Lion Cipher Lab
Run a blameless root-cause analysis after a security incident
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The same class of incident keeps happening at most organisations because the response stops at the symptom: 'a developer leaked a key', 'the analyst clicked a phish', and everyone moves on feeling something was done. Nothing was. A real root-cause analysis (RCA) is the difference between fixing this one instance and fixing the whole class of problem so it can't recur. It is also where careers are made or lost: run it with blame and people hide the very facts you need; run it blamelessly and you get the truth. This lab teaches the thinking directly on a worked incident, so you can walk into a…
What you'll learn
- distinguishing a symptom (proximate cause) from the real root cause
- running a blameless post-incident analysis and knowing why blame destroys your data
- performing the 5 Whys hands-on — and recognising its single-chain failure mode
- building a fishbone / Ishikawa diagram to capture contributing causes the 5 Whys misses
- writing corrective actions that are specific, assigned, and verifiable
- writing a full RCA report (problem statement, timeline, root cause, contributing factors, corrective actions, lessons)
- judgment: when a full RCA is worth it versus a lightweight review
Steps in this lab
- What a root-cause analysis actually is (and what it isn't)
- Where this fits: the post-incident activity phase
- The blameless principle — and why blame destroys the data you need
- Three words you must keep straight: proximate cause, contributing factor, root cause
- Your worked incident — read the whole timeline before you analyse it
- Technique 1 — run the 5 Whys, out loud, on paper
- The 5 Whys failure mode — why it is dangerous alone
- Technique 2 — build a fishbone (Ishikawa) diagram to catch what the chain missed
- WHEN a full RCA is worth it — and which technique fits which incident
- Turn findings into corrective actions — specific, assigned, verifiable
- Write it up — the six-section RCA report
- What you actually learned