1
What stops today, and what exposure do we buy?
Executive Decision · after inject 3 · timer 3 minutes
Held byCIO
VP R&D"Every day that link is dark, we lose ground we cannot win back." CTO"Every hour it stays open, the attacker can keep reading."
a

Dark now. Research is paused on everything that depends on the link, and every way in is shut.

CostFinancial one step worse. The Reputational step applies when Decision 3 resolves, unless Decision 3 is Open: this decision's triangle cannot shield it, Decision 3's can, and if Decision 3 expires it applies as a cost. RollAutomatic if the owner of the old system was named in the first call, else 10+. ComplicationThe shutdown breaks more of the link: Financial one more step.
b

A bounded window. The link stays open under watch for one hour of story time, ending before inject 5, while a temporary link is built.

CostSecurity one step worse. Roll10+. ComplicationThe attacker reads more research data in the window.
c

Wait for the temporary link, no limit. The wait outcome if the time runs out.

CostSecurity two steps worse. Roll15+, it goes against the CTO's stated fact. ComplicationSecurity one step worse and Financial one step worse: the attacker finishes copying the most valuable data.
Triangle tensionTime (shut them out) against Money (protect research).
Option chosen
ABCNo resolution
Votes
CEO
CFO
CIO
CISO
 
 
Square: for. Circle: against. Majority 3 of 4. A tie fails.
Triangle, written as set
TIME MONEY QUALITY 12 IN TOTAL, 4 EACH TO START
Roll, only on doubt
Target __+
Roll __
Backers +1
Specialty+___
At target: intended result. Within 3 below: partial, tell the complication. 4 or more below: failure, the complication moves the board.
What it led to, and the risk board after
Malware & Management · Operation Silk Harvest · Decision CardCounts against the three Executive Decisions
2
Whose time, and what exposure do we carry?
Executive Decision · after inject 4 · timer 3 minutes
Held byCFO
CFO line, read once by the Incident Master (IM) at half time"Every day the integration team stays off integration costs us money and a week of slippage." CTO"We cannot certify the research environment clean for a day on our own."
a

Pull the integration team onto the response. Certification takes hours, not a day.

CostFinancial two steps worse. The integration work slips a week. RollAutomatic, the CIO has clear ownership. ComplicationNone.
b

Emergency budget and overtime; the integration work stays on schedule. Certification takes about a day and a half.

CostFinancial one step worse, in cash. Roll10+. ComplicationReputational one step worse: overtime burns out the team and certification slips.
c

Run it with the internal team only. Certification takes more than a day.

CostReputational one step worse. Roll10+. ComplicationReputational one step worse: a stakeholder calls the CEO before certification.
Triangle tensionMoney against Time against Quality.
Option chosen
ABCNo resolution
Votes
CEO
CFO
CIO
CISO
 
 
Square: for. Circle: against. Majority 3 of 4. A tie fails.
Triangle, written as set
TIME MONEY QUALITY 12 IN TOTAL, 4 EACH TO START
Roll, only on doubt
Target __+
Roll __
Backers +1
Specialty+___
At target: intended result. Within 3 below: partial, tell the complication. 4 or more below: failure, the complication moves the board.
Consultant bought (3 of 4 vote, once, cost to the end of the session)
What it led to, and the risk board after
Malware & Management · Operation Silk Harvest · Decision CardCounts against the three Executive Decisions
cut
3
What do we say, to whom, and when?
Executive Decision · after inject 5 · one timer of 3 minutes
Held byCISO
General Counsel"If we say nothing, the CSIRT will assume we are withholding. If we say too much, I cannot take it back." One stance, one vote, one roll. Lands cleanly only with a named CSIRT owner.
a

Open. CSIRT: full findings with stated confidence. Stakeholders: told now, calibrated. Supplier: formal demand.

CostFinancial one step worse. Roll10+. ComplicationReputational one step worse: a later scope revision hurts credibility.
b

Measured. CSIRT: a validated subset. Stakeholders: told once scope is firmer. Supplier: ask for a call.

CostReputational one step worse. RollAutomatic if a CSIRT owner is named and counsel confirmed what may be shared, else 10+. ComplicationSecurity one step worse: the subset omits something the CSIRT needs.
c

Hold. CSIRT: nothing yet, and it escalates its request. Stakeholders: told nothing. The wait outcome.

CostReputational two steps worse. Roll15+, counsel already said so. ComplicationReputational one step worse: the CSIRT escalates its request.
Triangle tensionQuality (a defensible account) against Time. A hybrid is recorded as a dissent, not a fourth option.
Option chosen
ABCNo resolution
Votes
CEO
CFO
CIO
CISO
 
 
Square: for. Circle: against. Majority 3 of 4. A tie fails.
Triangle, written as set
TIME MONEY QUALITY 12 IN TOTAL, 4 EACH TO START
Roll, only on doubt
Target __+
Roll __
Backers +1
Specialty+___
At target: intended result. Within 3 below: partial, tell the complication. 4 or more below: failure, the complication moves the board.
What it led to, and the risk board after
Malware & Management · Operation Silk Harvest · Decision CardCounts against the three Executive Decisions
LC
Leadership Calls
Three leadership calls on one card · none counts against the three
Held byCEO
1

The first call

Name the executive incident lead and the owner of the old system. No roll. Timer 1 minute. Without a name: the attacker reaches more research systems, Security one step worse, before Decision 1.

2

Restart before certification?

Asked once while certification is pending. The table votes yes or no, 3 of 4. No CEO default. Yes accepts the technical team's stated risk. Roll 15+, it goes against the CTO's stated fact. Intended result: Financial one step better, not below Steady. Complication: a second way out is found late, Security one step worse.

3

Who is accountable for fixing what this showed, and by when?

The CEO writes the remediation owner at the end. It is not a condition of containment.

Votes, restart call
CEO
CFO
CIO
CISO
 
 
Square: for. Circle: against. Majority 3 of 4. A tie fails.
Restart call
ReopenWait
Roll, if any, and what it led to
Malware & Management · Operation Silk Harvest · Decision CardDoes not count against the three
cut