Incident context
Trace how a temporary work share evolved into a persistent access vector, then separate sharing responsibility from role validity.
Investigator missionDon't look for a single person to blame. Examine who shared the link, what rule allowed it to remain valid, and who is responsible for correcting the policy.
Before you begin
- 01
Reconstruct the sharing scope
- 02
Identify the control owner
- 03
Enforce time- and role-restricted sharing