Report the Impact

Part of the Stopping the Spread section of Coddy's Cybersecurity journey. Lesson 18 of 20.

Recovery answers whether the company can work safely now. The impact report answers what happened before that recovery.

A confirmed transfer remains part of the incident even after every route is blocked. In the practice logs:

seclab logs

Look for these lines:

2026-11-01 08:58:00 practice-laptop DATA_TRANSFERRED demo-upload: training-records.csv

The record confirms training-records.csv. It does not justify claiming that every file on the computer was stolen.

Report the confirmed filename separately from a later blocked attempt. State what the evidence shows, and leave unsupported claims out of the report. This helps the team make decisions based on the actual incident.

Challenge

Easy

Ticket from Sam, IT lead

Sam has received two older stock-relay audit records. Report the confirmed transferred filename as transferred and the filename from the blocked attempt as blocked. Keep both recovered computers clean, their outside routes blocked, and checkout and the returns backup working.

Try it yourself

Terminal

All lessons in Stopping the Spread

1Trace the Connection

Follow a Connection Test a Route Follow the Whole Order Inside the Company Orders Without Payment

4Recover and Verify

Prove the Block Recover in StagesReport the ImpactReview the Boundary Lumen Stays Open

2Close the Unwanted Route

Destination Rules Rule Order Outbound Rules Allow the Needed Work Two Unwanted Routes

3Contain More Than One Computer

Isolate a Computer The Exposed Password Follow the Spread Keep Customers Working Two Active Computers