Chapter 12
When incidents happen: a response playbook
12.1 Learning objectives
- Have the first steps ready for common incidents.
- Avoid "causing more damage" while panicking.
12.2 The first principle
If you are panicking, losing things or afraid: do not add security, do not reset, do not delete. Reread the handbook from the beginning, starting from ROOT.
12.3 Response table
| Incident | Do immediately |
|---|---|
| Lost phone | Remote lock/erase; sign in with the second hardware key; revoke sessions; remove the device from the mesh VPN |
| Lost laptop | Remote lock/erase; pause automated jobs that read the laptop; revoke SSH keys on that machine; canonical data is still on the NAS |
| One NAS drive failed | Do not pull the healthy drive by mistake; immediately back up anything without a copy; replace with a drive of the same capacity |
| NAS volume locked | Do not reinitialize the drives; unlock with the recovery key file or the key vault password |
| Ransomware | Disconnect devices and the NAS from the network; unplug the air-gapped drive; restore from immutable snapshots or offline copies |
| Lost email account | Follow the recovery map; pause any AI reading that mailbox |
| Lost registrar / domain | Use identity documents with the registrar; recreate email on the domain |
| Safe USB wiped itself or lost | Secrets are still in the password manager/on paper; rebuild the USB; if lost (not self-wiped), consider rotating keys |
| AI running amok | Pause the AI; unmount mounted network drives; open the ledger; compare recently changed files against snapshots |
12.4 Exercises
- Print the response table and add 2 incidents specific to you.
- Pick one row and drill it for 30 minutes.
12.5 Summary
- The first step of any incident is to stop and not make it worse.
- The response table is written while calm and used while panicking.