January 14, 2020 By Robert Calvert 3 min read

Within the field of incident response, planning and testing are key elements of a good security posture. The importance of training and methods of developing tests both feature highly on security professionals’ priority lists. Here are a few lessons I’ve learned about incident response from having run tabletop exercises within IBM and alongside our clients.

What Are Tabletop Exercises?

For those unfamiliar with tabletop exercises, the premise is deceptively simple. A gathered team of incident responders, decision-makers and department representatives are presented with an evolving set of scenario prompts known as injects. These injects are based on real attack scenarios and range from the routinely expected, such as malware alerts, to some less obvious but nonetheless important issues, such as leaks on social media.

The intent of a tabletop exercise is to highlight areas to improve internally, such as ambiguous remits or conflicting processes, all within a low-stakes, blame-free environment. There are even specific tools that can help facilitate your exercises, making running a tabletop as simple as possible with an all-in-one approach.

Manage Enterprisewide Access to Classified Information

Within a recent incident scenario, the team encountered a slight problem dealing with classified material and working alongside legal and HR teams. For the scenario, no person within the HR and legal teams had been previously cleared to access the project files.

This meant that following the traditional incident response plan at a companywide level was impossible. The traditional remote investigators would either need to be given heavily redacted information or start a formal check process to be given system access. Neither option is good in an incident response scenario.

The key lesson here is that if a local or specialist incident plan attempts to converge with a wider company policy, it shouldn’t be assumed the wider policy will translate particularly well. Within your teams, think about whether national sensitivities would impede a traditional multinational or centrally managed response. If they could, you may benefit from a more decentralized response with appropriate skills and empowerment within the core team.

Avoid Planning and Testing Within Silos

Within incident response, it’s essential to have a plan to deal with any major incident. During another recent exercise, I was surprised to learn that certain teams had become quite siloed in their planning processes. This isolation meant that other teams had either significantly duplicated their processes or designed incompatible plans with each other. I had representatives from certain teams surprised to see exactly what their colleagues were doing. Together, the group’s actions ranged from the minimally disruptive duplication of note-taking to teams doing another’s work, only without adequate training.

This finding highlighted the key shortcoming of testing teams in isolation. Had I tested each team independently, these interplay effects could not have been identified. To test for this within your own teams, try asking team leaders what they expect other teams to do in an incident response scenario. If they can’t provide a basic answer, there may be some incorrect assumptions within their decision-making and consequential plans.

Give Everyone a Chance to Engage With Security

The last observation is something that was a completely unanticipated benefit. During a tabletop exercise, we took particular care to include a diverse range of representatives from across many different teams. While collecting feedback, a few participants from a project management team remarked that they hadn’t thought about a cyberattack this much before. For them, seeing the end-to-end process made a lot of previous education make sense.

Within the security industry, it can be easy to lose sight of the fact that while we live and breathe security as a full-time job, our colleagues may not go far beyond mandatory education. Tabletops can be a real eye-opener and trigger an epiphany.

This final finding highlights the importance of inclusivity when it comes to both security education and awareness. Giving staff outside of traditional security teams the ability to engage with the challenges that we encounter day to day is a powerful tool to amplify existing good practices.

Consider Incident Response Training in Your 2020 Security Road Map

For those planning their 2020 security road map, I’d encourage everyone to weave some form of incident response training into it. The field of incident response is an increasingly essential element of security operations. I’m confident you too will find something useful from your tabletops as well as benefits you were not expecting.

More from Incident Response

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

X-Force uncovers global NetScaler Gateway credential harvesting campaign

6 min read - This post was made possible through the contributions of Bastien Lardy, Sebastiano Marinaccio and Ruben Castillo. In September of 2023, X-Force uncovered a campaign where attackers were exploiting the vulnerability identified in CVE-2023-3519 to attack unpatched NetScaler Gateways to insert a malicious script into the HTML content of the authentication web page to capture user credentials. The campaign is another example of increased interest from cyber criminals in credentials. The 2023 X-Force cloud threat report found that 67% of cloud-related…

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America. IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that…

Alert fatigue: A 911 cyber call center that never sleeps

4 min read - Imagine running a 911 call center where the switchboard is constantly lit up with incoming calls. The initial question, “What’s your emergency, please?” aims to funnel the event to the right responder for triage and assessment. Over the course of your shift, requests could range from soft-spoken “I’m having a heart attack” pleas to “Where’s my pizza?” freak-outs eating up important resources. Now add into the mix a volume of calls that burnout kicks in and important threats are missed.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today