All tabletop exercises
Outage / resilience·Intermediate·Mixed audience
DDoS and an extortion note on the busiest shopping day
The prompt — read this to the room
It is 09:00 on Black Friday at an online homeware retailer that takes 18% of its annual revenue in the next four days. Requests to the checkout API jump to 40 times normal, response times pass ten seconds and the site starts returning errors. An email arrives at the press address: pay 5 bitcoin or the site stays down all weekend. Your CDN has basic DDoS protection, but the checkout API sits outside it on a separate hostname. Marketing has a promotional email going to 3 million customers at 10:00. What do you do in the next hour?
Total duration
1 h 45 min
People to involve
7
Best fit
Retail
Who to involve
Most important first.
- CIO / CTO
- IT operations
- Cloud engineer
- CISO / Head of security
- CFO / Finance
- Communications / PR
- Customer support
What it tests
- Restore checkout capacity using mitigations that can be put in place within the hour.
- Make commercial decisions (the 10:00 email, promotions) with engineering input.
- Handle the extortion demand without engaging or paying on impulse.
- Keep customers and staff informed while the attack continues.
Outline of activities
- 1The attack starts and the demand arrives
- 2Mitigation: CDN, scrubbing, rate limits and the exposed API
- 3The 10:00 email and other commercial calls
- 4The extortion note: report, ignore, respond?
- 5Second wave and stand-down
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…