Write a call-back runbook and drill it against eight written requests

short · 40 min · Objective 3.2

Task

Write the verification procedure the lesson says defeats voice and video impersonation, then drill it against eight written scenarios. The procedure judges the request and the requester's channel, never the media, so no synthetic audio or video is made or needed. The drills test whether your runbook routes every call-back through a trusted record and never through the contact detail the request supplied.

Steps

  1. Write lab/trusted-contacts.csv with header person,role,phone,source,last_verified for six invented people: the chief executive, the finance director, the chief executive's assistant, the help desk lead, an HR contact and a supplier's accounts contact. source names the trusted record each number comes from, such as the HR directory, the supplier master record created at onboarding or the signed contract.
  2. Write lab/callback-runbook.md with these ## sections: Scope, High-risk requests, Trusted sources, Procedure, Pre-agreed challenges, Changes to trusted records, Exceptions and Reporting. Procedure must state the lesson's three rules: end the inbound contact; reach the sender on a contact detail from a trusted source, never one in the request; and confirm the specific request, not just the person. Exceptions must say that seniority is not an exception.
  3. Write lab/request-drills.csv with header id,channel,claimed_sender,request_type,contact_in_request,callback_phone,decision,rule_applied and eight written scenarios: a voice call from the 'chief executive' demanding an urgent payment and offering a number to ring back; a video call with the 'finance director' and two 'colleagues'; a supplier email giving new bank details and a new contact number; an employee asking the help desk for an MFA reset; 'IT support' phoning an employee; a voicemail from the chief executive's 'new mobile' asking the assistant to buy gift cards; a genuine request from the real chief executive; and a request whose trusted record was itself changed last week.
  4. Work each drill through the runbook alone. Fill callback_phone with the number you would actually dial and decision with proceed, hold or refuse, and name in rule_applied the runbook rule that decided it.
  5. For the drill whose trusted record changed recently, write in the runbook's Changes to trusted records section what independent verification and approval that change itself should have needed. The procedure only fails if the record it trusts has been altered.

Verify

cd ~/secai-lab
python - <<'EOF'
import csv
trusted = {r['phone'] for r in csv.DictReader(open('lab/trusted-contacts.csv'))}
rows = list(csv.DictReader(open('lab/request-drills.csv')))
bad = [r['id'] for r in rows if r['callback_phone'] not in trusted or r['callback_phone'] == r['contact_in_request']]
print(len(rows), 'drills; call-back not from a trusted record:', bad or 'none')
print('decisions used:', sorted({r['decision'] for r in rows}))
need = ['Scope', 'High-risk requests', 'Trusted sources', 'Procedure', 'Pre-agreed challenges',
        'Changes to trusted records', 'Exceptions', 'Reporting']
heads = [l[3:].strip() for l in open('lab/callback-runbook.md') if l.startswith('## ')]
print('missing runbook sections:', [h for h in need if h not in heads] or 'none')
EOF

Eight drills, with no call-back dialled to a number that is missing from the trusted record or that came with the request. All three decisions appear (the genuine request proceeds after its call-back, and the changed record holds), and no runbook section is missing. A drill that rings the number the caller offered is the trap the lesson describes, so the check flags it.

Notes

Notice what none of the drills needed: any judgement about whether the voice or the face was real. That is the design. A runbook that asks staff to listen for artefacts sets them a test that the next generation of models will pass, whereas one that routes every high-risk request through a trusted record keeps working however good the fake becomes.

This is an independent study companion for CompTIA SecAI+ CY0-001 and is not produced by or endorsed by CompTIA.