Triage and contain two live security incidents

You are a security analyst.

Simulated workplaceIntermediate missionCAQA Nova Digital Systems

What is going on

Two incidents are open in the Security and Safety Incident Register. At Merriwa Medical Centre the practice manager received an email impersonating a pathology supplier asking for updated bank details, which she did not click. At Harbourline Accountants a partner's mailbox was signed into from overseas at 3:10 am and an inbox rule was created forwarding mail to an external address; the account has been contained but the exposure has not been assessed. Yasmin Haddad wants both worked through the Cyber Security Incident Response Procedure today, with evidence preserved, wider exposure checked, plain language client notifications drafted and an assessment of whether personal information was accessed at Harbourline.

Yasmin Haddad, Cyber Security Lead
Subject: Triage the Merriwa supplier email and the Harbourline mailbox rule

Two live items need a security analyst today. SEC-26-058 is the fake supplier bank details email at Merriwa, and SEC-26-057 is the overseas sign in and forwarding rule on a Harbourline partner's mailbox. Work through the incident response procedure for both: confirm the incident, preserve evidence, contain, check for wider exposure, and prepare the client notification in plain language. For Harbourline I also need your assessment of whether personal information was accessed so Oliver can make the privacy breach decision.

Your brief

Confirm and classify both incidents, preserve evidence, complete or verify containment, check for wider exposure across the client, update the register, and prepare client notifications and a privacy assessment for the Business Services Manager.

Work through it

You do not need to do it all. Doing a few of these will show you what the work is like. Your ticks and notes stay on this device.

Read the Cyber Security Incident Response Procedure and the Information Security Policy incident section and list the steps and timeframes for a severity two incident.
For the Merriwa email, analyse the headers and the sending domain, record the indicators, confirm whether any other Merriwa user received it, and record the findings in SEC-26-058.
Block the sending domain and any linked addresses at the email gateway, record the containment as an emergency change in the Change Request Register and update the ticket T-48230.
For Harbourline, review the sign in logs, the rule creation time and the mailbox contents that the forwarding rule would have captured, and record the timeline in SEC-26-057.
Assess what personal information was in the mail forwarded before the rule was removed, estimate the number of people affected and prepare a written assessment for Oliver Standish under the notifiable data breaches scheme.
Check whether other Harbourline accounts show sign ins from the same location or new inbox rules and record what you find.
Draft plain language notifications for both clients describing what happened, what Nova did, what the client must do and what happens next.
Update both register entries with status, actions and the post incident review date.

My notes: what did I enjoy, and what surprised me?

What someone in this role would produce

Updated register entries with timelines and indicators
Emergency change record
Privacy breach assessment for the Business Services Manager
Two client notifications
Wider exposure check results

Printing this is a record of what you explored. It is not a certificate or a qualification.