coulomb/disaster-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Start DISCTL-WP-0002: policies, registers, runbooks, playbooks

Browse source 
Expand AssetRegister and DataRegister with T0/T4 stack assets.
Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five
incident playbooks. Update README with mirror status. Mark T02-T05,
T07-T08 done; T01 and T06 in progress.
This commit is contained in:
tegwick 2026-07-07 20:04:54 +02:00
parent 4288ad21a9
commit d011073e16
13 changed files with 814 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

27
IncidentPlaybooks/ransomware.md Normal file
View file

@ -0,0 +1,27 @@
# Playbook: Ransomware / Hostile Access
**Triggers:** suspicious encryption, unknown admin sessions, altered repos, exfiltration indicators.
**Tier:** L2 / I5 — treat as breach until proven otherwise.
## Steps
1. **Isolate** — disconnect affected hosts from network; disable compromised accounts; preserve VM/disk snapshots for evidence.
2. **Preserve evidence** — do not wipe logs; capture auth logs, k8s audit, Gitea/Forgejo access logs, firewall logs.
3. **Revoke credentials** — rotate all tokens/passwords that may be exposed: OpenBao, Stripe, API keys, backup tokens, Gitea/Forgejo admin, SSH certs.
4. **Assess backup integrity** — verify offsite backups (Nextcloud) were not deleted; check `.last-backup` stamps; assume on-node backups on compromised host are untrusted.
5. **Build clean environment** — new machines; fresh OS; Ansible from known-good Git refs. **Never restore into compromised host.**
6. **Restore known-good data** — from backups timestamped **before** compromise; age-decrypt from offsite only.
7. **Rotate all secrets** — full rotation, not selective; update OpenBao paths; re-issue `warden` certs.
8. **Force resets** — user sessions, MFA re-enrollment where applicable.
9. **Validate** — smoke tests; compare restored repos against known-good SHAs.
10. **Document** — State Hub progress event; `TestEvidence/` incident note; update `AssetRegister.yaml` if exposure changed posture.
## Do not
- Pay ransom without executive decision recorded.
- Restore production DB over live data without identifying last good point.
- Paste secrets into incident notes.
## References
`BackupPolicy.md` §8 · `RestoreRunbooks/01-full-server-loss.md` · `PanicSheet.md` §4