All tabletop exercises
Insider·Advanced·Mixed audience
An employee appears to be selling your VPN access
The prompt — read this to the room
Your threat-intelligence provider sends a screenshot from a criminal forum: a seller offers ‘VPN and Citrix access to a regional insurer, 2,000 staff, domain user, $6,000, insider can stay on for ongoing jobs’. The details match your company. The SOC traces two test logins described in the post to a claims handler’s account, from her home IP address, at times she was not scheduled to work. She is on shift right now. Is she the seller, a victim, or both? Do you lock her out now, or watch to see who buys?
Total duration
2 h 15 min
People to involve
7
Best fit
Insurance, Finance
Who to involve
Most important first.
- CISO / Head of security
- SOC analyst
- Incident response lead
- HR
- Legal counsel
- IT operations
- CEO / Managing director
What it tests
- Decide between immediate containment and controlled monitoring, with the risk of each written down.
- Test whether the employee is the seller, a compromised user, or both, without prejudging.
- Coordinate HR, legal and possible law-enforcement involvement in the right order.
- Find and close the access an access broker’s buyer would use.
Outline of activities
- 1The forum post and the matching logins
- 2Contain now or watch: the decision and its guardrails
- 3Seller, victim or both: building the evidence
- 4The employee conversation and law enforcement
- 5Closing the door: remote access, Citrix and privileges
- 6Lessons for access monitoring and insider risk
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…