Pratum Blog

Team of employees sitting around table doing incident response tabletop exercises

Tabletop exercises provide one of the most effective methods for testing your incident response (IR) plan, short of experiencing an actual breach.

IR planning in general has moved up the priority list for most organizations as weekly reports prove that no one is immune to cyberattack. But unless you test your IR plan, you won’t really know if it covers all the right steps. A tabletop exercise throws your team into a simulated breach, which quickly helps everyone start recognizing the IR plan as a real-world lifeline, not just a dusty policy statement. Most mature organizations conduct a tabletop exercise at least once a year, and some conduct several each year to cover various parts of the organization.

The guidelines below help you plan and carry out a tabletop exercise (also known as a TTX) that pays immediate dividends in finding places to improve your IR plan and focusing your team’s attention on the potential challenges. (If you want to take a deep dive into tabletop exercise planning and don’t mind government-speak, review the CISA Tabletop Exercise Package.)

Write Clear Objectives and Outcomes

The exercise’s organizers should have a specific idea of how the tabletop fits into the overall strategy for testing your IR plan. And since the IR plan will drive the tabletop exercise, make sure that all participants have a copy of the IR plan before the exercise. Let everyone know that they’re expected to review it prior to the exercise and to bring a copy to the meeting.

Invite the Right People

With a clear concept of your exercise’s purpose, you’ll know whom to have participate and what kind of scenario to use. The best tabletop exercises include representatives beyond the IT team. While your tech folks will be tasked with the immediate jobs of understanding and stopping a breach, key decisions require perspectives beyond the IT staff. For example, an operations representative should be there to explain the real-world ramifications if someone from IT always suggests “shut it down” as a solution to a breach. Representatives from the public relations and legal teams can help manage messaging and highlight legal traps to avoid. And, if you can get them to come, it’s best to have a member of the C-suite attend so they get a firsthand sense of the potential risks and what it will take to mitigate them. If you’ve identified a full Disaster Recovery team, inviting those people will probably check most of the above boxes.

Create Meaningful Scenarios

The scenario’s quality determines much of the success of the tabletop exercise. An experienced cybersecurity expert can help craft a scenario that reflects the latest real-world threats. They can pace the reveal of information to mimic how actual breaches develop. They can build in multiple attack vectors like the ones you’ll see in real life. The scenario should also bring in third-party concerns, such as clients calling to ask why your services aren’t working or issues that start cascading through your supply chain. The best scenarios typically take a key leader out of the equation by declaring them unreachable during the crisis. That prevents everyone from saying, “We’ll just call the boss, and she’ll know what to do.”

Take It Seriously, But Encourage Honesty

Managers should set the tone by treating the entire exercise with urgency. Don’t let participants short-circuit the process by skipping steps or brushing something off as unrealistic. Following the defined steps is all part of the exercise. This prepares you for the fact that, in some industries, you may not be able to file a cyber insurance claim for a real incident without showing a full root cause analysis (RCA) of the breach. So work the problem as described in the scenario and require everyone to be specific with their answers. But cultivate an atmosphere where people can admit it when they don’t know what to do. After all, you run these exercises to identify exactly those kinds of gaps.

Use an Outside Facilitator

You’ll usually get better results with an experienced third-party expert facilitating the process. They’ll work with the test’s leader to plan a strong scenario, and they’ll keep everyone on track during the actual exercise. They know how to ask the right questions and won’t be held up by internal politics. The facilitator also helps drive everyone to identify action items at the end.

Commit to Follow-Up Steps

Your session should include an immediate discussion about how the exercise went (what CISA calls a “hot wash”). Task someone (your facilitator often handles this step) to write down and assign specific to-do items from the meeting. Those often include updating portions of the IR plan, getting more information about how your backup system works, etc. Set a deadline for completing the to-do list and/or holding a follow-up meeting to check progress.

Pratum’s consultants lead dozens of tabletop exercises every year for clients of all sizes. Contact us today to learn how we can help you get the most from your next exercise.

Best Practices for Information Security Risk Assessments

If you’re considering how to get the most value from your information security risk assessment—or whether you even need one—use these best practices shared by Pratum vCISO Ben Hall. Ben and the rest of the Pratum team conduct numerous information security risk assessments each year, giving them deep insight into how you can maximize this key part of your cybersecurity strategy.

Pratum vCISO Ben Hall
Ben Hall
vCISO, Pratum

Q:

What’s the most common risk you see?

Ben:

We always see issues with access controls, whether that be access to the network, access to applications or access to the facility. There is always some gap in control when it relates to giving an individual user access to those resources. A lot of times, we see organizations give administrator privileges to an end-user that may not be doing development activities. So not only can they make changes to their local workstation, but they can also make changes to an application or to something like customer data when it may not be necessary for their job role.


Q:

What’s another common challenge that comes up in assessments?

Ben:

Change management comes up a lot as well. A lot of organizations think they have pretty robust change management controls in place, but we can typically identify that it’s not the case when we ask for selections. So if it’s firewall changes and you make changes every Wednesday, we’re going to ask if there are tickets to back that up. If you’re doing development changes where you’re going from one version to another, where’s the development process within that? How are you evaluating that the development change is actually good and will fit within the environment? Is there a quality assurance (QA) test?


Q:

Are there other policies or controls that you recommend everyone should have based on all the risk assessments you perform each year?

Ben:

Incident response comes up now more than ever based on all the news we’re seeing, the ransomware events, the actions of malicious employees, etc. With all that going on, it’s crucial to be able to get your team together and properly respond to an incident.


Q:

What kinds of things tend to surprise IT leaders when they read the report from their IT risk assessment?

Ben:

They almost always find something surprising in there. Most people tend to think their environment is more secure than it really is. And that’s the benefit of bringing in a third-party for the risk assessment. We can provide that objective view. We’re not intimate with those controls, so we can ask the questions of why they exist in the first place. So the risk posture they expect versus the reality comes up a lot, and it can make those meetings a little interesting.


Q:

You cast a wide net during a risk assessment by talking to people in a variety of departments. Why is it important to get all those perspectives within the organization?

Ben:

Something that comes up often is a lot of shadow IT controls and applications that exist. You may be aware, for example, of what your Accounts Payable department is using to make sure all the statements are paid. But there may be additional things like cloud-sharing tools that you were unaware of and that the team tells the external auditor about. We also like to meet with the finance team and CFO or others in the C-suite to get that additional insight as to what’s existing today and what their expectations are for IT. It sheds a lot of light on what the CEO expects IT to do but has never told them about and that IT has never even considered.


Q:

How do you coach people to read through a risk assessment report and start deciding on next steps?

Ben:

One thing we do with every report is identify the 5-10 items that we’d start with if it was our program. So we help you set that prioritization focusing on Implementation Level 1: This is what needs to take place, all the way through. We also provide a risk register that lists any additional opportunities for improvement discovered through the risk assessment. So that way you not only have that executive overview of these 10 things to do immediately, but you have that other comprehensive list of activities that can be incorporated throughout the year.


Q:

What trends have you been seeing in risk assessments this year?

Ben:

The thing that surprises me the most is the lack of multifactor authentication across the board. You would think that with 2020 and that immediate shift to remote workforce, everyone would have widely implemented some kind of MFA or 2FA by now, I’m surprised that it’s still a gap with a lot of organizations that still have pretty substantial applications open to the network. A lot of times you’ll see that maybe they have put in some kind of VPN, but even that still doesn’t have MFA or 2FA tied to it. This remote shift is going to stay a while, so if you don’t already have plans to implement MFA or 2FA, that would probably be my #1 thing to start working toward this year.


Q:

After an organization has done a risk assessment, when do they need to start thinking about another one?

Ben:

Best practice is to do it at least annually. Even better practice is to have that annual risk assessment, but then have some kind of risk management committee. So not only are you evaluating those controls identified in the risk assessment and utilizing your risk register to manage a lot of that, but you’re also meeting on a quarterly or even monthly basis to look through what exists, adding new risks that have been identified throughout the year to that list and talking through a remediation plan. So you need that continuous evolution of quarterly processes reviewing that process in addition to the annual formalized risk assessment.


Q:

Can an organization realistically evaluate its own risk using its internal team?

Ben:

You could, and we often encourage that. But if you look at it like going to a gym and hiring a trainer, you really benefit from getting an expert opinion on what kind of workout makes the most sense for you. That can tie into risk assessments, too. You want that external opinion from subject matter experts who do this on a daily basis and can truly assess your organization with that independent lens. As a control owner within that organization, you tend to be a little guarded as far as to what some of those activities could be. In comparison, an independent auditor or assessor can look at those processes objectively and point out potential flaws that exist in the remediation activity. Hard questions will be asked during a good risk assessment. But that said, it’s not a tough engagement. We’re there to help you get better. So it’s best to give us those open, honest answers. We’re here to help you get stronger and get better. There are no wrong answers in a risk assessment.


If you’d like to talk with a Pratum consultant about how to plan a risk assessment in your environment, contact us today.

A thorough penetration testing campaign involves social engineering, vulnerability scanning, and the manual hacking of computer systems, networks, and web applications. This overview shows how a professional team uses multiple types of penetration testing to exploit a variety of attack vectors, just as a real hacker would.

Social Engineering: Hacking Humans

  • Phishing
    Penetration testers craft emails that seem to be from a trusted source and invite recipients to either supply their login credentials or click on a malicious link or attachment.
  • Pretexting
    Penetration testers call targeted people and ask for sensitive information such as login credentials or fool the user into performing a malicious action. Callers frequently impersonate a Call Center rep or a fellow employee from another division.
  • Facility Access
    Old-fashioned physical intrusion still plays a role. Penetration testers may slide through an open door in a group of employees. Or they may look for vulnerable entrances such as loading docks, maintenance entrances or designated smoking areas. Testers sometimes pose as maintenance workers and talk their way into sensitive parts of the facility.
  • Dumpster Diving
    Just like real hackers, testers know they often can find sensitive information in the trash. This might include credit card receipts, travel information, network diagrams, device inventories with IP addresses, contact lists, and more.

Vulnerability Scanning: Discovering Weaknesses

Automated tools seek known security vulnerabilities in your systems such as unpatched software or open ports. The scans reveal risks that may directly impact your organization and point penetration testers to areas they can try to exploit.

Penetration Testing: Manually Exploiting Vulnerabilities

  • Network & Infrastructure
    Infrastructure penetration testing identifies security weaknesses within your network. Testers look for flaws such as outdated software, missing patches, improper security configurations, weak communication algorithms, command injection, etc. Infrastructure penetration tests often include testing of firewalls, switches, virtual and physical servers, and workstations.
  • Wireless Penetration Testing
    Hackers can leverage wireless capabilities to infiltrate an organization’s secured environment, even if some access and physical security controls are in place. Pen testers map access points in the wireless landscape and gain access to the wireless network. Then they attempt to exploit weaknesses in the network to gain access to privileged areas and demonstrate the potential impact of a wireless network breach
  • Web Applications
    Web applications often process and/or store sensitive information including credit card data, personally identifiable information (PII), and proprietary data. And web apps are frequently vulnerable due to their complexity and rapid development cycles. That’s why about 40% of all breaches involve web apps. And that’s why a well-rounded pen test includes any web apps the company uses.

Red Teaming: Emulating Advanced Threats

Here, penetration testers take a more adversarial approach as they go after specific targets. This type of advanced, focused test emulates Tactics, Techniques and Procedures (TTPs) of mature threat actors. The Red Team attempts to remain invisible to the systems’ defenders (known as the Blue Team).

To learn more about Pratum's penetration testing services, contact us today.

The information we track while users are on our websites helps us analyze site traffic, optimize site performance, improve our services, and identify new products and services of interest to our users. To learn more please see our Privacy Policy.