Incident › Module 8 › Lesson 4
Lab — Comms
Comms and legal lab on `$IR_LAB` — comms plan, legal checkpoints, external notify matrix bundled.
Visual · t34_comms_lab
Lab: comms/legal pack on YOUR $IR_LAB tabletop. Original Cyberlium.
Opening
Ship comms and legal artifacts from YOUR tabletop — templates, legal gates, notify matrix — zero unauthorized live notifications.
On YOUR `$IR_LAB` per brief: (1) scope proof — ransomware tabletop scenario from Module 7 labeled; (2) comms plan stub Module 8-1; (3) legal checkpoint list Module 8-2; (4) external notify matrix Module 8-3; (5) cross-link approval flow diagram stub (comms → legal → external); (6) integrity — `$IR_LAB` only, no unauthorized prod notifications, no live victim PII, no legal impersonation; (7) chmod 600 pack. Cross-link Module 7 tabletop decisions — comms reflects defender policy path only.
1. Lab deliverables
Comms + legal + external notify cross-indexed — single approval flow thread.
Templates reference facts-known vs under-investigation discipline.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final SANS IR — https://www.sans.org/for-organizations/incident-response/ FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/comms/executive-brief-template.md" <<'EOF'
# Executive Brief — YOUR template (1 page)
- **Incident ID:** LAB-IR-RANSOM-001
- **Severity:** Sev-1 (tabletop)
- **Business impact:** [systems down / data at risk — fictional]
- **Status:** Contained / investigating / recovering
- **Decisions needed:** [continue ops / notify regulators / resource request]
- **Next milestone:** [recovery validation UTC]
Pair with internal-status-template.md for layered comms
EOFCommand — copy this
grep -E 'LAB-IR-RANSOM|Decisions needed|internal-status' "$IR_LAB/comms/executive-brief-template.md"
ls "$IR_LAB/comms/"
python3 -c "print('Comms lab: internal + external + executive templates complete')"═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t34-ir/comms/internal-status-template.md | Select-String helpdesk
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); SANS IR (https://www.sans.org/for-organizations/incident-response/); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Each external row has approval owner stub — not analyst solo send.
Zero unauthorized notification notes or live contact details in pack.
3. Teardown
Secure notes chmod 600; templates remain lab-only until org authorization.
Archive stub optional per brief.
4. What you ship: comms lab pack
Comms plan + legal checkpoints + notify matrix + approval flow + integrity — chmod 600.
5. What you record before the next lesson
Comms lab pack path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Comms lab includes sent unauthorized customer emails as proof of completion.
Right
Comms lab pack on `$IR_LAB` tabletop. Next: quiz.
Mission: comms lab
1) Scope and tabletop link proof. 2) Comms plan and legal checkpoints. 3) External notify matrix. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Approval flow diagram — minimum nodes?”
Knowledge Check
APPLY: Comms lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Live regulatory filing is comms lab deliverable.
True or False
Knowledge Check
APPLY: Comms lab pack should:
Multiple choice