Lap 14: Cyber Incident Response Planning and Tabletop exercises

Cyber Incident Response (IR) Planning creates a blueprint for handling breaches, while Tabletop Exercises (TTX) are discussion-based simulations testing that plan, identifying gaps in roles, communication, and procedures (like detecting ransomware or phishing) in a low-pressure environment, making teams familiar with their tasks and improving readiness before a real attack hits.

 

• Preparation: Building tools, policies, and training.
• Detection & Analysis: Identifying and understanding an incident.
• Containment, Eradication & Recovery: Steps to stop the attack, remove threats, and restore systems.
• Post-Incident Activity: Reviewing and improving the process.
• Key Components: Defined roles (IT, Legal, Comms), communication channels, escalation paths, and technical/procedural steps for specific threats like ransomware or phishing.

• Test the Plan: See if the written IRP works in practice.
• Evaluate Readiness: Assess people, processes, and technology performance.
• Identify Gaps: Uncover weaknesses in communication, decision-making, and procedures.
• Build Muscle Memory: Familiarize teams with their roles under stress.
• Improve Collaboration: Strengthen coordination across departments.

• Communicate with your providers. Reach out to your third-party providers, such as your ISP, to ensure you have communication paths established in case you are the victim of a cyber event. 
• Designate a crisis-response team, with main points of contact for a suspected cybersecurity incident and roles/responsibilities, within the organization, including technology, communications, legal and business continuity. 
• Conduct a tabletop exercise, to ensure that all participants understand their roles during an incident. 

1. Plan First: Develop a robust Incident Response Plan (IRP).
2. Simulate: Run a tabletop exercise using a realistic scenario (e.g., ransomware).
3. Discuss: Participants discuss their responses, focusing on "how would we do this?".
4. Analyze: Review the discussion to find weaknesses and missed steps.
5. Refine: Update the IRP and provide targeted training based on findings.