Threat Scenarios. IT Tabletop Exercises
Shall we play a game?
No, today we're not playing Monopoly or Mafia, but a board game that will help your business survive a crisis and thrive even in the event of war or a terrible, unknown pandemic.
Closed-door discussions are essentially formatted meetings during which players learn their roles and model strategies in the event of a crisis from external forces or an incident of any nature that poses a potential threat to the stability of the enterprise.
Scenarios and clear step-by-step protocols are developed to eliminate the threat and for each player to practice their assigned role in an emergency.
A sort of tabletop exercise. War or fire may not occur, but by knowing your role and playing out several scenarios simulating a natural or man-made disaster, you'll receive a plan directly from your computer to prepare for any situation, save your business, and repel attacks.
We wrote about good attacks in IT in a recent issue of ourblogToday we'll talk about possible bad ones and how to protect yourself in such cases.
Follow us onFacebook,Telegram,Twitter or Instagramto be in trend!
The simulated crisis and its purpose
Training company personnel and senior IT managers in new skills and ongoing specialized knowledge development about cyber risks is commonplace today.
Companies that constantly monitor the evolution of threats by default apply the principles ofZero Trust.
Companies that are one step ahead also use tabletop exercises to simulate potential emergencies and develop comprehensive scenarios based on the experience of others and real-life, practiced cases for each incident. The core element of protection is the software and people who work for you.
In addition to practicing actions, models and scenarios involve not theoretical but actual discovery of people's behavioral reactions in specific situations that are not described in textbooks or crisis management manuals.
Therefore, such artificial war games or thrillers in the office are the best tool for understanding where the real threat is hidden and how to eliminate it without harming your business.
A comprehensive overview of cyber risks and a proprietary protection tool based on it can only be obtained through experience and modeling, and nothing else. Even the most theoretically sound strategy and analysis will fall apart if you don't consider the full range of technical components and the human factor.
Even the best software and security can be compromised by an employee who becomes incapacitated due to psychological pressure or unavailability of technology. The detailed scenarios described below provide a picture of the appropriate response and adequate recovery for your team and individual players.
The main goal of such exercises is to ensure that people are able to work without loss of quality in the most unforeseen situations.
Rules
You must be sure,that all players understand that these training meetings are confidential.
Besides technical ones,Come up with creative, unusual threat scenarios. This will develop your social intelligence and add a fun element to such a serious set of security measures.
It is mandatory in the exercisesTop managers must be involved. They approve final scenarios, assess risks, and make decisions. They are also responsible for all consequences. Based on the decisions made, a report is prepared for the owners or CEO, and possibly also for the president, board of directors, or shareholders' meeting—depending on the structure of your company.
AssignChoose a staff member to be the facilitator—someone the group can trust, figuratively speaking, with the keys to the apartment or their secrets. This could be your boss or an employee everyone enjoys talking to, someone who is bright, people-pleasing, and enjoys good food. You understand the principle behind appointing someone to this role. Perhaps it's someone's mother.
This role-playing appointee will help the group achieve synergy during exercises and will advocate for open communication, inclusivity, and fairness, regardless of opinions. A kind of neutral player who cannot be drawn into confrontation or the negative vortex of the scenario.
It is important to remember,that it is not so much the technologies that are being tested, but rather people and communication channels.
Developseveral scenarios for each threat.
Players musttreat the exercise as a real event and get into the role as much as possible.
GroupThe time for each scenario should not be excessively large. The training duration should not exceed two hours.
Spaceshould be safe and familiar to each participant to minimize stress during experiments, since failure is part of the game.
Principles and creation of response models
It needs to be clarifiedWhat real risks exist, document them in separate capsules, so that after developing solution models, such a first aid kit is readily available. In this segment, it's important to understand what real events could lead to a company's collapse, rather than making mountains out of molehills based on minor incidents that occur all the time. It's important to be able to analyze which critical events, such as a system hack, a devastating fire, war, mental health issues, or unhealthy bullying, could ruin a business. There are plenty of examples in recent history and in the media.
The training is conducted by employeesSecurity and offer their own protection ideas. Legal, support, HR, and logistics are all equally important. They will also have roles. Because if this scenario comes to fruition, they will be the ones using the tools to communicate with clients and restore your brand.
Some participants may not understandWhat are such games for? However, everyone should understand that this is meant to test a team's comprehensive response to a threat and its behavior, not in peacetime, but in an artificially created, threatening fake attack, to deeply understand what needs to be improved. Few people develop such skills in everyday life, and gaining experience in the midst of a real tragedy without a plan and without knowing who's really working alongside you is a complete failure. Smart people learn from the experience of others.
Develop recovery modelsBased on the fact that you'll have to rely on limited resources. Eliminate the excessive impact of technology and think through backup options for business continuity. You should have backup options. Or in the event that communication channels, both landline and electronic, are unavailable.
Collect analyticsand the latest data on attacks worldwide. Don't assume that by using someone else's scenario for recovering from a devastating DDoS attack, you'll automatically be protected. Certainly, it's important to have basic knowledge of how to protect yourself from such incidents—we've covered that in this article.articleAt the same time, thanks to your tabletop exercises, you'll develop your own highly realistic scenario and, in the event of a disaster, quickly deploy to the field. In the coming issues, we'll tell you how to protect yourself from ransomware and how to remove it from your computers. Stay tuned.blog.
Teachings– This is a unique role-playing game, and it may differ from what your employees experience in their daily work lives. Since the threat scenarios are fictitious and the role is assigned, the player must immerse themselves in that role, gain a fresh perspective, and identify gaps.
Don't get distractedAvoid idle chatter during exercises, as deviating from the central task will result in low efficiency and fatigue among those present. Focus on the end result.
Be aware that identifying weaknessesand unexpected reactions mean that your model and exercises have been successful – because increased safety in the short and long term, improved communication and coordination within the team – will bring stability to business processes.
To make your forum comfortable and flawless,Give people freedom of action, as many subordinates feel constrained and uncomfortable when forced to speak up in front of their superiors. After all, this is a fictional business gimmick, a game designed to detect thin ice. People should feel natural and at ease. A player's loss in a given scenario is also a result, as "only winning" is not what directors are looking for.
Example scenarios
Phishing attack.Develop instructions for employees on how to proceed when receiving an unusual or suspicious email. Create a scenario model with cells for the player who has entered the attack model, and develop a response manual for each interaction. That is, if the employee doesn't recognize it as phishing from the first step and clicks the link, they should know what to do. The same applies if they take the second incorrect step, and so on. The scenario should be described to the very end, with variable outcomes. There should be a manual for every run of the game, since even in a zero-sum model with uncontrollable catastrophic consequences, it is necessary to know what to do. During the game, all participants propose solutions, even those assigned to the role of the victim. Players share how they would react and what they would do if they made a mistake. The results of the discussion are compiled into instructions in the knowledge base.
Attack on the logistics or sales department.Simulate an attack on your sales department. For example, a company has purchased new software for hosting analytical tools in the cloud from an untrusted vendor. At a certain point, software maintenance and support begins to cause problems and delays. The number of dissatisfied customers grows, the workload on support increases, and related departments also feel the pressure and stress of downtime. Roleplayers must play out a scenario of how to interact until the situation is resolved positively without damaging the business. They also must reverse the scenario if the forecast worsens. Network administrators develop backup sites for deploying service packages or supply chains. Time and material costs are taken into account and optimized as much as possible. Players discuss all possible viable options, considering available resources and constraints. To prevent a business disruption from escalating into an international tragedy, you need to clearly understand where exactly events are spiraling out of your company's control.
Social game involving human risk factor.Sometimes people go crazy, and that shouldn't affect you either. Play out a scenario with someone who started a fire or caused other damage to your equipment or trashed a laboratory, for example. Or, not just one person, but a group or even more – causing physical damage to your business, including equipment, buildings, and people. To avoid this kind of force majeure, you must ensure your security team is in place, have comprehensive fire safety measures in place, and have trained your people in civil defense. Fire extinguishers and other auxiliary equipment, on-duty guards, and access control are essential for safety. The scale and components depend on the size of your company. Players go through the model step by step, as if the incident had occurred. Evacuation plan, video surveillance, operational communication channels with law enforcement, backup deployment locations, etc.
New pandemic.The recent pandemic has taught many businesspeople how to adapt their businesses and teams to the realities of a previously unfamiliar business environment. However, it wouldn't hurt to develop models and guidelines for an even more restrictive and dangerous global disease.
Develop strategies for when your team is functionally at half capacity. How to properly distribute the workload so those remaining don't burn out and still enjoy their work. Listen to the opinions and suggestions of your assigned team members, and what optimal solutions and workarounds are already available.
These are a few random examples of safety games, along with an explanation of why adults sometimes need to play.
Come up with and get a feel for what's relevant for your segment and what solutions are right for you – ask your employees and yourself.
Prevention is better than cure, this is common knowledge.
With us you will receive a reliable and securehosting, cooldomain And SSL certificatefor your business.
