LDR553: Cyber Incident Management

Overview

In Section 1 we focus on understanding the incident, gathering information, and establishing the language the whole team will use. We review common terms, abbreviations, and incident types so that when we talk to different functions (IR, legal, HR, comms) we mean the same things. From there we categorise the incident using the RAPID framework and define what the Incident Management group is trying to achieve, so that focus is set early and maintained as complexity grows.

The centerpiece of this phase is the CIMTK, specifically The Grid: a structured set of questions and initial tasks that gets the team moving in the right direction from the first hour. Identifying and allocating tasks early allows concurrent activity across support teams: IR, IT, Legal, HR, and the IM function itself. We then use Commander's Intent to brief those teams clearly, communicating short and medium-term goals without creating information dependency.

We move into platform and tooling considerations. Where the team operates from matters, especially when attackers may have visibility of your response infrastructure. Team composition follows: who you need, where they sit, how big the group should be, and how to make it work when it is a mix of internal staff, retained advisors, and external specialists.

We close Section 1 by adding GenAI to the bench. Throughout the course, GenAI is used as a practical support tool: drafting briefs, parsing incoming information, stress-testing decisions. In this section students build their first purpose-built GPT for use in the labs ahead.

Exercises

• Lab 1.1: Initial Setup at the Start of the Course
• Lab 1.2: Initial Incident Briefing
• Lab 1.3: CIMTK: The Grid
• Lab 1.4: Setting Objectives and Developing the Commander's Intent
• Lab 1.5: Making GPTs in OpenAI

Topics

• Initial Information Gathering
• Using ubiquitous language and categorising the incident with RAPID
• IR frameworks: PICERL, NIST CSF 2.0, OODA loops
• Tracking the incident in AIM-RADAR
• Scoping initial tasks with The Grid
• Defining Objectives
• Typical IM objectives and how to set them
• Commander's Intent and combating information overload
• Mapping attack activity to business impact
• Tracking the Incident, Tasks, People and Progress
• IM platform requirements and safe operating environments
• Task, evidence, and impact tracking
• Building the right solution for the organisation
• Who's on Our Team?
• Skills, size, location, and follow-the-sun vs centralize-and-focus
• Making hybrid and multi-location teams work
• What GenAI Is on Your Team?
• Using GenAI to support IM tasks
• Building and configuring GPTs for incident use

Overview

Section 2 opens with executive briefings. Using the 3-Whats structure (What Happened, What Is Happening Now, What Is Happening Next) we give the IC a repeatable format for briefing the board and leadership team at any stage of the incident, with any level of completeness. The format works when facts are still emerging and when the exec audience is impatient.

We move into public communications, both pre-emptive and reactive. Students work through when and how to get ahead of a story versus when to respond, what goes into a public statement, and how to manage the tone and legal exposure of external communications. Lab 2.2 works through both approaches against the Submarine Studios scenario.

Briefing the wider organization presents different challenges: the audience is larger, the information needs to be controlled, and the message must hold up across different functions simultaneously. Lab 2.3 covers how to construct and deliver that briefing without inadvertently spreading panic or leaking details to the wrong audience.

The remediation section covers categorizing the damage, mapping the work, prioritizing actions, and ensuring nothing is missed. Attention goes to secrets within stolen data and compromised systems (credentials, API keys, certificates) and the downstream implications these carry for future operations.

We close with root cause analysis and incident reporting. A strong IR report is necessary but not sufficient for IM purposes; the IC needs to understand what additional material is required, how to get input from teams under pressure, and how to manage access and control over sensitive documentation. Lab 2.4 examines examples of poor root cause analysis meetings. As an outsider, the student spots the dysfunction more easily than those sitting in it and is better placed to avoid the same traps when running their own RCA. Lab 2.5 covers remediation prioritization across systems and data, to give the student a glimpse of how a remediation rebuild plan looks and demonstrates how you can build one when you lack project management support.

GenAI in Section 2 focuses on producing briefs, reformatting unstructured text, and cross-checking communications before release, pressure-testing your own output before it goes to the exec. As always these are supportive functions that the AI is performing and not replacing any staff member or IC task.

Exercises

• Lab 2.0: How They Said It (optional pre-class reading on press statements and making better AI Configs)
• Lab 2.1: Crisis Comms: Briefing Executives
• Lab 2.2: Crisis Comms: Pre-emptive or Reactive Public Statements
• Lab 2.3: Crisis Comms: Briefing the Wider Organization
• Lab 2.4: What Is a Good RCA?
• Lab 2.5: Prioritizing the Data and System Remediation

Topics

• How to Brief Executives
• Structure, modality, and frequency of exec briefings
• Planning, delivering exec style briefings
• Public Communications: Pre-emptive and Reactive
• When to get ahead of a story and when to wait to respond
• Drafting public statements and managing legal exposure
• Briefing the Wider Organization
• Controlling information and managing different audience needs
• Battle rhythm and team welfare
• Remediation of System and Data Damage
• Categorizing damage and tracking remediation
• Counter Compromise Activity planning and execution
• Identifying secrets in stolen data and their downstream implications
• Root Cause Analysis
• Planning a good RCA
• Five Whys: strong and flawed applications
• Reporting and Closure
• Report types, content, access control
• Transitioning from incident status to BAU projects
• Breaking up the IM team

Overview

Section 3 opens with team development. We examine what good training looks like for IR and IM functions: not frequency compliance, but targeted development against specific capability gaps. Students work through exercise selection (Lab 3.1) and plan a hot seat exercise (Lab 3.2), with guidance on how to build exercises that challenge teams without overwhelming them. This is one of the most important sections of the course; no other zero-cost change will improve your organization's IM capabilities more than running good exercises.

Cyber Threat Intelligence is talked up far more than it is used well during real incidents. In this section we address why that is, and how to fix it. We cover the intelligence cycle from a practitioner perspective: what CTI can produce for an IM team, how to generate Priority Intelligence Requirements, and how to maintain CTI access during a fast-moving incident. Lab 3.3 has the student develop a request for CTI Support for threat actor profiles relevant to the Submarine Studios scenario and then leveraging OpenCTI they see how it looks in a live platform as they compare it with a written report from an Intel vendor.

The third-party compromise module runs across two long labs and is the most substantial element of the section. Starting with an optional pre-class lab reviewing real third-party incident reports, students then work through the full lifecycle of a supply chain incident using the CURTAIN framework. It runs as seven parallel swim lanes rather than a sequential checklist, coordinated by the IC and worked while the supplier is still telling you almost nothing. Lab 3.4 covers reviewing a third-party notification and building a Supplier Assurance Question Set (SAQS), the structured set of questions you put to a vendor when information is scarce. Lab 3.5 turns to the communications that run alongside the investigation: the vendor call, the internal team brief, and the executive update.

The section closes with bug bounty and vulnerability reporting programs: understanding how researchers and third parties approach you, what their motivations are, and how to manage those relationships without losing control of the narrative or the timeline. The incident management function is involved from the first report. What looks like a routine vulnerability disclosure can, once investigated, reveal a significant compromise that has been running undetected for months, and judging when a disclosure becomes an incident is an IM decision rather than a technical one.

Exercises

• Lab 3.0: Reviewing Third-Party Supply Incident Reports (optional pre-class reading)
• Lab 3.1: Choosing Cyber Training Exercises
• Lab 3.2: Planning a Hot Seat Exercise
• Lab 3.3: Working with Cyber Threat Intelligence
• Lab 3.4: Reviewing a Third-Party Notice and Building a SAQS
• Lab 3.5: Comms During a Third-Party Incident

Topics

• Developing IR/IM Training and Exercises
• Exercise types, maturity levels, and learning needs analysis
• Planning and running hot seat exercises
• Who to include and what to assess
• Leveraging Cyber Threat Intelligence
• Strategic, operational, and tactical CTI products
• Generating PIRs and avoiding common integration failures
• Using OpenCTI with threat actor intelligence
• Third-Party Supply Chain Compromise
• Why they are so impactful and what caused the increase in reports
• CIMTK: CURTAIN framework for managing the supplier incident
• Building a Supplier Assurance Question Set (SAQS)
• Third-party communications: the vendor call, the team brief, and the exec update
• Closing third-party incidents
• Bug Bounty and Vulnerability Reporting Programs
• Researcher types and their motivations
• Managing disclosure timelines and narrative control

Overview

Section 4 opens with an optional pre-class lab reviewing high-impact credential compromise cases, before moving into timeline visualization. A well-scoped timeline is a powerful communication tool; a poorly scoped one creates confusion. We work through how to build timelines for different audiences at different stages of an incident.

Credential theft and identity compromise take centre stage, and this is where the TRACE framework does its primary work. The core teaching point is one that catches organizations repeatedly: resetting a password does not evict an attacker who holds a valid refresh token. The 7Rs is a sequence, not a checklist: Restrict (lock the account; this stops Entra issuing new tokens), Revoke active sessions, Revoke refresh tokens, Reset credentials, Review MFA methods and trusted devices, Re-enroll MFA, Re-enable the account. Run them out of order and the attacker stays in. Lab 4.2 builds the full credential exposure picture for the Submarine Studios scenario and works through eviction planning using the TRACE tabs in AIM-RADAR.

Business Email Compromise is examined in depth: its stages, the six-plus attack types, where liability falls, how to support legal arguments, and what the IC needs to direct IR forensics effectively. Lab 4.3 puts students inside a BEC investigation where the operative challenge is doubt: doubt what you see and are told.

The section introduces agentic AI as an incident management challenge. As AI agents become more common in enterprise environments, incident managers need a framework for what happens when an agent behaves unexpectedly or when a vendor's agent is in scope during a third-party incident. The CORDS framework (Confirm, Own, Restrain, Document, Sanction) provides that structure, with graduated restraint options (from pausing the queue through to full termination) and an emphasis on evidence preservation before any reset or redeployment.

Lab 4.4 covers cloud management console attacks as a homework exercise. Lab 4.5 returns to the Submarine Studios scenario for a public statement update, applying the communications skills from Section 2 with the fuller picture now available.

Exercises

• Lab 4.0: Devastating Credential Compromises (optional)
• Lab 4.1: Reviewing Incident Timelines
• Lab 4.2: Credential Loss Impact Assessment
• Lab 4.3: We Paid the Wrong Account! (BEC)
• Lab 4.4: The Cloud Bill Is Vast!
• Lab 4.5: Crisis Comms: Updating the Public Statement

Topics

• Timelines for Visualization
• Scoping, audience, and levels of detail
• Credential Theft and Identity Compromise
• What attackers seek and how they use stolen credentials
• MFA fatigue, OAuth consent attacks, AiTM phishing, and infostealer techniques
• CIMTK: TRACE framework: Track, Reset, Assess reach, Compare, Extend monitoring
• The 7Rs eviction sequence: Restrict, Revoke sessions, Revoke refresh tokens, Reset, Review MFA, Re-enroll MFA, Re-enable
• Why order matters: token lifetime, tenant boundaries, and federation traps
• Business Email Compromise
• Stages of BEC and the six-plus attack types
• Liability, legal support, and inbox investigation
• Multi-site and multi-vendor compromise scenarios
• Cloud Asset and Management Console Attacks
• IaaS host compromise: vectors, impact, investigation, and clean-up
• Management console compromise: attacker goals, policy checks, and RCA
• Agentic AI During Incidents
• What changes when an AI agent is in scope
• CIMTK: CORDS framework: Confirm, Own, Restrain, Document, Sanction
• Graduated restraint options and evidence preservation requirements
• Pairing CORDS and CURTAIN when a vendor's agent is in play

Overview

The industry uses the term artificial intelligence loosely. Section 5 does not: we break it into its actual categories before narrowing to LLMs and the GenAI tools used throughout the course. We examine hallucination risk, the governance implications of deploying AI in a response context, and where AI adds genuine value versus where it introduces risk that outweighs the benefit. Lab 5.1 works through an agent incident (building on the CORDS framework introduced in Section 4) where students investigate an AI agent behaving outside its intended scope.

Lab 5.2 covers hostile communications: managing dialogue with threat actors, understanding what the attacker is trying to achieve, and keeping executives informed of options and their consequences. This builds directly on the attacker engagement content in Section 2.

Ransomware occupies the second half of the section. We cover its evolution, the stages of a compromise from initial access to encryption, and where detection opportunities were missed. The IC's role is clear: direct IR, maintain context, press executives for decisions, and keep the organization's options open for as long as possible. We work through no-regret options, the implications of going dark, negotiation planning, and the evidence and documentation requirements that determine whether the post-incident review is productive or a liability exercise.

Students close with the capstone: a full multi-stage exercise running across live and OnDemand formats, drawing on every section of the course.

Exercises

• Lab 5.0: Reviewing Ransomware Cases (Optional)
• Lab 5.1: Managing an Agent Incident
• Lab 5.2: Managing Hostile Communications
• Lab 5.3: Capstone

Topics

• AI and LLM Risk in IM
• Defining AI categories and understanding LLMs
• Hallucination risk and governance implications of AI in response contexts
• Where AI supports IM and where it introduces new risk
• Managing an Agent Incident
• Applying the CORDS framework under incident conditions
• Investigating agent behavior and scope violations
• Managing Hostile Communications
• Attacker engagement: options, risks, and what dialogue can and cannot achieve
• Keeping executives informed of options and consequences
• Ransomware
• History, evolution, and current operator tradecraft
• Stages from initial access to encryption, where detection was possible
• Directing IR and pressing execs for timely decisions
• No-regret options, going dark, and negotiation planning
• Documenting impacts, decisions, and system availability for the hindsight review
• Capstone Exercise
• Multi-stage time-pressured incident drawing on all five sections
• Available to live in-person, live online, and OnDemand students