All tabletop exercises
DevSecOps / supply chain·Intermediate·Technical audience
The build output does not match the source
The prompt — read this to the room
A release engineer runs a reproducible-build check on tomorrow's release and it fails: the compiled agent your customers install on 40,000 endpoints contains a 3 KB block that is not in any commit. Rebuilding on a clean machine gives a different hash. The build server's scheduled tasks include a script nobody recognises, created five weeks ago. Your last two releases came off the same server and are already in customers' hands. Release is scheduled for 09:00 tomorrow and the sales team has promised the new version to your largest customer.
Total duration
2 h
People to involve
5
Best fit
Saas, Manufacturing
Who to involve
Most important first.
- Developer / DevOps
- Incident response lead
- CISO / Head of security
- SOC analyst
- CIO / CTO
What it tests
- Stop the release and preserve the build server as evidence without tipping off the intruder.
- Determine whether the two earlier releases were also tampered with, and how to prove it.
- Rebuild a trusted pipeline from known-good sources and keys.
- Decide what the business needs to know before 09:00 and who decides on customer notice.
Outline of activities
- 1The failed check: real tampering or a broken build
- 2Hold the release and preserve the build environment
- 3Scope back in time: were earlier releases affected
- 4Rebuild trust: clean builders, keys and provenance
- 5Escalation: what goes to executives before morning
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…