diff --git a/frontend/public/Spike-Thumbs-Up.png b/frontend/public/Spike-Thumbs-Up.png new file mode 100644 index 0000000..bb65080 Binary files /dev/null and b/frontend/public/Spike-Thumbs-Up.png differ diff --git a/frontend/src/components/ui/CalloutBox.tsx b/frontend/src/components/ui/CalloutBox.tsx index cc9c741..607fb9c 100644 --- a/frontend/src/components/ui/CalloutBox.tsx +++ b/frontend/src/components/ui/CalloutBox.tsx @@ -16,7 +16,7 @@ const STYLES: Record +
{title && (

{title} diff --git a/frontend/src/components/ui/PerformanceReportView.tsx b/frontend/src/components/ui/PerformanceReportView.tsx index da5554e..3b1979d 100644 --- a/frontend/src/components/ui/PerformanceReportView.tsx +++ b/frontend/src/components/ui/PerformanceReportView.tsx @@ -2,13 +2,13 @@ import { useState } from 'react'; import { Download } from 'lucide-react'; import type { SessionReport } from '../../schemas/api.schema'; import SectionPanel from './SectionPanel'; -import InfoField from './InfoField'; import { toScoreStatus, toQuestionType, barColor, scoreColor } from '../../pages/learner/performance/utils'; import { TACTIC_LABELS, BCSM_STAGE_META, BCSM_SHORT_LABELS } from '../../pages/learner/performance/constants'; import type { ScoreEntry, InvQuestion, BcsmStage, BcsmBreakdownEntry, ChipStatus } from '../../pages/learner/performance/types'; import InvestigationSection from '../../pages/learner/performance/InvestigationSection'; import NegotiationSection from '../../pages/learner/performance/NegotiationSection'; import BcsmSection from '../../pages/learner/performance/BcsmSection'; +import PartBSection from '../../pages/learner/performance/PartBSection'; export interface ReportHeaderField { label: string; @@ -24,7 +24,7 @@ interface Props { } export default function PerformanceReportView({ report, isLoading, headerTitle, headerFields, onBack }: Props) { - const [open, setOpen] = useState({ s1: true, s2: true, s3: true }); + const [open, setOpen] = useState({ s1: true, s2: true, s3: true, s4: true }); const toggle = (key: keyof typeof open) => setOpen(prev => ({ ...prev, [key]: !prev[key] })); const isReportReady = !!(report?.scores?.total && report?.verdict && report?.investigation && report?.bcsm); @@ -69,6 +69,7 @@ export default function PerformanceReportView({ report, isLoading, headerTitle, points: q.points, verified: aiVerified[i] ?? false, correctAnswer: q.correct_answer, + selectedAnswer: q.selected_answer ?? '—', })) : []; @@ -80,6 +81,7 @@ export default function PerformanceReportView({ report, isLoading, headerTitle, points: aiFeedback?.ENCRYPTION_PROOF ? 10 : 0, verified: aiFeedback?.ENCRYPTION_PROOF ?? false, correctAnswer: 'Request decryption proof from threat actor', + selectedAnswer: aiFeedback?.ENCRYPTION_PROOF ? 'Requested' : 'Not requested', } : null; const allInvestigation = encryptionProofQ ? [...investigation, encryptionProofQ] : investigation; @@ -138,13 +140,11 @@ export default function PerformanceReportView({ report, isLoading, headerTitle,

Behavioral Change Stairway Model (BCSM) post-session evaluation

-
+
{headerFields.map(field => ( - {field.value}} - /> + + {field.label}: {field.value} + ))}
@@ -153,6 +153,16 @@ export default function PerformanceReportView({ report, isLoading, headerTitle, <> + {!isLoading && isReportReady && ( +
+

How the score is composed

+

+ Performance score = 100%: Investigation tasks 40% + Negotiation outcomes 10% (AI-evaluated) + BCSM five-stage assessment 50% (AI-evaluated). + {report?.verdict?.pass_threshold ? ` A score of ${report.verdict.pass_threshold} or above is a pass.` : ''} +

+
+ )} + {isLoading && (
@@ -177,7 +187,7 @@ export default function PerformanceReportView({ report, isLoading, headerTitle, {!isLoading && isReportReady && ( <> -
+
{scores.map((s) => (
◎
-

{verdict.title}

+

{verdict.title}

{report?.open_ended_evaluation}

@@ -241,6 +251,11 @@ export default function PerformanceReportView({ report, isLoading, headerTitle, isOpen={open.s3} onToggle={() => toggle('s3')} /> + + toggle('s4')} + /> )}
diff --git a/frontend/src/components/ui/SectionPanel.tsx b/frontend/src/components/ui/SectionPanel.tsx index f0ccedd..21eab90 100644 --- a/frontend/src/components/ui/SectionPanel.tsx +++ b/frontend/src/components/ui/SectionPanel.tsx @@ -10,7 +10,7 @@ interface SectionPanelProps { export default function SectionPanel({ title, icon, header, children, className }: SectionPanelProps) { return ( -
+
{header ?? } {children}
diff --git a/frontend/src/index.css b/frontend/src/index.css index 2d6e3d8..64fa508 100644 --- a/frontend/src/index.css +++ b/frontend/src/index.css @@ -6,4 +6,26 @@ html, body { background-size: cover; background-position: center; background-attachment: fixed; +} + +@media print { + html, body { + background: white !important; + background-image: none !important; + } + + * { + -webkit-print-color-adjust: exact !important; + print-color-adjust: exact !important; + } + + /* Prevent table rows from splitting across pages */ + tr { + break-inside: avoid; + } + + /* Keep headings with the content that follows */ + h3 { + break-after: avoid; + } } \ No newline at end of file diff --git a/frontend/src/pages/learner/performance/BcsmSection.tsx b/frontend/src/pages/learner/performance/BcsmSection.tsx index 5768163..ddc65c3 100644 --- a/frontend/src/pages/learner/performance/BcsmSection.tsx +++ b/frontend/src/pages/learner/performance/BcsmSection.tsx @@ -1,8 +1,6 @@ import SectionPanel from '../../../components/ui/SectionPanel'; -import CalloutBox from '../../../components/ui/CalloutBox'; import type { BcsmStage, BcsmBreakdownEntry } from './types'; -import { toScoreStatus, scoreColor, stageNumClass, chipClass, chipPrefix } from './utils'; -import { TACTIC_DESCRIPTIONS } from './constants'; +import { toScoreStatus, scoreColor, stageNumClass } from './utils'; import SectionToggleHeader from './SectionToggleHeader'; interface Props { @@ -14,6 +12,17 @@ interface Props { onToggle: () => void; } +function buildNotes(chips: BcsmStage['chips'], score: number, max: number): { main: string; missed: string } { + const detected = chips.filter(c => c.status === 'detected').map(c => c.label); + const missed = chips.filter(c => c.status === 'missed').map(c => c.label); + const n = detected.length; + const marksText = score >= max ? 'full marks' : score > 0 ? 'partial marks' : 'no marks'; + const main = n > 0 + ? `Detected: ${detected.join(', ')}. ${n} action${n !== 1 ? 's' : ''} — ${marksText}.` + : `No actions detected. 0 actions — ${marksText}.`; + return { main, missed: missed.length > 0 ? `Missed: ${missed.join(', ')}.` : '' }; +} + export default function BcsmSection({ bcsm, bcsmBreakdown, totalScore, maxScore, isOpen, onToggle }: Props) { return ( {isOpen && ( -
-

+

+

5 pts = 1 action detected · 10 pts = 2 or more actions detected

- {bcsm.map((stage) => ( -
-
-
-
- {stage.num} -
-
-

{stage.title}

-

{stage.subtitle}

-
-
- - {stage.score} / {stage.max} - -
-
- {stage.chips.map((chip) => ( - - {chipPrefix(chip.status)} - {chip.label} - - ))} -
- {stage.chips.some((c) => c.status === 'missed') && ( - c.status === 'detected') ? 'partial' : 'fail'} - title='Missed tactics' - className='mt-3' - > -
    - {stage.chips - .filter((c) => c.status === 'missed') - .map((c) => ( -
  • - {c.label} - {TACTIC_DESCRIPTIONS[c.key] ? ` — ${TACTIC_DESCRIPTIONS[c.key]}` : ''} -
    • - ))} -
- - )} -
- ))} -
- {bcsmBreakdown.map((b) => ( + + + + + + + + + + {bcsm.map(stage => { + const notes = buildNotes(stage.chips, stage.score, stage.max); + return ( + + + + + + ); + })} + +
StageScoreDetected actions & notes
+
+
+ {stage.num} +
+
+

{stage.title}

+

{stage.subtitle}

+
+
+ 		+ + {stage.score} / {stage.max} + + +

{notes.main}

+ {notes.missed && ( +

{notes.missed}

+ )} +
+ + {/* Score breakdown strip */} +
+ {bcsmBreakdown.map(b => (

{b.label}

{b.score}

))}
-
+ +
◈

BCSM stages evaluated by AI Model 3 · Full conversation transcript analysed diff --git a/frontend/src/pages/learner/performance/InvestigationSection.tsx b/frontend/src/pages/learner/performance/InvestigationSection.tsx index 074adeb..7be1645 100644 --- a/frontend/src/pages/learner/performance/InvestigationSection.tsx +++ b/frontend/src/pages/learner/performance/InvestigationSection.tsx @@ -15,35 +15,11 @@ interface Props { onToggle: () => void; } -function QuestionRow({ q, showVerified = true }: { q: InvQuestion; showVerified?: boolean }) { - const gridCols = showVerified ? 'grid-cols-[1fr_auto_auto_auto]' : 'grid-cols-[1fr_auto_auto]'; - return ( -

-
-

{q.label}

-

{q.detail}

-
- {showVerified && ( - - {q.verified ? '✓ Verified' : '○ Not verified'} - - )} - - {q.type} - - - {resultLabel(q.result, q.points ?? 0)} - -
- ); -} - export default function InvestigationSection({ - mcQuestions, tfQuestions, encryptionProofQ, allInvestigation, + allInvestigation, invAdjustedScore, invAdjustedMax, isOpen, onToggle, }: Props) { const correctCount = allInvestigation.filter(q => q.result === 'pass').length; - const verifiedCount = allInvestigation.filter(q => q.verified).length; const totalCount = allInvestigation.length; const invStatus: ScoreStatus = correctCount === totalCount ? 'pass' : correctCount > 0 ? 'partial' : 'fail'; const wrongQuestions = allInvestigation.filter(q => q.result === 'fail'); @@ -66,51 +42,52 @@ export default function InvestigationSection({ } > {isOpen && ( -
- {mcQuestions.length > 0 && ( - <> -

- Multiple choice — human input (10 pts each) -

- {mcQuestions.map((q, i) => ( -
- -
- ))} - - )} - {tfQuestions.length > 0 && ( - <> -

- True / False — human input (10 pts) -

- {tfQuestions.map((q, i) => ( -
- -
+
+ + + + + + + + + + {allInvestigation.map((q, i) => ( + + + + + ))} - - )} - {encryptionProofQ && ( - <> -

- AI-evaluated — chat conversation -

- - - )} - - {wrongQuestions.length > 0 && ( -
    - {wrongQuestions.map((q, i) => ( -
  • {q.label.split(' — ')[0]} — Correct: {q.correctAnswer ?? '—'}
    • - ))} -
- )} - + +
TaskYour ResponseResult
+

{q.label}

+ {q.type} + 		+

{q.selectedAnswer}

+ {q.result === 'fail' && q.correctAnswer && ( +

correct: {q.correctAnswer}

+ )} + 		+ + {resultLabel(q.result, q.points ?? 0)} + +
+
+ + {`${correctCount} of ${totalCount} ${totalCount === 1 ? 'question' : 'questions'} correct.`} + {wrongQuestions.length > 0 && ( +
    + {wrongQuestions.map((q, i) => ( +
  • {q.label.split(' — ')[0]} — correct: {q.correctAnswer ?? '—'}
    • + ))} +
+ )} + +
)} diff --git a/frontend/src/pages/learner/performance/NegotiationSection.tsx b/frontend/src/pages/learner/performance/NegotiationSection.tsx index 66d88ca..ef7ad7e 100644 --- a/frontend/src/pages/learner/performance/NegotiationSection.tsx +++ b/frontend/src/pages/learner/performance/NegotiationSection.tsx @@ -43,35 +43,44 @@ export default function NegotiationSection({ outcomes, totalScore, maxScore, isO } > {isOpen && ( -
-

- AI-evaluated outcomes (5 pts each) -

- {outcomes.map((o, i) => { - const result: ResultStatus = o.achieved ? 'pass' : 'fail'; - return ( -
-
-

{OUTCOME_LABELS[i] ?? `Outcome ${i + 1}`}

-

- {o.achieved ? 'Achieved ✓' : 'Not achieved ✗'} -

-
- - AI - - - {resultLabel(result, o.points)} - -
- ); - })} - - {combined.detail} - +
+ + + + + + + + + + {outcomes.map((o, i) => { + const result: ResultStatus = o.achieved ? 'pass' : 'fail'; + return ( + + + + + + ); + })} + +
OutcomeStatusPoints
+

{OUTCOME_LABELS[i] ?? `Outcome ${i + 1}`}

+ AI + 		+

+ {o.achieved ? 'Achieved' : 'Not achieved'} +

+ 		+ + {resultLabel(result, o.points)} + +
+
+ + {combined.detail} + +
)} diff --git a/frontend/src/pages/learner/performance/PartBSection.tsx b/frontend/src/pages/learner/performance/PartBSection.tsx new file mode 100644 index 0000000..d38292e --- /dev/null +++ b/frontend/src/pages/learner/performance/PartBSection.tsx @@ -0,0 +1,672 @@ +import { ChevronRight } from 'lucide-react'; +import SectionPanel from '../../../components/ui/SectionPanel'; + +interface Props { + isOpen: boolean; + onToggle: () => void; +} + +export default function PartBSection({ isOpen, onToggle }: Props) { + return ( + +
+
+ Part B — Ransom Negotiation Strategy + + Educational + +
+ + + } + > + {isOpen && ( +
+ + {/* B1 */} +
+

+ B1. The Bias in Ransomware Decision-Making — “Pay or Not to Pay” +

+ +

+ The ransomware decision is often collapsed into a single binary: to pay, or not to pay? That framing is a + trap. It hides the decisions that actually determine the outcome — how much was invested in prevention, + which controls exist, what assurance there is that they work, and what response options are realistically + available in the moment. +

+ +

+ The Australian Government, the ACSC and the Department of Home Affairs maintain a firm policy stance that + organisations should not pay a ransom, and this training does not condone paying. A strict ‘do not + pay’ position is commendable, but it carries a corollary: the board must then fully fund readiness + and incident response so credible alternatives exist. Failing to do so can itself expose directors to + duty-of-care concerns. +

+ +

+ The decision is unique to every organisation. Negotiation may be viable where projected costs and impacts + are unacceptable; payment is only ever weighed where the impacts of not paying would be un-survivable. + Both choices carry significant risk. The single most important lesson: the time to prepare for a crisis is + not during a crisis. +

+ +

+ Before moving to ransom negotiation — assess risk appetite, tolerance and impact +

+ +

+ Negotiation is not the first move. Before any engagement with a threat actor, you must understand what + your organisation can absorb and at what point impacts cross from “manageable” into + “unacceptable” or “un-survivable”. + These thresholds should drive the decision. +

+ +

Step 1 — Know your company’s risk appetite and risk tolerance.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Risk appetiteRisk tolerance
DefinitionThe level and type of risk leadership is willing to pursue or accept in pursuit of objectives.The acceptable variation around that appetite before action is triggered.
Set byA strategic statement by Board and executive.Operational thresholds and limits by Management.
Question it answers“How much risk are we willing to take?”“How far can we drift before we must act?”
Find it inRisk appetite statement; enterprise risk management framework.Risk consequence matrix: the low / moderate / high / critical bands.
+ +

Step 2 — Map the situation onto your risk bands.

+ +

+ Plot the projected impact against the consequence bands. The band it lands in tells you whether to respond, + negotiate, or escalate toward considering payment. +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
BandWhat it means hereIndicated action
+ Low + + Manageable: Impact absorbed within normal operations. + Respond & recover. No negotiation needed.
+ Moderate + + Manageable: Noticeable disruption but within tolerance. + Respond & recover; monitor closely.
+ High + + Unacceptable: beyond tolerance. + Consider negotiating for time, information, control.
+ Critical + + Un-survivable: threatens the organisation. + Negotiation +, with expert & legal advice, payment may be weighed.
+ +

Step 3 — Assess the impact across three dimensions.

+
    +
  • Service interruption — which critical functions are down, for how long, and how many users or customers are affected.
    • +
  • Financial loss — lost revenue, recovery and investigation cost, regulatory penalty, contractual exposure.
    • +
  • Non-financial — safety, reputation, legal and privacy obligations, stakeholder trust.
    • +
+ +
+

+ Decision framing — matching impact to action +

+
    +
  • “We can manage these impacts” → respond and recover; no engagement needed.
    • +
  • “We can’t accept these impacts” → consider negotiating for time, information and control.
    • +
  • “We won’t survive these impacts” → only here is payment (a better price, speed, relief) even discussed, and only with expert and legal advice.
    • +
+
+ +

Step 4 — Run the quick self-assessment.

+ +

+ Answer each question, note which band the answer points to, then act on the highest band reached. +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
#QuestionIf the answer is concerning…
1Which critical functions are affected, and how long can we survive that disruption?Survival in days/weeks → High to Critical
2What is the realistic financial exposure (direct loss, recovery, penalty, contractual)?Exceeds tolerance limits → High
3Do we have reliable, tested backups, and how fast can we recover unaided?No reliable recovery path → High to Critical
4What level of risk requires Board review or triggers our crisis-management plans?Threshold met → escalate to Board
5Is the projected impact within appetite, beyond tolerance, or threatening survival?Beyond tolerance → negotiate; survival → payment may be weighed
+
+ + {/* B2 */} +
+

B2. The Strategic Paradigm: Time, Information, and Control

+ +

+ Reframe the decision as a set of strategic options: whether to negotiate, and what for. You do not + negotiate only for a cheaper ransom. Negotiating buys three things that save money in response, + investigation and recovery without ever paying: +

+ +
    +
  • Time — the threat actor’s deadlines can be pushed out, giving incident responders capacity to restore from backups and contain the spread.
    • +
  • Information — conversations reveal how the breach occurred, what data was taken, and the actor’s tactics, techniques and procedures, accelerating the investigation.
    • +
  • Control — understanding the group, whether they will honour terms, and when further contact is futile keeps the organisation in the driver’s seat.
    • +
+ +

Why each one matters? Here are the benefits:

+ + + + + + + + + + + + + + + + + + + + + + +
GainBenefits to your organisation
Time +
    +
  • Pushes out the payment deadline so responders can restore from clean backups.
    • +
  • Slows escalation and buys room to engage experts, legal counsel and insurers.
    • +
  • Reduces pressure-driven decisions that favour the attacker.
    • +
+
Information +
    +
  • Reveals how the breach occurred and what data was actually taken — speeding the investigation.
    • +
  • Exposes the actor’s tactics, techniques and procedures, and the likelihood they will honour terms.
    • +
  • Informs breach-notification scope and legal obligations with facts, not assumptions.
    • +
+
Control +
    +
  • Keeps the organisation setting the pace rather than reacting to the attacker.
    • +
  • Allows the negotiator to know when communication is futile and when to stop.
    • +
  • Preserves optionality: recovery, negotiation or escalation stay on the table longer.
    • +
+
+ +

+ Ransomware is engineered to restrict your choices. The new approach is to recognise you usually have more + options than the attacker wants you to believe. The negotiation outcomes you are scored on — ransom + reduction and deadline extension — are direct, measurable proxies for buying time and control. +

+
+ + {/* B3 */} +
+

B3. The Negotiation Strategy — Behavioral Change Stairway Model (5 Stages)

+ +

+ The BCSM was developed by the FBI’s hostage negotiation unit. It describes five sequential steps for + getting another person to see your point of view and change their behaviour. Behavioural change is most + likely only when the previous four stages have been genuinely completed — you cannot skip a step. This + model is the backbone of the 50-point BCSM portion of your score. +

+ +
    +
  1. Stage 1 : Active Listening — Listen to their side and make them aware you are listening. Don’t interrupt, disagree or evaluate. Use brief acknowledgements and ask questions that show you have been paying attention.
    2. +
  2. Stage 2 : Empathy — Build an understanding of where they are coming from — their situation, feelings and motives — and establish a relationship through communication.
    3. +
  3. Stage 3 : Rapport — Empathy is what you feel; rapport is when they feel it back and begin to trust you. Agree where possible without conceding, reduce real or perceived differences, find common ground.
    4. +
  4. Stage 4 : Influence — Once trust exists, you have earned the right to problem-solve with them and recommend a course of action, drawing on a defined set of influence strategies.
    5. +
  5. Stage 5 : Behavioral Change — They act. The threat actor follows your suggestions reducing the ransom or extending the deadline, which only reliably happens if the prior four stages were carried out effectively.
    6. +
+
+ + {/* B4 */} +
+

B4. How to Apply the Model in a Ransom Negotiation

+ +

+ Move up the staircase deliberately. Each stage builds the foundation for the next, and the AI evaluator + scores you on evidence of distinct actions within each stage. +

+ +
+

Stage 1 — Active Listening

+
    +
  • Open with open-ended questions about how the situation arose and what the group wants.
    • +
  • Use minimal encouragers and mirror their key terms (echo a phrase like “irreversible encryption”) so they feel heard.
    • +
  • Add paraphrasing — restating their demand in your own words — to demonstrate active comprehension.
    • +
+
+ +
+

Stage 2 — Empathy

+
    +
  • Name their apparent feelings without judging them (e.g., “You seem frustrated the last deadline wasn’t taken seriously”).
    • +
  • Acknowledge their motive and explicitly reference their operational situation (time pressure, needing a guaranteed outcome).
    • +
+
+ +
+

Stage 3 — Rapport

+
    +
  • Agree where you can without conceding anything of value.
    • +
  • Actively reduce perceived differences and state shared interests — a quick, quiet resolution with no data publication benefits both sides. This is the most direct way to lift Rapport from 5 to 10.
    • +
+
+ +
+

Stage 4 — Influence

+
    +
  • Deliberately use several distinct categories, not two that overlap. Combine rational persuasion with being credible (signal expertise), legitimising (reference legal/regulatory obligations) and exchanging (a structured, conditional offer).
    • +
  • This is your largest improvement opportunity: distinct categories, not volume, drive the score.
    • +
+
+ +
+

Stage 5 — Behavioral Change

+
    +
  • Translate trust into concrete asks: a lower ransom, a longer deadline, proof of decryption. Concessions are the observable evidence of behavioural change.
    • +
  • Full Stage 5 credit assumes the earlier stages were genuinely effective — invest in Stages 3 and 4 to consolidate it.
    • +
+
+ +

+ Throughout: treat the exchange as a calm business deal, remain unemotional and respectful, and never move + faster than the staircase allows. +

+
+ + {/* B5 */} +
+

B5. What to Avoid in a Ransom Negotiation

+ +
    +
  • Engaging too early — Negotiating before systems are secured — do not engage until cyber advisors confirm the environment is contained.
    • +
  • Moving too rapidly — Skipping stages or jumping to a deal before rapport and influence are built. Premature problem-solving collapses the negotiation and is explicitly checked by the evaluator.
    • +
  • Intimidation — Threats are a threat-actor tactic. As a negotiator it destroys trust, is flagged as an avoidance violation, and undermines every prior stage.
    • +
  • Losing composure — Emotional, reactive messages. Treat it as a business transaction; assume every word may be read aloud later.
    • +
  • Unilateral concessions — Conceding value to feel progress. Agree where possible without giving ground; concessions should be earned and conditional.
    • +
  • Going it alone — Negotiating on your own behalf. In reality this must be done by a skilled negotiation specialist, not executives, lawyers or cyber staff alone.
    • +
+
+ + {/* B6 */} +
+

B6. Warnings on Ransom Negotiation

+ +

+ These warnings apply to any real ransomware event. The simulation rewards negotiating for time, + information and control; these points explain why paying is treated as a last resort decided only with + expert and legal advice. +

+ +
+
+

+ Paying a ransom could be illegal +

+

+ International or domestic sanctions, the laws of your jurisdiction, the nature of the situation and the + specific payment circumstances can all make paying unlawful. The recipient may be a sanctioned person + or entity, or the funds may be proceeds of crime. Specific legal advice is essential before any payment + is contemplated. +

+
+ +
+

+ Assume everything becomes public +

+

+ Assume any communication with a criminal group will become public and may be produced as evidence in + litigation, or in a regulatory or compliance proceeding. The Australian government has signalled it + intends to require businesses to disclose when they have suffered or paid a ransom. Write every message + as if a court, a regulator and the media will read it. +

+
+ +
+

+ Don’t do it yourself +

+

+ Ransom negotiations must be undertaken by skilled negotiation experts, not talented executives, lawyers + or cyber specialists acting alone. Engage a ransomware negotiation specialist and connect them with + legal and finance teams. Be wary of fake “recovery” specialists who quietly pay the ransom + and bill it as a fee. +

+
+ +
+

+ Do not trust the criminals — no guarantees +

+

+ You are dealing on good faith with criminals and have no means to enforce terms. Paying does not + guarantee restoration or deletion of data, may invite repeat extortion, and authorities cannot relieve + the situation or recover funds. There is no enforceable contract behind any promise they make. +

+
+
+
+ + {/* B7 */} +
+

B7. After the Negotiation — The Incident Response Lifecycle

+ +

+ A ransom negotiation is one moment inside a much larger incident response effort. Whatever the outcome of + the conversation, the incident is not over. The widely used NIST SP 800-61 Rev. 2 Computer Security + Incident Handling Guide describes a four-phase lifecycle that should wrap around every ransomware event. + Use it to frame what happens before and after the chat. +

+ + + + + + + + + + + + + + + + + + + + + + + + + + +
PhaseWhat it involves in a ransomware context
1 · Preparation + Build the capability before a crisis: a tested incident response plan and playbooks, defined roles + and a crisis-management team, reliable and verified backups, a rehearsed ransomware decision + strategy, and pre-established relationships with negotiation, legal and forensic experts. The + negotiation skills practised here are part of this phase. +
2 · Detection & Analysis + Identify and scope the incident: confirm the compromise, determine how the breach happened, which + systems are affected, and what data is at risk — the same questions as the investigation tasks. + Establish the impact against risk appetite and tolerance to decide whether negotiation is even + warranted. +
3 · Containment, Eradication & Recovery + Secure the environment before engaging the threat actor: contain lateral spread, eradicate the + attacker’s access and persistence, and recover systems and data from clean backups. + Negotiation for time and information directly supports this phase by giving responders capacity + to act. +
4 · Post-Incident Activity + Capture the lessons: conduct a post-incident review, update plans, playbooks and controls, complete + regulatory and breach-notification obligations, and feed improvements back into Preparation so the + next event is handled better. +
+ +
+

+ The lifecycle is a loop +

+ {/* 2×2 loop grid */} +
+
+ 1 + Preparation +
+
→
+
+ 2 + Detection & Analysis +
+ +
↑
+
+ ↺ +
+
↓
+ +
+ 4 + Post-Incident Activity +
+
←
+
+ 3 + Containment, Eradication & Recovery +
+
+

+ Each event should leave the organisation better prepared for the next. The negotiation you just + practised sits inside Preparation and supports Containment & Recovery — it is never the whole + response. +

+
+
+ + {/* B8 */} +
+

B8. Key Takeaway

+ +

+ When systems are compromised and sensitive data is encrypted, exfiltrated or deleted, the questions of + when to negotiate and whether to pay are decisive and carry significant risk. Negotiating or paying offers + no guarantee of resolving the incident, may invite further exploitation, may conflict with your + principles, and could expose you to prosecution. +

+ +

+ Conversely, an organisation may lack time to restore data or services before harm reaches customers and + the public, so in narrow cases payment may mitigate greater harm — but only after every alternative has + been ruled out and privileged legal advice obtained. +

+ +

+ Carry these forward into your next attempt +

+ +
    +
  1. Assess before you engage. Know your risk appetite and tolerance, map the impact onto your consequence bands, and only negotiate when impacts are beyond tolerance.
    2. +
  2. Reject the binary. Frame every scenario as “whether to negotiate, and what for”, targeting time, information and control before money is discussed.
    3. +
  3. Climb the staircase in order. Active Listening → Empathy → Rapport → Influence → Behavioral Change. Skipping a step forfeits the score and the outcome.
    4. +
  4. Stay disciplined. No intimidation, no rushing, no emotional or unilateral concessions; treat it as a calm business deal that may one day be evidence.
    5. +
  5. Never act alone. Engage negotiation, legal and finance experts; assume any payment may be illegal and any message public.
    6. +
  6. Remember the lifecycle. The negotiation is one step inside NIST SP 800-61r2: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity. The incident is not over when the chat ends — capture lessons and feed them back into Preparation.
    7. +
+ +
+

+ In one line +

+ {/* Equal-height flex: boxes stretch to tallest, arrows stay centered */} +
+ {[ + { num: 1, label: 'Assess impact against appetite & tolerance' }, + { num: 2, label: 'Negotiate for time, information & control' }, + { num: 3, label: 'Climb the BCSM staircase in order' }, + { num: 4, label: 'Treat the chat as one phase of the lifecycle, never the whole response' }, + ].map((step, i, arr) => ( +
+
+ {step.num} + {step.label} +
+ {i < arr.length - 1 && ( +
+ → +
+ )} +
+ ))} +
+
+
+ + {/* Flame Tree Cyber */} +
+
+
+ Flame Tree Cyber +

Australian-owned cyber security consultancy · Brisbane

+
+ +
+

+ This training is provided by Flame Tree Cyber, an Australian-owned cyber security consultancy. + Flame Tree Cyber was established by Kat McCrabb in 2023 and is headquartered in Brisbane, working + with government agencies, education institutions, not-for-profits and growing businesses. +

+

+ Flame Tree’s mission is inspired by two Australian icons: the resilient flame tree and the + echidna. Like the flame tree, the firm is built to thrive in harsh conditions and shield + organisations from threats; Spike, the echidna, symbolises a proactive, strong defence. The + approach is pragmatic and risk-based — reducing risk through governance, delivery support and + incident readiness without creating busywork, with strategies shaped around each organisation’s + risk profile, obligations and capability constraints. +

+ +
+

How Flame Tree Cyber can help

+
    + {[ + { title: 'Audit & assessment', desc: 'Validate alignment with recognised standards and demonstrate that controls actually work.' }, + { title: 'Governance & risk', desc: 'Connect risk appetite, reporting and delivery so boards and executives get clearer oversight and better decisions.' }, + { title: 'Incident resilience', desc: 'Tailored incident response plans, playbooks, tabletop exercises and simulations so you are resilient whatever the incident.' }, + { title: 'Cybersecurity uplift', desc: 'Increase cyber security maturity with hands-on implementation support across frameworks such as NIST and the Essential Eight.' }, + { title: 'Privacy & data protection', desc: 'Privacy impact and risk assessments aligned to the Privacy Act and Australian Privacy Principles.' }, + { title: 'Responsible AI', desc: 'Advisory services to help you deliver secure and safe AI.' }, + ].map(item => ( +
  • + ▸ + {item.title} — {item.desc} +
    • + ))} +
+
+ +
+

+ Learn more at{' '} + + flametreecyber.com.au + + {' '}or reach out via{' '} + + info@flametreecyber.com.au + +

+
+ +
+

+ Get Prepared, Be Protected, Stay Resilient. +

+ Spike +

Good luck out there — Spike

+
+
+
+
+ +
+ )} + + ); +} diff --git a/frontend/src/pages/learner/performance/types.ts b/frontend/src/pages/learner/performance/types.ts index 1f973a5..9acd21e 100644 --- a/frontend/src/pages/learner/performance/types.ts +++ b/frontend/src/pages/learner/performance/types.ts @@ -19,6 +19,7 @@ export interface InvQuestion { points: number | null; verified: boolean; correctAnswer: string | null; + selectedAnswer: string; } export interface ActionChip {