With cybersecurity being one of many hats that very busy technical leaders wear, many organizations may not feel they have time to or the skills to conduct their own cybersecurity tabletop exercise. NIST guidelines and CIS Control 17 set a minumum standard of annual tabletop exercises; recent guidelines issued by the FBI in Operation Winter Shield advise quarterly tabletops. To get started or add variety to tabletops, consider conducting a quick single-event tabletop exercise with a discussion time limit of 30 minutes to an hour.
Examples of questions to ask during a short tabletop include:
- Who would be involved in the response (internal and external)?
- What is each of the responders’ role?
- What actions with the responders take?
- Who would communicate/what/to whom?
- Do current plans adequately aid in the response?
- What resources or new plans are needed to better prepare for this type of event?
Bring any incident response, disaster recovery, and/or business continuity plans as well as relevant playbooks to this discussion, and plan on a quick roundtable to address one type of event. To increase participation, consider likelyhood, events experienced by a nearby organization, etc. Below are 30 ideas for short tabletop exercises, to discuss with IT staff and/or senior leadership.
- Tornado (example: destroys Main Distribution Frame)
- Flood in building with technical equipment (ex: pipe burst)
- Power outage
- Fire in building with technical equipment
- Earthquake
- Fiber cut
- Internet outage
- MDF space overheating
- Third party software data breach
- Accidental sensitive data sharing
- Intentional sensitive data sharing
- Sensitive data found on dark web
- Compromised accounts found on dark web
- Staff email account hacked by outside threat actor and used for phishing attempt
- Student account hacked and used for phishing attempt
- A student/patron hacks internal system
- Cloud software outage for a critical system
- Widespread outage impacting cloud services (ex: AWS, Google, Cloudflare, etc.)
- All devices locked by ransomware
- Malware on devices
- Financial social engineering (ex: unpaid invoice)
- Social engineering help desk call
- Unauthorized access to network equipment area
- Disgruntled IT employee fired
- Keylogger discovered on IT employee device
- Large volume of login attempts on critical system
- Data deleted from critical system
- Backups lost
- Lost admin or IT employee device
- Stolen admin or IT employee device
Additional ideas for exercises may be inspired by current events or experiences from other organizations. Taking the time to practice builds that crisis muscle memory, allowing a more rational and through response during an actual event.
Additional Resources:
Operation Winter SHIELD, Federal Bureau of Investigation
Sans Institute “You came with *that* plan? You’re braver than I thought!, Steve Armstrong-Godwin, YouTube
MSIP 6 Standards, MOREnet