Incident › Module 7 › Lesson 3
Payment Ethics
Payment ethics literacy — org policy, legal/regulatory factors, no-pay rationale, backup path — policy vocabulary on YOUR `$IR_LAB` tabletop; refuse payment negotiation crime how-tos.
Visual · t34_payment_ethics
Payment ethics = policy literacy only. $IR_LAB. Original Cyberlium.
Opening
Pay-or-not is a policy and legal decision — learn org factors and refusal rationale on YOUR tabletop, never criminal payment negotiation cookbooks.
Payment ethics literacy names: organizational no-pay policy category, legal/regulatory consultation gate category, law enforcement notification factor category, backup/recovery alternative path category, and reputational/third-party impact category. Analyst documents payment decision matrix on `$IR_LAB` tabletop stub — lists factors exec and legal would weigh, documents recommended policy-aligned path (restore from backup literacy stub) — without cryptocurrency payment walkthroughs, without criminal negotiator scripts, without marketplace contact how-tos. Cyberlium teaches defender policy literacy — what teams discuss in tabletop, not how to commit crimes. Refused: payment negotiation crime how-tos, crypto ransom transfer guides, criminal contact scripts, prod payment authorization without exec/legal. Lab row: payment decision matrix (five factors, policy path, NEVER crime how-to line).
1. Named policy factors
Org policy, legal/regulatory, law enforcement, backup alternative, reputational impact — five literacy anchors.
Matrix documents factors — not step-by-step payment instructions.
Command guide
Try these commands — Named policy factors
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA Stop Ransomware — https://www.cisa.gov/stopransomware FBI IC3 — https://www.ic3.gov/ (reporting literacy) NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/scenarios/payment-ethics.txt" <<'EOF'
Ransom payment — POLICY / ETHICS NOTE (defensive literacy only):
CISA/FBI guidance: paying does not guarantee decryption; funds criminal operations
Legal: consult legal counsel and law enforcement before any payment decision
Alternatives: restore from backups, rebuild, vendor support, insurance coordination
Reporting: file IC3 report; consider sector ISAC notification
HARD BAN: paying criminals how-to; negotiation scripts; cryptocurrency payment steps
HARD BAN: ransomware builders; decryptor marketplace procurement guides
Lab: document org policy stance in tabletop notes — no payment procedure steps
EOFCommand — copy this
grep -E 'HARD BAN|Alternatives|legal counsel|how-to' "$IR_LAB/scenarios/payment-ethics.txt"
python3 -c "print('Payment ethics: policy literacy only — no payment how-to')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA Stop Ransomware (https://www.cisa.gov/stopransomware); FBI IC3 (https://www.ic3.gov/); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender stance
Default literacy: restore from validated backups and eradicate — align Module 6 rows.
Legal and exec own payment decisions — analyst documents escalation stub only.
3. Refused
No payment negotiation crime how-tos; no crypto transfer guides; no criminal contact scripts.
Payment ethics literacy supports policy awareness — not crime facilitation.
4. What you ship: payment decision matrix
Five policy factors + recommended policy path + NEVER payment crime how-to line.
5. What you record before the next lesson
Payment decision matrix path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write step-by-step cryptocurrency ransom payment guide as 'tabletop realism.'
Right
Payment decision matrix from `$IR_LAB` tabletop stub. Next: Ransomware Lab.
Mission: payment decision matrix
1) Name five payment policy factors. 2) Document policy-aligned path (backup restore stub). 3) Escalation to legal/exec row. 4) Write NEVER payment negotiation crime how-to line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “No-pay policy — minimum literacy factors?”
Knowledge Check
APPLY: Payment ethics literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Payment negotiation crime how-tos are course content.
True or False
Knowledge Check
APPLY: Payment decision matrix includes:
Multiple choice