Threat-intel lead must resolve whether the incident is contained or still

Situation

The incident is contained sits with threat-intel lead because a partner SSO integration that never got an offboarding review hit a law firm with a client-matter data store. Evidence is over-privileged service account in production; write the Cybersecurity Incident Response option that extract can carry.

Decision

Threat-intel lead in a law firm with a client-matter data store must choose The incident is contained / Still lateral using over-privileged service account in production after a partner SSO integration that never got an offboarding review.

Hypotheses to test

• The population in over-privileged service account in production is the one a partner SSO integration that never got an offboarding review named, so The incident is contained follows for this Incident Response file.
• The population in over-privileged service account in production is adjacent only to a partner SSO integration that never got an offboarding review; Still lateral is the honest Cybersecurity call.
• A law firm with a client-matter data store already contained a partner SSO integration that never got an offboarding review before over-privileged service account in production arrived; no new Incident Response path.
• Provenance on over-privileged service account in production after a partner SSO integration that never got an offboarding review is broken; do not pick The incident is contained or Still lateral yet.

Analysis required

• Map identities, standing privileges, and last-use timestamps in over-privileged service account in production to the blast radius of a partner SSO integration that never got an offboarding review.
• Name the compensating control that would let threat-intel lead release a reversible hold.
• Test whether access is still live, already rotated, or only written as closed.
• For this Cybersecurity Incident Response file, read over-privileged service account in production against a partner SSO integration that never got an offboarding review and write the one fact that would move the incident is contained for threat-intel lead.

Recommendation

Choose The incident is contained / Still lateral on this Cybersecurity / Incident Response packet (over-privileged service account in production after a partner SSO integration that never got an offboarding review). If over-privileged service account in production cannot force a Cybersecurity label under Incident Response, stop. Do not invent pages a law firm with a client-matter data store does not have.