Tabletop Exercises Should be Smaller

Hear me out, most frameworks have tabletop exercises as part of the preparation phase and it usually includes everyone and their pets. HR Department, Sales, Legal, IT, Cyber, Communications, the Flintstones / Jetsons… you get my point.

At a very high level, the preparation phase of the SANs framework focuses on what your company is doing to prepare for an incident. Here are the high level areas as per SANs.

• Establish an incident response team and define their roles.
• Develop policies, playbooks, and protocols for various incident types.
• Conduct training and simulations.

Tabletop exercises live in this bucket, they test your controls against a scenario. SANs ICS Tabletop Exercise guidance says to "include all teams that are practical to involve" but I am telling you to start narrow instead.

Trying to come up with a scenario that covers all the teams above and test their responses can be a major challenge. Not only do you not have the time, you might not end up with meaningful action items. The idea of the exercise is to not only test, but document what was missed.

Do not use this as a way to point fingers! Tabletops and incidents for that matter, are collaboration heavy. You are likely to get better results if you have good relationships between business units.

Focus on a scenario that might cover actions between the cybersecurity team and IT team and prepare to not let the scenario get out of those boundaries.

Scenario

A scenario is a fictional incident the facilitator presents to the room, a scripted starting situation (and the events that follow) that the team responds to as if it were real, so you can test your plans and decisions without an actual incident. This is where the facilitator should take control of the room. Don't let the room argue whether this is a feasible scenario or not. The point of the exercise is to test controls as well as playbooks/policies.

• 02:14a.m. EDR triggers on a prod server. Suspicious Powershell process using a service account. Provide more details for the SOC to continue the discussion.
• 02:21a.m Tier 1 SOC analyst begins triage. Based on the data, the analyst escalates to Tier 2 as per their playbooks.
• 02:34a.m Tier 2 confirms lateral movement indicators. The service account has authenticated to a second host in the last 20 mins.

So far you are testing the escalation process within the SOC tier analysts and testing definitions in your IR Plan.

Do they know when an event goes to an incident? Do they know who to call at 2:30a.m to escalate it?

Who can isolate devices in the middle of the night? Do their current roles support actions needed? Who has the authority to pull production hosts offline in the middle of the night?

Bring IT into the conversation

02:41a.m. The incident lead declares an incident. Cyber wants both hosts isolated and the service account disabled. The account should not be a problem for the SOC to disable… hopefully.

This is also where you let people speak and provide their insights, ask if they have playbooks that they follow? IT knows, more often than not, by looking at a server name where it belongs to and what the consequences of it being compromised or otherwise unavailable. They should also discuss who the decision makers are based on the host.

In the containment phase of the scenario, it requires changes, does IT run change control? does emergency change move at incident speed or does it need approvals? You'll be surprised how many decisions need to be made, an incident is not the time to answer them. You most certainly can… but you shouldn't.

During an incident, you don't want to answer these questions because they can not only delay remediation and containment but it will also make your team look unprepared. Having your IT team in the room during the exercise is as close as it gets to a real incident.

Lessons Learned

The benefits of starting small is that your actions items are useful! You don't end up with 15 pages of notes and trying to figure out who owns them.

Some of my best feedback after an exercise was when we minimized it and involved only a few groups.

Take note of what was missing as it is happening and while it's fresh:

• Did the SOC know the escalation threshold?
• Did anyone know who could authorize production decisions?
• Do you have an emergency change team?
• Who was missing from the room that you would've involved during an incident?
• Did teams have their own playbooks? Did they follow them?

If you end up your exercise with no action items, something is missing. Figure out what that is.

The exercise will only be useful if you are able to get smaller teams to engage and converse, in a big tabletop exercise, you can't accomplish this because there isn't enough time. Don't focus on getting the scenario perfect, you have to assume there's an incident at some point. Give yourself a timeline to have all action items addressed and don't let them fall for other priorities, chances are they're small hanging fruits anyways.