HomeResourcesProject resourcesTemplatesAccess-denial response

RUNBOOK

Access-denial response

Practice validation, scope, containment, and recovery as a team.

Where it goes

Fill in roles and decisions during a tabletop exercise.

Download incident-playbook.txt ↓Open lab 06 →

How to use this resource

  1. Save incident-playbook.txt beside your project files and open it in a text editor.
  2. Complete the roles and read the stale-record-ID scenario.
  3. Answer the four prompts about evidence, approval, recovery, and follow-up ownership.
  4. Save the file after observing a 403 decision log from the exercise API.

Lab 06 shows how to generate the event and work through the scenario.

incident-playbook.txt
TABLETOP / REPEATED ACCESS DENIALS

Trigger: an unusual increase in record_read events with status 403.
This is a signal to investigate, not proof of compromise.

Roles: incident lead _____; investigator _____; communications owner _____
1. Validate: check time range, baseline, affected identities, and request context.
2. Scope: is it one caller, a client regression, or a wider access pattern?
3. Contain: choose the narrowest justified intervention; record the decision.
4. Preserve: retain relevant evidence with controlled access. Never log tokens.
5. Recover: verify intended users retain access and checks still pass.
6. Learn: add one regression test or detection improvement with an owner.

Exercise inject: a client update causes repeated requests for stale record IDs.
What evidence distinguishes this from deliberate enumeration? __________
Who can approve containment? __________
How will you measure recovery? __________
Next improvement / owner / due date: __________