Find nine root causes where you expected one

short · 50 min · Objective 3.3

Task

Take the intrusion you staged and investigated, and run a proper root cause analysis on it: past the proximate cause, across every layer, including the detection failure as a cause in its own right. Then convert the findings into tracked actions.

Steps

  1. Write the proximate cause in one sentence -- the action that immediately preceded the intrusion.
  2. Now ask why at each layer rather than following one chain. For every control that could have stopped or bounded it, ask whether it existed, whether it was operating, and why it did not stop this.
  3. Add the detection failure as its own root cause branch: why did this run as long as it did? That question is separate from how they got in and is usually more actionable.
  4. Stop when your causes name conditions rather than people. If any cause names a person, keep going -- human error is a constant of the environment, and a system that fails when someone makes an ordinary mistake has a design problem.
  5. For every cause, write the action: a detection, a preventive control, a telemetry gap to close, a process change, or an explicit acceptance.
  6. Give each action an owner, a date, and a closing criterion that is evidence rather than assertion.
  7. Finally, read any earlier findings you have written in this course. Any that appear twice are a finding about the process, not about the incident.

Verify

grep -c "^" /tmp/rca-causes.tsv
awk -F'\t' '$2=="detection"' /tmp/rca-causes.tsv | wc -l
awk -F'\t' '$3==""' /tmp/rca-actions.tsv | wc -l
awk -F'\t' '$4==""' /tmp/rca-actions.tsv | wc -l
comm -12 <(sort /tmp/rca-causes.tsv) <(sort /tmp/previous-findings.tsv) | wc -l

The cause count should be well above one. The detection branch must be non-empty -- an analysis with no detection cause has not asked why it ran so long. The two empty-field counts must be zero: every action needs an owner and a date. The last is the repeat count, and a non-zero result is the most important line in the whole analysis.

Notes

The nine-cause shape from the lesson is not an exaggeration. Filtering, macro policy, execution control, process-chain detection, least privilege, credential protection, segmentation, and eleven days of not noticing -- eight independent controls, and none of them is "the user".

Write the actions as five real ones rather than twenty aspirational ones. Five that get done beat twenty that do not, and the temptation after a bad incident is always twenty.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.