These exercises can be delivered in person or remotely. They can help to build confidence in an organisation’s plan and can help to build “muscle memory” allowing a team to better ‘implant’ their plan in memory, allowing them to respond faster and more effectively if a real incident were ever to occur. Additionally, these exercises can highlight weaknesses in a given plan, for example highlighting single points of failure, critical team members, undocumented key knowledge, or ambiguity in the detail of the plan.
The scenarios can be based on a wide range of potential cybersecurity incidents, such as ransomware attacks, denial of service attacks, data breaches, or more complex attacks involving multiple aspects.
Scenario Testing Methodology Summary
Tabletop Session
The session walks the team through a realistic cybersecurity incident, for example a ransomware attack, a denial of service attack, a data breach, or a multi-stage complex attack. This tests both the effectiveness of the organisation’s existing plan and the team’s “muscle memory” for response, and how well the plan is integrated into their standard processes. The intention is to identify weaknesses within the plan, such as single points of failure, undocumented key knowledge, and reliance on critical individuals. The session finishes with a debrief of immediate recommendations.
Reporting
A report containing evidence of the testing and the findings from the session, including recommendations for changes to policies, processes, or existing documents. Where an organisation also wants a review of its existing plan and the development of playbooks and improved documentation, this is offered as our Incident Response Workshop and Plan Development service.