book

Cybersecurity Tabletop Exercises

by Robert Lelewski, John Hollenberger

October 2024

Intermediate to advanced

200 pages

5h 16m

English

No Starch Press

Read now

Unlock full access

Praise for Cybersecurity Tabletop Exercises
Title Page
Copyright
Dedication
About the Authors and Technical Reviewer
Acknowledgments
Introduction
Who Should Read This Book and WhyWhat’s in This BookThe Book’s Scope
Part I: The Tabletop Exercise Process
1. Why Perform Tabletop Exercises?
Reasons to Conduct a Tabletop ExerciseImprove Incident Response Team CollaborationClarify Team Roles and ResponsibilitiesAssess the Impact of Process ChangesReduce the Cost of Data BreachesImprove Security AwarenessExplore Key QuestionsPrepare Senior Leadership for an IncidentAlign with Industry StandardsFulfill Contractual RequirementsExamine a Recent Cybersecurity IncidentIdentify and Prioritize RisksAdvantages of Tabletops over Other Security ExercisesLow Cost and High Return on InvestmentEfficiencyNo Operational DisruptionWhat Tabletop Exercises Can TestThe Potential Impact of Current ThreatsThe Sufficiency of the Information Security BudgetInformation Sharing Protocols for IoCsGaps in the Incident Response PlanThe Efficacy of Processes and ProceduresCompliance with Notification RequirementsResidual Risk After Corrective ActionsSummaryQuestions
2. Planning the Tabletop Exercise
Securing Executive Sponsor SupportChoosing an Appropriate Executive SponsorOutlining the Executive Sponsor’s ResponsibilitiesDefining the Exercise’s Goals and ObjectivesRehearsing the Incident Response PlanUnderstanding Organizational Incident Response RolesAssessing Vendor ResponseEvaluating Communication ProcessesSenior-Level vs. Operational-Level ExercisesDetermining Who Should ParticipateExternal VendorsLegal SupportThe Development TeamLogistical ConsiderationsHosting Remote vs. In-Person ExercisesDetermining the DurationChoosing a Date and TimeSecuring a FacilitySetting the ToneNotifying and Preparing Exercise AttendeesThe Executive CheckpointThe Initial Email NotificationCalendar InvitationsThe Discussion SessionInformal TouchpointsThe Final ReminderScenario ConfidentialityOpposition from InviteesOutsourcing Tabletop ExercisesSummaryQuestions

3. The Development Process: Where the Rubber Meets the Road
Choosing a TopicConsult Your Business Impact AnalysisConfer with the Executive SponsorLeverage Other Resources for InspirationDeveloping the ScenarioCharacteristics of an Effective ScenarioSources of Inspiration for Your ScenarioIntroducing InjectsSimulate Time ConstraintsDirect FocusBalance Clarity and ConcisenessDesigning the Exercise StoryboardConsidering the Scenario Escalation PaceCrafting Your Ground Truth DocumentAdd Details and Expected OutcomesMaintain RealismAlign with ObjectivesCreating the Presentation DeckIntroductionsThe PreambleInjects and Exercise DiscussionsThe DebriefInviting FeedbackSummaryQuestions
4. Facilitating a Successful Tabletop Exercise
The Facilitator’s RoleTabletop Management TasksAssigning a ScribeAdding a Co-facilitatorInviting a Guest PresenterPrewriting QuestionsExercise Tools and TacticsA Writing BoardPolling SoftwareRemote Presentation SoftwareMultimedia AidsAttendee Tasks and Breakout GroupsRecording Devices and SoftwareMaking the Most of the Exercise SpaceMaximize the Conference Room LayoutWork the Room to Boost EngagementCommunication TipsMonitor Physiological ResponsesSet Up BackchannelsCheck in with Senior AttendeesManage Conversation HogsForge Interpersonal ConnectionsConsider the Question StructurePay Attention to Nonverbal CommunicationPractice Cultural AwarenessIdentify Sensitive Topics BeforehandSummaryQuestions
5. Acting on What You’ve Learned: Evaluation and Next Steps
Evaluation Requirements and RestrictionsChoosing an EvaluatorEvaluation MethodsPerforming a DebriefSending a SurveyReporting ConventionsStatement of CompletionFull ReportFollow-up ActivitiesAssess the Incident Response PlanCatalog and Update Other Documentation and ProcessesConduct Follow-up Tabletop ExercisesImplement a Formal Tabletop Exercise ProgramCommunicate High-Level Exercise FindingsIdentify and Analyze TrendsSummaryQuestions
Part II: Example Scenarios
6. Engaging a Technical Audience
A Widespread Phishing CampaignThe ScenarioPossible ModificationsRansomware Affecting File Servers (the Technical Version)The ScenarioPossible ModificationsA Malware Outbreak via a Zero-Day VulnerabilityThe ScenarioPossible ModificationsA Supply Chain CompromiseThe ScenarioPossible Modifications
7. Engaging an Executive Audience
Ransomware Affecting File Servers (the Senior-Level Version)The ScenarioPossible ModificationsA Dark Web Data DiscoveryThe ScenarioPossible ModificationsA Distributed Denial-of-Service AttackThe ScenarioPossible Modifications
8. Engaging the Business
A Physical Security BreachThe ScenarioPossible ModificationsA Social Media CompromiseThe ScenarioPossible ModificationsAn Insider ThreatThe ScenarioPossible Modifications
Appendix: Reporting Templates
Index

Content preview from Cybersecurity Tabletop Exercises

4 FACILITATING A SUCCESSFUL TABLETOP EXERCISE

Now that the preparation work is complete, it’s time to deliver the tabletop exercise. This chapter puts you in the role of facilitator and covers a number of strategies that will help ensure your event is productive. Some of these are guidelines you can follow to stay organized and balance your responsibilities as facilitator, and others are recommendations for tools and techniques to boost participant engagement and create a more interactive exercise.

The Facilitator’s Role

If you’re facilitating the tabletop, you have the challenging role of guiding participants through the scenario while ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781098182489Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Cybersecurity Tabletop Exercises

by Robert Lelewski, John Hollenberger