Exercise 1: Why Capture Comes Before Mitigate, and Why It Must Stay Fast — Possible Solution ==================================================================== WHY CAPTURE HAS TO COME FIRST ------------------------------ Per this chapter, "mitigating before capturing risks losing the exact evidence that explains what happened." If the forwarding rule (or whatever the finding is) is disabled or deleted before its exact configuration is documented, the specific details - the destination address, when it was created, how it was configured - may be gone for good. Fixing first optimizes for stopping the harm quickly, at the cost of possibly never fully understanding what happened or how far it went. WHY WAITING INDEFINITELY TO CAPTURE ISN'T THE ANSWER EITHER ------------------------------ Per this chapter, "delaying mitigation for hours 'to be thorough' risks letting real harm continue for no good reason." A forwarding rule actively leaks mail for as long as it exists - treating documentation as an open-ended investigation, rather than a quick, bounded step, would mean tolerating ongoing, real damage in the name of thoroughness that doesn't actually require that much time. WHY MINUTES IS THE RIGHT SCALE FOR THIS STEP SPECIFICALLY ------------------------------ A screenshot and a few notes about what was found and when takes minutes, not hours - the information needed already exists in front of the technician; it just needs to be recorded before it's changed. Turning this into an extended investigation both delays stopping the active harm and isn't actually necessary to preserve the core evidence, which is already visible and capturable quickly. WHY THIS RESOLVES THE TENSION RATHER THAN PICKING A SIDE ------------------------------ This chapter doesn't argue capture matters more than mitigation, or the reverse - it argues for a specific, short-duration ordering: fast capture, immediately followed by mitigation. That sequencing gets both outcomes (real evidence preserved, and harm stopped quickly) rather than sacrificing one for the other. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains what's lost by mitigating first, explains what's lost by delaying mitigation too long, and explains why keeping the capture step itself fast is what allows both concerns to be satisfied rather than trading one off against the other.