What evidence may show deliberate disruption?¶
The practical answer¶
Deliberate disruption should be supported by evidence that systems or services were intentionally made unavailable, degraded or unsafe.
The key evidential caution¶
The dangerous assumption is that every outage during a cyber incident was caused directly by the offender.
Some disruption may result from:
Key points¶
- defensive shutdown
- network isolation
- recovery activity
- hardware failure
- configuration error
- overloaded systems
- expired certificates
- third-party failure
Evidence supporting deliberate disruption may include:
- malicious commands
- service stoppage
- account lockout
- configuration change
- file encryption
- deletion
- resource exhaustion
- process termination
- remote-session activity
- communications claiming responsibility
Investigators should separate offender actions from responder actions.
Record who shut systems down, when isolation occurred and what was already unavailable.
A ransom note or threat may support intent but does not prove which technical action caused the outage.
Deliberate disruption may be selective. An offender may target identity, virtualisation, communications or management systems to create a wider outage than the number of directly affected devices suggests. Preserve dependency information so the actual technical cause of the operational impact is understood.
Operational impact should be measured separately from technical impact. A small number of disabled systems may interrupt a critical service, while widespread encryption of unused systems may have limited immediate consequence.
Also distinguish direct offender action from disruption caused by precautionary shutdown, isolation, restoration or loss of dependent services. The overall business impact may result from several causes, each requiring its own evidential basis.
Operational takeaway¶
Attribute disruption from the specific commands, changes and system effects, and distinguish offender action from containment, recovery and unrelated failure.