Have you heard of a cybersecurity tabletop exercise or tabletop drill?

A tabletop drill is a type of exercise or simulation used to test and practice an organization's incident response plan. It typically involves the incident response team members sitting around a table and discussing how they would respond to a hypothetical incident or scenario.

Why Run a Cybersecurity Tabletop Exercise?

The goal of a cybersecurity tabletop exercise is to identify any vulnerabilities or weaknesses in an organization's cyber defenses and incident response plan and to evaluate the effectiveness of the organization's incident response team.

Participants will work through the steps outlined in the incident response plan and make decisions on how to handle the simulated incident. This can include identifying the incident, assessing the impact, determining the appropriate response, and coordinating efforts to resolve the incident. This also includes a plan for communicating with stakeholders and the public during an incident and managing potential damage to the organization's reputation.

The first 24 hours after you discover a data breach are critical to (1) restoring your network security, (2) obtaining and preserving evidence for the cyber investigation, and (3) complying with your legal and contractual obligations.

Are you prepared?

Benefits of Cybersecurity Tabletop Exercises 

Cybersecurity tabletop exercises are a valuable tool for organizations to test and improve their incident response plans and readiness for dealing with cyber incidents.

Here are some of the benefits of conducting a cybersecurity tabletop exercise:

1. Identify vulnerabilities:

A tabletop exercise allows organizations to identify potential vulnerabilities in their systems and incident response plans. This information can be used to make necessary improvements and enhance the organization's cyber defenses.

2. Improve incident response readiness:

Organizations can test the incident response plan and evaluate the readiness of the incident response team. This can help identify any gaps in the plan and ensure that team members are properly trained and equipped to handle a cyber incident.

3. Enhance communication and coordination:

A tabletop exercise provides an opportunity for different departments and external partners to work together and practice communication and coordination in the event of a cyber incident.

4. Compliance:

Many regulatory compliance frameworks such as NIST, PCI-DSS, HIPAA, etc, require incident response planning and testing as a requirement thus assisting organizations to comply with these regulations.

5. Building confidence:

A well-conducted tabletop exercise can build trust and confidence among incident response team members, and across the organization, that they are prepared to handle a cyber incident.

6. Cost-effective:

Tabletop exercises are relatively low-cost and low-impact ways to test incident response plans. They can provide valuable insights and improve readiness without incurring the costs associated with live exercises or actual incidents.

Overall, cybersecurity tabletop exercises help organizations to identify vulnerabilities, improve incident response readiness, enhance communication and coordination, and provide a cost-effective solution to compliance and building confidence.

How to Perform an Effective Cybersecurity Tabletop Exercise

Performing an effective tabletop exercise requires proper planning. Here are some steps that can help you conduct a successful tabletop drill:

1. Have an Incident Response Plan.

Without an incident response plan, the exercise will likely be unorganized without defined processes to follow. The goal is to test your plan, not create one.

2. Identify the purpose and objectives of the exercise.

Clearly define the goals of the drill and what you hope to achieve.

3. Develop a realistic scenario.

Create a scenario that is relevant to your organization and that will test the incident response plan. In addition to a cyber-attack scenario, include a variety of different incident types, such as natural disasters, pandemics, cybersecurity incidents, or workplace violence.

4. Identify your team of participants.

Who is responsible for critical decision-making, overall incident management, containment & restoration of services, and communications?

5. Create an agenda and plan for the exercise.

Outline the steps that will be taken during the drill and assign roles and responsibilities to participants.

6. Facilitate the exercise.

Lead the participants through the scenario and guide the discussion to ensure the objectives are met. Encourage participation and actively listen to feedback from the team.

7. Evaluate the results.

After the exercise, review the results and identify areas of improvement. Use the feedback to update the incident response plan and prepare for future drills.

8. Document the key findings and lessons learned.

The following are some cybersecurity incident scenarios typically covered during incident response tabletop exercises:

• Data breaches
• Device, network, and service compromise
• Ransomware containment
• Cloud SaaS provider data compromise
• Business Email Compromise or financial

Who Needs to be Involved in the Cybersecurity Tabletop Exercise?

Cybersecurity is not purely an IT problem. 

In the event of a cyber incident, who is responsible for critical decision-making, overall incident management, containment & restoration of services, and communications? You need a team that starts from the C-suite down.

Roles and Responsibilities need to be outlined in your Incident Response Plan:

• President / CEO

Responsible for critical decision-making.

• Director of Service Delivery / CTO

The Incident Response Team Leader is responsible for overall incident management.

• Technicians

Responsible for containment & restoration of service(s).

• Sales / Finance / Communications Manager

Responsible for communications.

Additional participants:

• Facilitator

Resource who will guide participants through the scenario.

• Scribe

Responsible for taking notes of participants' reactions and decisions, lessons learned, and what went well, and what did not.

Note: Consider having a third-party security forensics firm as your facilitator. They can provide guidance on attacks they have observed, and answer questions posed by team members.

Additional points of contact in a real-world cyber incident to include in your Incident Response Plan:

• Identify who will assist and collect documentation from a compliance and reporting perspective.
• Related vendors may have an essential role in determining if there is a cybersecurity incident as well as in ensuring the team members understand how to resolve failures and resume operations.
• Insurance Representative who will be responsible for Breach Counsel and authorized 3rd party incident responders.
• Outside agencies such as law enforcement, outside counsel, security forensics firms, or regulators.

Start with an Incident Response Plan

An incident response plan is a document that outlines the steps an organization will take in the event of a security incident. It serves as a guideline for how to respond to a security breach or other emergency situation and is an essential part of any cybersecurity strategy.

An incident response plan typically includes the following components:

• Identification of potential incident types and scenarios
• Roles and responsibilities of incident response team members
• Procedures for incident detection, assessment, and notification
• Guidelines for incident containment, eradication, and recovery
• A checklist of the resources and tools that will be needed to respond to an incident
• Communication plan and procedures
• Post-incident review and improvement process

The incident response plan is an essential document that should be understood and practiced by all employees, so they know what to do in case of an emergency.

It is important to note that cybersecurity tabletop exercises are not only for the IT department but for all the departments in an organization as cybersecurity can have a wide range of impact on the organization.

Teknologize is a SOC 2 accredited, Professional Technology Services company with clients throughout the Pacific Northwest. We have offices located in:

• Tri-Cities, Washington 509.396.6640
• Yakima, Washington 509.396.6640
• Bend, Oregon 541.848.6072

Questions about your IT or Cybersecurity? Give us a call today!