サイバーセキュリティお助け隊サービスと「72時間」初動訓練ガイド 「電源を切らずにLANを抜く」現場の初動3原則と、朝礼15分でできる実践訓練シナリオ

#![forbid(unsafe_code)]

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum IncidentPhase {
    Detected {
        detected_at_epoch_sec: u64,
    },
    NetworkIsolated {
        detected_at_epoch_sec: u64,
        isolated_at_epoch_sec: u64,
        power_kept_on: bool,
    },
    VolatileEvidenceCaptured {
        detected_at_epoch_sec: u64,
        ram_and_socket_blake3: [u8; 32],
        zfs_hold_tag: String,
    },
    ReadyForCleanRecovery {
        detected_at_epoch_sec: u64,
        ppc_72h_report_submitted: bool,
        root_cause_patched: bool,
    },
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum TransitionError {
    PowerOffViolatesRfc3227Volatility,
    MustCaptureVolatileRamBeforeRecovery,
    Ppc72HourDeadlineExceeded { elapsed_hours: u64 },
    RootCauseNotPatchedReinfectionRisk,
}

/// Step 1 -> Step 2: 電源を維持したままネットワークのみを隔離したか検証
pub fn transition_to_isolated(
    phase: IncidentPhase,
    now_epoch_sec: u64,
    power_kept_on: bool,
) -> Result<IncidentPhase, TransitionError> {
    if !power_kept_on {
        return Err(TransitionError::PowerOffViolatesRfc3227Volatility);
    }
    match phase {
        IncidentPhase::Detected { detected_at_epoch_sec } => Ok(IncidentPhase::NetworkIsolated {
            detected_at_epoch_sec,
            isolated_at_epoch_sec: now_epoch_sec,
            power_kept_on,
        }),
        other => Ok(other),
    }
}

/// Step 3 -> Step 4: 侵入口の修正と72時間以内の法定速報を確認してからクリーン復元を許可
pub fn authorize_clean_recovery(
    phase: IncidentPhase,
    now_epoch_sec: u64,
    ppc_72h_report_submitted: bool,
    root_cause_patched: bool,
) -> Result<IncidentPhase, TransitionError> {
    let IncidentPhase::VolatileEvidenceCaptured {
        detected_at_epoch_sec, ..
    } = phase
    else {
        return Err(TransitionError::MustCaptureVolatileRamBeforeRecovery);
    };

    let elapsed_hours = now_epoch_sec.saturating_sub(detected_at_epoch_sec) / 3600;
    if elapsed_hours > 72 && !ppc_72h_report_submitted {
        return Err(TransitionError::Ppc72HourDeadlineExceeded { elapsed_hours });
    }
    if !root_cause_patched {
        return Err(TransitionError::RootCauseNotPatchedReinfectionRisk);
    }

    Ok(IncidentPhase::ReadyForCleanRecovery {
        detected_at_epoch_sec,
        ppc_72h_report_submitted,
        root_cause_patched,
    })
}

CREATE TABLE IF NOT EXISTS incident_drill_and_response_log (
    event_id            UUID PRIMARY KEY DEFAULT uuidv7(),
    tenant_id           UUID NOT NULL,
    event_mode          TEXT NOT NULL CHECK (event_mode IN ('DRILL_15MIN', 'LIVE_INCIDENT')),
    rfc3227_phase       TEXT NOT NULL,
    volatile_hash_hex   TEXT NOT NULL,
    ppc_72h_deadline_at TIMESTAMPTZ NOT NULL,
    action_payload      JSONB NOT NULL,
    recorded_at         TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
    UNIQUE (tenant_id, volatile_hash_hex)
);

ALTER TABLE incident_drill_and_response_log ENABLE ROW LEVEL SECURITY;
ALTER TABLE incident_drill_and_response_log FORCE ROW LEVEL SECURITY;

CREATE POLICY incident_log_tenant_isolation ON incident_drill_and_response_log
    USING (tenant_id = (SELECT sovereign_auth.current_tenant_id()));

-- PostgreSQL 19 INSERT ... ON CONFLICT DO SELECT で重複イベント送信時もゼロWALで既存記録を返却
INSERT INTO incident_drill_and_response_log (
    tenant_id, event_mode, rfc3227_phase, volatile_hash_hex, ppc_72h_deadline_at, action_payload
) VALUES (
    (SELECT sovereign_auth.current_tenant_id()),
    'DRILL_15MIN',
    'VOLATILE_EVIDENCE_CAPTURED',
    'b94f6f125c79e3a81e1a02c5f9b4d8e2c7a1f0b3d4e5f6a7b8c9d0e1f2a3b4c5',
    clock_timestamp() + INTERVAL '72 hours',
    '{"drill_participants":14,"lan_disconnect_verified":true,"backup_restore_tested":true}'::jsonb
)
ON CONFLICT (tenant_id, volatile_hash_hex) DO SELECT
RETURNING event_id, event_mode, rfc3227_phase, ppc_72h_deadline_at, recorded_at;