No Hacking Back

Suppose an attack comes from an outside server. It might be tempting to break into that server and shut it down. This is called hacking back. The server may actually belong to another victim whose system the attacker took over.

Lumen's permission to defend its own systems does not give you permission to break into someone else's. If a coworker requests that action, deny it:

seclab request retaliate deny

You should see:

Denied request retaliate.

You can still protect Lumen, save the logs and report what happened. If the owner has approved a separate request to save the evidence, approve that work:

seclab request keep-evidence approve

You should see:

Approved request keep-evidence.

Judge each request by the permission it has. Refusing to attack the outside server does not mean refusing the legitimate work needed to investigate.