Hello, and welcome to another episode of the
prepared Podcast,
I'm your host, Rob Button, and just before
we get started today. Here's a word from
our sponsors un unsolved.
Physical threats such as severe weather,
infrastructure failures and civil unrest are increasing in...
Severity and frequency, forcing
organizations and government agencies alike to prepare for
unpredictability.
That's why only on solve technology is committed
to to helping security and risk professionals
identify threats quickly and manage response holistically.
On unsolved combines artificial intelligence Ai, powered threat
detection, real time and historical, with mass notification,
incident management capabilities, and travel risk management,
to form the industry's most comprehensive
unified platform,
1 that helps organizations identify critical events faster,
analyze risks more accurately, and shorten the time
to respond.
From anticipating risks to detection and recovery, on
soft technology and their experienced team support over
30000
organizations across the globe through every step of
a critical event.
Welcome to the prepared x podcast. Your complete
source for crisis, emergency business continuity and security
preparedness interviews, news, and mud more.
Now your host. He creates chaos for a
living,
Rob.
Welcome to so 139
of the prepaid prepared podcast
titled Cyber defense frontline
Crafting.
The ultimate incident response tabletop top exercises. Welcome
back. Took a short break there over about
a month over the summer here.
To
both work, but also take a couple of
days off with the family. So it's really
good
to be back and back into it and
we'll be going back to our usual 2
podcasts per month is
our usual plan. So looking forward to jumping
back into it. So this 1, it's all
about cyber instant response tabletop exercises I think,
we've been through this before. We follow a
very similar process to our other tabletop top
exercises. Of course, we we move more in
the direction of the incident response as it
relates to instant response planning as it relates
to some elements of technical components of your
cyber response, so we'll touch on
those types of, pieces that we're gonna bring
in to the exercise from your tech teams,
and those components.
Are we gonna make it tech technology heavy?
Depends on the team. Do we need to
add some element of communication in there if
we're bringing in the instant response team from
a com standpoint is a leadership team. What
is the makeup of the team? All those
good things
should come out in your planning stage, which
we're gonna come onto to. So anyway, the
first step and really, most importantly
is really to get organized. And you'll hear
me talk about it in no matter exercise
we plan for
really say in the stage. So what are
we doing? Why are we here? Why are
we ring this instant response tabletop
exercise? You could have a good reason and
often you will
often, you, obviously, if from I'm a if
you're in a regulated environment, you gotta do
it from a a regulatory perspective. Of course,
instant response is essential to your response to
a cyber attack, and so with those organizations,
which is the vast majority of us now
are susceptible in some way shape or form
to to some kind of ransom wear, some
kind of other technical event that may impact
us. And so, you know, preparing for that
scenario planning is essential. So craft those objectives
why are we here? What are we doing?
What are we looking to accomplish with by
going through this
process. So that's really, really important in the
early stages. Part of the planning as well.
And again, you know, we can be broken
down is to a separate component, but, it's
to start to look at those
different issues that you want to look at
specific to the... Your organization. So what of
those scenarios that are gonna impact you the
the most, how are they gonna unfold. So
work with your tech technology teams, not all
of them. If they're participating, work with 1
or 2 of them. And try and find
out how this will start to unfold and
make your day a bad 1 to make
the whole organization's day, a bad 1. So
think about the impacts, think about the systems
that could be, taken down. How would that
happen? What it would it look like to
you what's the general timeline of that happening,
what are the impacts of and what of
your customers seeing potentially, but certainly, what are
your employees experiences as well when these things
start to unfold. So, You can roughly draft
that out in this initial planning stages as
well
before jumping in and adding the details into
the scenario, which we'll talk about now. So
once you've got that draft overview together, what
you want to do is then put some
details around, you know, how this is gonna
unfold.
Usually go... Keep it simple to start off
with, go through the initial unfolding
situation. So that might be the first day,
you're experiencing this or you certainly find out
that you're experiencing this.
And then go on to the next period.
Again, that might be 1 another day, it
may be it's several other days. How how
bad you want to make it. Right? So
think about that, it in terms of your
scenario. So if you wanna make it a
5 day event. So how are we gonna
do that. We need to flush you out
further
in terms of us struggling to get back
online,
you know, the ransom web component to it
obviously bringing in all the other key role
players for the instant risk response standpoint, So
making sure that they're
participating as well. So including that in your
scenario,
you know, all the legal components you know,
the other elements that are gonna,
be, you know, brought to your knees in
terms of a technical component. All the you
know, supporting our organizations are gonna come along
this, critical vendors.
They're gonna come along with support you. Are
they involved in the exercise, or you're just
gonna talk about them in the exercise. So
again, all this can be flushed out when
you are designing your,
scenario. So, again,
making it a difficult day is certainly something
you want today you want to do. Because,
again, this is crisis management. This is instant
response. So, you know, you may... You don't
wanna make it over something overly difficult, of
course, because we want those leaders and we
want those participants to come back and do
further training and exercises in the future. You
need to obviously make it a bad day
that's relevant and realistic to, your environment.
So once you put all that together and
if... Course, we want to deliver, and, hopefully,
you've organized this ahead of time. So in
terms of the delivery, make sure you got
that that's a seasoned of course facilitate to
facilitate that process. That's it's really important, especially
if you've got leaders in the room for
a couple of hours. You don't wanna be
wasting their time, wanna have a professional event
but organized. If there's hand outs, there's hand
outs. If you're breaking the teams down to
different groups where they're gonna go while they're
gonna discuss. You you know, you've got different,
you know, inject for different,
areas of the business, so you got some
legal information for the legal folks. So are
they gonna go and work on it. Are
you gonna keep them in the in room.
So lots of things to think about in
terms of delivery preparing that team as well?
Have you sent them a brief ahead of
time in the planning stages? We usually send
their pre read video
to get those participants ready for the exercise.
So, lot you can been doing there. So
challenging in the delivery, the decision making and
obviously
communications, being a big part of it as
well. And, of course, if it's more technical
focus, you know, we're gonna be talking about
all those technical
components and the different issues that the technical
team's is gonna be faced with as it
relates to the specifics around the scenario. So
Again, you may have both of those scenarios
running. We we have 1 client right now
where we're doing technology on day 1. Either
way we roll it day 2 for the...
Leadership and it works quite well because we're
obviously learn a lot from day 1. We
can adjust slightly.
So this scenario into day 2 and have
those key discussions, on some of those findings.
So lots to do on delivery. A partnered
of delivery as well is that evaluation component
really. So
step 3 here really is the evaluation and
making sure we can pull all that information
in. So as you're having your discussions, how
we we evaluating the x exercise. Is it
based on our plans, our procedures? Is it
based on other elements that we, have, built
into to our,
evaluation, protocols,
our evaluation,
assessment processes,
you know, how are we meeting those
again, you can get into a lot of
detail as it relates to your evaluation. But,
you know, really, it links back to, plans.
And I I use use 1 example,
and let's use it from an instant response
activation of the team. So your plan makes
what say 1 thing,
but from an evaluation standpoint. So, you know,
that... Something else actually happens or is discussed
differently to what's in the plan,
what happens in real life. So again, you
know, that's the evaluation there. It's not matching
up. It in terms of, that process. So
the adjustment would need to take place in
your after actual report afterwards. So... And again,
there are other elements that you want to
test in your plans And again, that links
back to your evaluation
protocols.
So really important that we evaluate. And of
course, at the end of the exercise, we...
Be gathering all the information from all the
participants, and it's really important that's, of, of
course, we put a comprehensive
after action report together, gonna just like we're
doing other exercises is really important that that
report
identifies what everyone's discussed in terms of their
findings. Again, everything comes from the participants. You
know, they find out what's going on, they
find out what's wrong in terms of the...
In in terms of their experiences
in the tabletop topic. Exercise and even in
real life as well. So you're documenting
all of that during the exercise, it's really
important because sometimes when we get together and
have our meetings, in a general setting and
have a general discussion, we really don't identify
opportunities for improvement. That's the main purpose behind
running after running a tabletop top exercises and
put you after action reports together. So gathering
those observations, this is what we found and
then adding a recommendation. This is what we
recommend based on those findings and documenting those
in your after action report really, really important.
And, of course,
part of that as well, is once you've
had that report approved everyone signed off on
it in terms of those findings, then you
put the remediation plan together. So we found
everything and they have to act and report
the observations and recommendations. Now we put those
recommendations into remediation plan. Who's responsible for doing
what bioware when in terms of those improvements,
shouldn't whether it's a a update of a
policy,
update of procedure, like some capability that's missing
that we need to add into the planning,
whatever it may be, that mediation plan needs
to have those details and how you're gonna
accomplish,
you know,
modification of the plan, all those other things
that are in there. So at that plan
that remediation plan needs to be put together,
and again, distributed those individuals who are gonna
be responsible for
you know, for, carrying out the remediation plan.
And that may last 3 months it may
last 6 months depending on how detailed you
get in terms of for, those remediation items.
But again, you know, you need to have
a plan and you need to be to
act on it after the exercise,
So, you know, very high level,
and it went to, not too much detail,
but planning obviously, is the initial part of
it putting your exercise together the object. Tips
all that good stuff,
delivery really important
that we have a facilitator who's done this
before, or you got someone who's confidence standing
for of those leaders to make sure that
we're delivering and we're challenging those decision making
and communication elements. Of course, the evaluation and,
the the report writing and remediation are those
steps that come
you know, after that. So, you know, really,
really
important that you have a thorough process as
you're designing your after... I... All your tabletop
exercises
and you're conducting your after action report and
remediation planning, which is really the main element
at the end of the whole process. So
hope you enjoyed this 1.
Episode 01:39.
If you did, please share it with your
network, and we look forward to seeing you
on the next
podcast. Take care.