How to Build an Effective Cyber Tabletop Exercise

<img src="https://bomberbot.com/news/content/images/size/w2000/2022/11/pexels-fauxels-3183197.jpg"
alt="Group of business professionals having a discussion"
width="2000" height="1335">

Why Conduct a Cybersecurity Tabletop Exercise?

With cyber attacks on the rise and costing companies millions in losses, it‘s more important than ever to prepare your organization to effectively respond to a potential incident. One of the best ways to do this is by conducting a cybersecurity tabletop exercise (TTX).

A tabletop exercise is essentially a guided walkthrough of a simulated cyber incident. Participants, which usually include representatives from IT, security, legal, HR, PR, and executive leadership, are presented with a hypothetical scenario and talk through how they would respond at each stage. The goal is to assess the organization‘s incident response plan, clarify roles and decision-making processes, and identify areas for improvement.

The main benefits of conducting regular TTXs include:

• Developing a better understanding of the business impact of a cyber incident
• Maintaining stakeholder confidence through proactive preparation
• Clarifying responsibilities and streamlining communication
• Assessing the efficacy of your current response capabilities
• Uncovering gaps in processes, documentation, and training

Essential Components of an Effective Tabletop Exercise

While the specific objectives and format of a TTX can vary, there are several key elements needed to ensure an impactful and valuable exercise:

An Established Incident Response Plan

Without a documented incident response plan outlining roles, responsibilities, communication protocols, and technical procedures, your TTX will likely devolve into chaos. The point is to test your IR plan, not create one from scratch. Be sure to distribute the plan to all participants ahead of the exercise.

Recent Risk Assessment Findings

To create a relevant scenario, you need to understand what threats and vulnerabilities pose the highest risk to your organization. A risk assessment helps identify critical assets, likely attack vectors, and potential business impacts to incorporate into your TTX. If you don‘t already have a current risk assessment, performing at least an informal analysis is an important precursor to the exercise.

Clearly Defined Objectives

What do you want to achieve with this particular TTX? Vague goals like "improve security" aren‘t helpful. Effective TTXs have specific learning objectives such as testing the escalation process, evaluating the efficacy of backup systems, or assessing cross-functional coordination. Let your objectives guide the scenario design.

Active Executive Participation

Tabletop exercises are only truly valuable if senior leadership is bought in and willing to dedicate time and resources to the effort. Their participation is essential for assessing high-level decision making, addressing cross-functional challenges, and driving post-exercise improvements. Be sure to secure their commitment well in advance and align on objectives.

A Skilled Facilitator

Keeping participants engaged and the exercise on track requires a strong facilitator. This person is responsible for presenting the scenario, introducing new information at key points, posing questions to the group, and ensuring active participation. They need to strike a balance between allowing open discussion and keeping things focused on the objectives. A third-party expert can be helpful in this role to provide an outside perspective.

Anatomy of a Tabletop Exercise

With the essential components in place, let‘s walk through what an actual TTX looks like.

Designing the Scenario

An engaging and realistic scenario is the cornerstone of an impactful exercise. Rather than presenting the entire scenario upfront, information is typically revealed in phases as the "story" evolves.

To build your scenario, consider questions like:

• Who is the attacker and what is their motivation?
• How are they most likely to infiltrate your environment?
• What might tip off your security team that an incident is occurring?
• How could the incident escalate or spread if undetected?
• What technical challenges would responders face in each phase?
• What business functions could be impacted as the incident progresses?

Weave in relevant details pulled from your risk assessment, penetration testing results, previous incidents, and threat intelligence. The scenario should ultimately align with your predefined objectives. For example, if you want to test your backup systems, include an attack that threatens data availability.

Avoid making the scenario overly complex or extreme – the goal is to be realistic and focus on the response, not get bogged down in debating technicalities. As a general guideline, limit the scenario to 2-4 injects (new pieces of information) revealed through a mix of emails, memos, mock news reports, or phone calls.

Facilitating the Discussion

With the scenario outlined, it‘s time to bring in your participants. TTXs typically work best as half-day events held in-person if possible. After reviewing the objectives and ground rules, the facilitator kicks things off by revealing the initial scenario details.

At each phase, participants assess the new information presented, consider the organizational implications, and talk through how they would respond per their incident response plan. The facilitator should have a list of key discussion points and questions to work in throughout the exercise, such as:

• What security systems or controls could help detect or prevent this threat?
• Who would be involved in responding at this stage and how would they coordinate?
• What communication needs to happen internally and externally?
• Are there any legal or regulatory requirements to consider?
• How would we validate the scope and severity of the incident?
• What are the decision points and who has the authority to make the call?
• What steps can we take to contain the damage?
• When and how would we involve outside parties like law enforcement or legal counsel?

Encourage active participation from all attendees and be sure to call out any inconsistencies or gaps as they emerge. The point is to put the incident response plan to the test and identify areas for improvement.

Conducting the Post-Mortem

Immediately following the exercise, gather the participants together for a "hotwash" – a quick debrief to capture initial reactions and high-level takeaways while the experience is still fresh. What went well? What needs work? Have each person share their top lesson learned.

Over the next few weeks, the facilitator and core team should thoroughly review the notes and observations from the exercise to extract deeper insights and recommendations. Common lessons learned could include:

• Enhance cross-training so there are no single points of failure
• Expand system redundancy and validate failover procedures
• Implement an up-to-date asset inventory to streamline scoping
• Update the IR plan with clearer decision trees and comms templates
• Schedule follow-on training on reporting requirements
• Establish formal information sharing channels with peer organizations

Compile the lessons learned into a report for leadership, prioritizing the items with the highest risk reduction potential. Assign clear owners and due dates to create accountability and momentum. Remember, the value of the exercise is in applying what you learned to level up your cyber resilience.

Tips for a Valuable and Engaging TTX

• Choose a scenario that feels authentic to your organization and industry
• Incorporate visuals, data samples, and other artifacts to build immersion
• Invite active participation by going around the room to solicit input
• Allow some flexibility for tangents while keeping an eye on the clock
• Use breakout groups for specific technical discussions as needed
• Gamify the exercise with a "score" based on key decisions and outcomes
• Document everything and socialize the insights to reinforce the lessons
• Conduct TTXs regularly to gauge progress and adapt to emerging threats

With robust planning and skilled facilitation, tabletop exercises are a powerful tool for assessing and improving your organization‘s cyber incident response capabilities. Don‘t wait for a real attack to put your people and processes to the test.

For more guidance and ideas, check out the DHS Tabletop Exercise Packages and NIST‘s Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities.