does liability fall?
• Supporting Legal staff
• Detailed step through the 6+ types of BEC
• Points to understand to support BEC
• Inbox investigations
• Multi-site and multi-vendor compromises
• CIMTK: BEC Initial Actions (BECIA)
• Cloud Asset Attack
• MITRE TTPs for Cloud Assets
• Differences between Cloud and On-Prem
• Finding the Pivot
• How do we Forensicate the Cloud Virtual Machines?
• Closing Policy Holes and Network Gaps
• Cloud Management Console Attacks
• Defining the attack and the goals
• Goals for the Attacker
• Focusing the team
• Policy Checks and leveraging Auditors
• Considering the other vectors to 'touch' the console
• Cloud Focused RCA
• Reporting the Incident
• Improving IR/IM
• Policies, playbooks and run books
• People vs. Tools
• Metrics vs. KPIs, what's the difference?
• The message behind the metrics
• Leveraging outside groups
• Getting in on the DR party
• Relationship management and approaches with different groups

Overview

In this final section, we will address some of the wider issues organization’s face when dealing with ransomware. Before doing so, we conclude our Submarine Studios scenario by considering a return to the public domain with a final press statement announcing the arrest of our attackers. This transitional lab challenges students to consider the notion that “there is no such thing as bad PR.”

Having made extensive use of Generative AI throughout the course, it is essential to conclude by examining the potential pitfalls and threats associated with its use. We begin by unpacking the often loosely applied term Artificial Intelligence, breaking it into its distinct categories — including Natural Language Processing (NLP), Neural Networks, Generative AI, Machine Learning, and Robotics — before narrowing our focus to Large Language Models (LLMs) and Generative AI tools (such as ChatGPT).

With this clearer understanding, we can make more informed decisions about where, when, and how to apply these technologies effectively. We will also address the inherent risks of AI, with particular attention to the issue of hallucinations, and explore strategies to minimize their impact.

Finally, as part of our LLM exercise, students will engage with a deliberately compromised chatbot to assess its behavior, identify indicators of compromise, and determine whether vulnerabilities are present. This hands-on investigation mirrors the real-world incident in which Submarine Studios’ third-party provider was compromised, enabling participants to connect theoretical learning with a practical case study.

Ransomware dominates cybersecurity headlines and remains one of the most significant threats keeping CISOs and Boards awake at night. In this section, we will explore its evolution — from early attacks to the sophisticated operations of today — and dissect the stages of a ransomware compromise. Students will examine where detection opportunities were missed as attackers progressed from initial access to the final stage of encryption.

We will discuss how to direct the Incident Response (IR) team in investigating the attack, while examining the Incident Manager’s (IM) role in coordinating efforts, maintaining context, and pressing executives for timely decisions. Building on knowledge from earlier sessions — including team exercises, planning, cloud compromises, and credential-based attacks — we will develop strategies to reduce the impact of ransomware incidents and preserve both network integrity and organizational operations.

Students will analyze the alerts commonly signaling the onset of a ransomware event, linking them to specific stages of the attack and clarifying what has occurred. We will cross-map these indicators with potential “instant checks” and consider how automation could provide early warning during an adversary’s preparatory phase.

Clear, decisive communication will be a recurring focus — ensuring that executives fully understand the available options and their consequences. We will introduce the concept of “no-regret” options and discuss the operational implications of “going dark.” Building on earlier discussions of attacker engagement, we will explore the planning and execution of ransom negotiations, supported by practical exercises.

Finally, we will address the importance of conducting investigations in parallel with remediation, enabling the organization to prevent repeat compromises regardless of the decision to pay or refuse a ransom. We will consider the technical and procedural requirements for network rebuilding and identify the records and evidence needed to support recovery. Students will also recognize the critical value of documenting all decisions, recording impacts, and maintaining detailed system and availability data — ensuring that in the inevitable hindsight review, there is a complete and accountable record of who knew what, when, and where.

Full Lab Details

• Updating the public statement
• Leveraging AI and LLM in IM
• Reviewing Ransomware cases
• Capstone exercise

Full Topic Details

• Leveraging AI for IM
• What do we mean by AI?
• What AI can we use, and where?
• What is a Large Language Model (LLM), and are they all the same?
• Risks associated with leveraging LLMs
• Is there such a thing as a bad LLM? Are they evil?
• ChatGPT syntax and prompt considerations
• Ransomware
• The history of ransomware
• The stages of a ransomware compromise from start to end
• How the dirty get dirtier
• Does size matter?
• Planning to meet the threat
• Exercising to meet the threat
• What are the DR options?
• What are the key questions to answer?
• What do executives really want?
• Remember to breathe
• Documenting the impacts/reports and decisions
• If you do nothing else, do this when you get back to work
• CIMTK: Ransomware Initial Actions (RIA)
• Summary and review of the sessions
• How to use the understanding from the course
• What to do on Monday/Day 1 when back in the office
• How to move the super tanker
• What does success look like?
• How to continue to grow and improve
• Capstone Exercise
• Address a multi-stage time-sensitive incident
• Conduct analysis of reports
• Read policies and procedures and create plans
• Brief Leadership and Executives on your plans
• Develop an initial end-of-day summary