An incident response tabletop exercise is a great tool for helping small and medium-sized organizations prepare for cyberattacks or other business disruptions. Developing an incident response plan (IRP) is just one part of a comprehensive cybersecurity strategy; businesses need to test these plans to ensure they work as intended.
By engaging in tabletop exercises, teams enhance existing plans and policies as new risks arise, ensuring employees know what to do during a cybersecurity incident.
Preparing for a Tabletop Exercise
From data breaches to ransomware and data extortion, cybersecurity threats impacted organizations of all sizes across the globe in 2023. The growing variety and sophistication of attacks underscore the importance of a well-defined IRP, and many businesses are taking notice. The growing variety and sophistication of attacks underscore the importance of a well-defined IRP, and many businesses are taking notice.
Devoting adequate resources to cybersecurity is essential, but organizations want to use them wisely. In other words, as cyberattacks become more complex, businesses need insight into how such events may occur. This is where tabletop exercises are invaluable.
Before an organization conducts a tabletop exercise, it should have a well-organized IRP. Each plan has a different structure depending on the organization’s size, mission, and goals, among other considerations.
With an IRP in place, you can prepare for the tabletop exercise. This process includes:
Defining Objectives and Goals
Setting objectives before an incident response tabletop exercise is crucial. Doing so ensures a clear focus on specific scenarios and that participants understand the exercise’s purpose and expected outcomes.
Identifying Tabletop Exercise Participants and Roles
Who participates will depend on the scope of the exercise. For instance, if it’s a company-wide threat, all personnel should be involved. Other tabletop exercises will focus on a specific incident response procedure that one department handles.
Developing a Realistic Scenario
Think of a tabletop exercise as a role-playing game. The presenter names a topic, such as attack vectors or the type of data to protect. They create “what-if” questions about the cybersecurity incident. These questions set the stage for a realistic scenario.
Establishing Ground Rules and Logistics
Ground rules further define the reason for the exercise. They establish the parameters each participant should work within according to their roles and responsibilities.
Conducting the Tabletop Exercise
The personnel facilitating the tabletop exercise will begin with an introduction to discuss the aspects laid out during preparation.
The presentation should explain which component of the incident response lifecycle the activity will center around, such as:
- Preparation
- Identification
- Detection and analysis
- Containment
- Eradication and Recovery
- Post-Incident
Shortly after the exercise, facilitators will hold a “hot wash” (after-action) meeting to discuss what went well and any obstacles participants faced. They will then compare the outcomes to the objectives and gather feedback from all participants. An official after-action report details what was learned, including an updated IRP and best practices to consider moving forward.
Like IRPs, tabletop exercises are subject to industry standards. Organizations should review select ISO standards (22320:2018, 22361:2022, 27035:2011) and the Computer Security Incident Handling Guide from the National Institute of Standards and Technology (NIST) to ensure compliance.
Benefits of Conducting Tabletop Exercises
The primary goal of a tabletop exercise is to enhance the effectiveness of an IRP. They enable organizations to simulate and practice responses to various scenarios, ensuring that teams are well-prepared to handle real incidents effectively. According to the United States Government Accountability Office (GAO), instances of most types of cyberattacks are increasing, along with their cost. These exercises ensure plans account for the various potential threats.
By conducting tabletop exercises, organizations can identify gaps, weaknesses, and areas for improvement in their incident response plans, processes, and communication protocols, allowing for targeted enhancements.
Organizations can also use tabletop exercises to foster collaboration and communication among different teams and stakeholders involved in incident response. This improves coordination during actual incidents, leading to more efficient and effective responses. Additionally, they enable businesses to determine the types of resources they need to support the IRP.
Challenges and Best Practices for Tabletop Exercises
Like creating an IRP, your business may experience obstacles with a tabletop exercise. The following details some mistakes to avoid:
- Not keeping the IRP readily available for all participants during the exercise
- Not having an assigned manager/facilitator to oversee the activity
- Not notifying stakeholders (customers, partners, vendors, law enforcement) about the results and changes to the IRP
- Not having the right people participate in the exercise
It can be difficult to determine where to begin with a tabletop exercise. These best practices help ensure a smoother experience:
- Go over the incident response plan beforehand and ensure every participant understands it
- Give space for every participant to be involved and share their concerns
- Encourage participants to think out loud to facilitate discussion
- Record notes in a shared document that all participants can access
Trust M.A. Polce for Tabletop Exercises
Tabletop exercises increase the effectiveness of incident response plans. They also serve as a frequent reminder for all employees of their roles and responsibilities in achieving cybersecurity. As part of our governance, risk, and compliance services, M.A. Polce offers IR tabletop exercises to help small and midsized businesses improve their incident response processes.
The only way to improve your incident response and plan is to practice. A tabletop exercise allows you to test your capabilities without the stress of a true incident. Success should not be measured as passed or failed but rather measured by improvement.
Get in touch with us today to learn how we can help your organization conduct a tabletop exercise, whether it’s for regulatory compliance or any other reason.
Sources:
https://www.cisecurity.org/insights/white-papers/six-tabletop-exercises-prepare-cybersecurity-team
https://www.techtarget.com/searchsecurity/tip/How-to-conduct-incident-response-tabletop-exercises
https://www.csoonline.com/article/555131/how-to-conduct-a-tabletop-exercise.html
https://www.isaca.org/resources/isaca-journal/issues/2022/volume-1/cybersecurity-incident-response-exercise-guidance
https://www.cisa.gov/sites/default/files/publications/Cybersecurity-Tabletop-Exercise-Tips_508c.pdf
https://www.openpr.com/news/3370584/global-incident-response-market-overview-2033-forecasted
https://www.crn.com/news/security/10-major-cyberattacks-and-data-breaches-in-2023
https://www.crn.com/news/security/gartner-spending-on-cybersecurity-services-is-outpacing-expectations-in-2023
