Decision Rights, Authorisation and the White Team

All courses / AI Purple / Module 5 / Chapter 20

Learning objectives

After the lesson the participant can:

Explain the ten decisions of the loop and the four rules that govern the decision-rights file.
Draft a decision-rights file with holders, deputies, times and records, checking the forbidden pairs.
Classify residual findings into the three acceptance tiers and name who may not accept.
Run a tabletop with injects for an exercise that becomes an incident and a real incident behind an exercise.

Key concepts

Ten decisions D1 to D10: Authorise an exercise; change scope during a window; approve a run above S1; stop; restart; declare an event real or pause for deconfliction; raise a delegation level; accept a residual finding; declare a finding closed and verified; declare a technique covered.
Decision-rights file: The DRF record: the table of decisions in machine-readable form with the white team, the stop holders and the acceptance tiers. It is versioned, changed by pull request, approved by the management body and tested in a tabletop.
Stop and restart: Any named stop holder may stop without approval or justification, through a route outside the exercise platform. Restart is not the mirror of stop: it needs the white-team lead and the system owner, after review, at a lower level.
Acceptance tiers: Tier 1, low or medium severity and not a priority technique, accepted by the head of the owning function for up to 180 days; tier 2, high severity or any priority technique, by the CISO for 90 days; tier 3, critical or beyond appetite, by the management body.
Tag ledger: The record that links tagged emulation actions to the exercise. No alert is closed as an exercise without a match in the ledger, and it must be readable by the incident commander, the trusted agent and the provider's shift lead without going through the tester.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Decisions of the loop and the stage each belongs to

Sort each decision of the loop into the stage the chapter assigns it to.

Interactive exercise 2 · Put in order

When an emulation becomes an incident

An authorised emulation has caused real harm. Put the four things the chapter says happen in order.

Teaching plan

15 min	The teacher presents the ten decisions and the four rules: lowest tier with evidence decides, every right has a time, authority and execution are separate, and the file is data.
15 min	Short input on authorisation, the white team, stopping and the acceptance tiers, with the worked risk acceptance for T1098.001 at Hansa Mutual.
25 min	Groups draft a decision-rights file for their organisation or adapt Nordvik Region's, naming holder, deputy, second deputy and time for each decision.
35 min	Exercise: tabletop with four injects against the drafted file, timed and recorded.
15 min	Debrief: each inject over target becomes a finding; compare with Nordvik Region's tabletop, where the ledger lookup took 22 minutes against 15 and revocation 190 seconds against 120.

Discussion

The right to stop is never routed upwards and needs no justification. What does an organisation risk by granting it so freely, and what does it risk by not doing so?
An adversary who knows an exercise is running may rely on the defender to dismiss what it sees. How does the tag-ledger rule change the incentives of an analyst at two in the morning?
Karin Lund keeps Nordvik Region's file but is excluded from authorisation, restart and acceptance. What does that exclusion protect?

Written exercise

Exercise · 35 minutes

Tabletop: an exercise that becomes an incident

Using the decision-rights file your group drafted, run a tabletop with a facilitator who holds none of the decisions. Play four injects in order: an alert with no match in the tag ledger; a tagged emulation with a real effect, such as a locked staff account; a holder who cannot be reached for a scope change; and a request to continue with the next scenario after a stop. For each inject, name the decision that applies, who holds it, the route used and the evidence relied on, and record the target time and the time your group actually needed. Anything over target is written as a finding with an owner, and the file is amended.

Deliverable: A tabletop record with target and actual time per inject, the gaps found, and the amendments proposed to the decision-rights file.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Who may accept a high-severity finding or a finding on a priority technique, and for how long at most?
Show the answer
A. The CISO, at tier 2, for at most 90 days.
Tier 2 covers high severity or any priority technique: the CISO, or the group CISO at Hansa Mutual, accepts, the management body is informed, and the longest expiry is 90 days. The author, the closure owner and the tester may not accept.
How does the chapter describe the decision to restart after a stop?
Show the answer
D. It needs the white-team lead and the system owner, after review, and resumes at a lower level.
D5 is not the mirror of stop. It needs the white-team lead with the owner of the system concerned, after review and confirmed clean-up, and the exercise restarts at a lower level. No agent holds D5.
What rule catches a real incident hidden behind an exercise?
Show the answer
B. No alert is closed as an exercise without a tag-ledger match, and a failed match freezes it.
The standing rule is that no alert is closed as an exercise without a match in the tag ledger. When the match fails, D6 freezes the exercise and the incident is handled as real, so the ledger must be readable without the tester.