Chapter 30 — Laboratory II | Bachelor's Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 30 — Laboratory II

Lesson map

Lesson 30 published. Map, example, EX088.

flowchart TD
  N0["Learning outcomes"]
  N1["30.1 Exercise design"]
  N2["30.2 Observations"]
  N3["30.3 Improvements"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX088"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["30.1 Exercise design"]
  N2["30.2 Observations"]
  N3["30.3 Improvements"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX088"]

[Learning outcomes]
    |
    v
[30.1 Exercise design]
    |
    v
[30.2 Observations]
    |
    v
[30.3 Improvements]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX088]

Learning outcomes

You will (1) run a tabletop exercise; (2) evaluate response against the plan; (3) record improvements.

30.1 Exercise design

In the second laboratory, Sofia designs a tabletop exercise for Elmfield's managers: ransomware has encrypted the file server on a Monday morning. The scenario unfolds in stages, with new information at each stage. Participants decide what to do using the incident plan. The exercise is announced, uses no real systems and lasts ninety minutes. Sofia prepares injects, such as a call from a journalist and a tenant asking about their data. The journalist call inject tests who may speak publicly, a question the incident plan had not answered.

30.2 Observations

Sofia and a colleague observe. Managers quickly isolate the server but are unsure who decides whether to contact the police and the regulator. The backup restore plan exists but nobody knows where it is stored. Communication with tenants is improvised. The housing system, being a cloud service, keeps running, which reassures everyone. She records each observation with the time and compares actions with the incident plan. The calm reaction to the cloud housing system staying up also reveals how much depends on that supplier.

30.3 Improvements

After the exercise, the group agrees improvements: name the director as decision maker for external notifications, store the restore plan in two places including paper, and prepare template messages for tenants. Sofia records these as actions in the tracker. She learns that tabletop exercises are cheap and safe ways to test plans, and that they often reveal simple gaps, such as a plan nobody can find, that matter enormously in a real incident. Storing the restore plan on paper as well answers the exercise's finding that nobody could locate it.

Worked example

Sofia runs a ransomware tabletop, observes three gaps and records agreed improvements as tracked actions.

Synthetic case. The exercise is synthetic and used no real systems.

Errors and limits

Tabletops do not test technical recovery. Participants may perform for observers.

Exercises

EX088 — Exercise safety. Why does the tabletop use no real systems? Rubric: 3 = to stay safe and avoid disruption;; 2 = safety;; 1 = vague;; 0 = none.
EX089 — Missing plan. What gap concerned the restore plan? Rubric: 3 = nobody knew where it was stored;; 2 = location;; 1 = vague;; 0 = none.
EX090 — Notification decision. Who will decide on external notifications? Rubric: 3 = the director;; 2 = director, hedged with another option;; 1 = IT lead;; 0 = none.

Synthesis

Tabletop exercises safely reveal simple gaps that matter greatly in real incidents.

Continue studying — chapter 30 of 40

← Chapter 29 (draft) · Course chapter index · Chapter 31 (draft) →