book

Cybersecurity Tabletop Exercises

by Robert Lelewski, John Hollenberger

October 2024

Intermediate to advanced

200 pages

5h 16m

English

No Starch Press

Read now

Unlock full access

Praise for Cybersecurity Tabletop Exercises
Title Page
Copyright
Dedication
About the Authors and Technical Reviewer
Acknowledgments
Introduction
Who Should Read This Book and WhyWhat’s in This BookThe Book’s Scope
Part I: The Tabletop Exercise Process
1. Why Perform Tabletop Exercises?
Reasons to Conduct a Tabletop ExerciseImprove Incident Response Team CollaborationClarify Team Roles and ResponsibilitiesAssess the Impact of Process ChangesReduce the Cost of Data BreachesImprove Security AwarenessExplore Key QuestionsPrepare Senior Leadership for an IncidentAlign with Industry StandardsFulfill Contractual RequirementsExamine a Recent Cybersecurity IncidentIdentify and Prioritize RisksAdvantages of Tabletops over Other Security ExercisesLow Cost and High Return on InvestmentEfficiencyNo Operational DisruptionWhat Tabletop Exercises Can TestThe Potential Impact of Current ThreatsThe Sufficiency of the Information Security BudgetInformation Sharing Protocols for IoCsGaps in the Incident Response PlanThe Efficacy of Processes and ProceduresCompliance with Notification RequirementsResidual Risk After Corrective ActionsSummaryQuestions
2. Planning the Tabletop Exercise
Securing Executive Sponsor SupportChoosing an Appropriate Executive SponsorOutlining the Executive Sponsor’s ResponsibilitiesDefining the Exercise’s Goals and ObjectivesRehearsing the Incident Response PlanUnderstanding Organizational Incident Response RolesAssessing Vendor ResponseEvaluating Communication ProcessesSenior-Level vs. Operational-Level ExercisesDetermining Who Should ParticipateExternal VendorsLegal SupportThe Development TeamLogistical ConsiderationsHosting Remote vs. In-Person ExercisesDetermining the DurationChoosing a Date and TimeSecuring a FacilitySetting the ToneNotifying and Preparing Exercise AttendeesThe Executive CheckpointThe Initial Email NotificationCalendar InvitationsThe Discussion SessionInformal TouchpointsThe Final ReminderScenario ConfidentialityOpposition from InviteesOutsourcing Tabletop ExercisesSummaryQuestions

3. The Development Process: Where the Rubber Meets the Road
Choosing a TopicConsult Your Business Impact AnalysisConfer with the Executive SponsorLeverage Other Resources for InspirationDeveloping the ScenarioCharacteristics of an Effective ScenarioSources of Inspiration for Your ScenarioIntroducing InjectsSimulate Time ConstraintsDirect FocusBalance Clarity and ConcisenessDesigning the Exercise StoryboardConsidering the Scenario Escalation PaceCrafting Your Ground Truth DocumentAdd Details and Expected OutcomesMaintain RealismAlign with ObjectivesCreating the Presentation DeckIntroductionsThe PreambleInjects and Exercise DiscussionsThe DebriefInviting FeedbackSummaryQuestions
4. Facilitating a Successful Tabletop Exercise
The Facilitator’s RoleTabletop Management TasksAssigning a ScribeAdding a Co-facilitatorInviting a Guest PresenterPrewriting QuestionsExercise Tools and TacticsA Writing BoardPolling SoftwareRemote Presentation SoftwareMultimedia AidsAttendee Tasks and Breakout GroupsRecording Devices and SoftwareMaking the Most of the Exercise SpaceMaximize the Conference Room LayoutWork the Room to Boost EngagementCommunication TipsMonitor Physiological ResponsesSet Up BackchannelsCheck in with Senior AttendeesManage Conversation HogsForge Interpersonal ConnectionsConsider the Question StructurePay Attention to Nonverbal CommunicationPractice Cultural AwarenessIdentify Sensitive Topics BeforehandSummaryQuestions
5. Acting on What You’ve Learned: Evaluation and Next Steps
Evaluation Requirements and RestrictionsChoosing an EvaluatorEvaluation MethodsPerforming a DebriefSending a SurveyReporting ConventionsStatement of CompletionFull ReportFollow-up ActivitiesAssess the Incident Response PlanCatalog and Update Other Documentation and ProcessesConduct Follow-up Tabletop ExercisesImplement a Formal Tabletop Exercise ProgramCommunicate High-Level Exercise FindingsIdentify and Analyze TrendsSummaryQuestions
Part II: Example Scenarios
6. Engaging a Technical Audience
A Widespread Phishing CampaignThe ScenarioPossible ModificationsRansomware Affecting File Servers (the Technical Version)The ScenarioPossible ModificationsA Malware Outbreak via a Zero-Day VulnerabilityThe ScenarioPossible ModificationsA Supply Chain CompromiseThe ScenarioPossible Modifications
7. Engaging an Executive Audience
Ransomware Affecting File Servers (the Senior-Level Version)The ScenarioPossible ModificationsA Dark Web Data DiscoveryThe ScenarioPossible ModificationsA Distributed Denial-of-Service AttackThe ScenarioPossible Modifications
8. Engaging the Business
A Physical Security BreachThe ScenarioPossible ModificationsA Social Media CompromiseThe ScenarioPossible ModificationsAn Insider ThreatThe ScenarioPossible Modifications
Appendix: Reporting Templates
Index

Content preview from Cybersecurity Tabletop Exercises

2 PLANNING THE TABLETOP EXERCISE

Before you can develop the tabletop exercise, you need to lay its foundation. This chapter will walk you through that process, outlining the factors you should consider in the preparation and planning stage. The advice in this chapter comes from hundreds of conversations with our clients, who frequently ask the same several questions that you’ll need to answer prior to constructing the tabletop exercise.

These foundational questions include the following: Who from the executive level is providing support? What are the organization’s goals and objectives? What is the exercise’s tenor? Whom should you invite? ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781098182489Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Cybersecurity Tabletop Exercises

by Robert Lelewski, John Hollenberger

2 PLANNING THE TABLETOP EXERCISE

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.