Third party·Intermediate·Mixed audience

A zero-day in your file-transfer appliance is being mass-exploited

The prompt — read this to the room

A national cyber agency publishes an alert on Thursday evening: a critical, unpatched flaw in the managed file-transfer appliance you use to exchange files with banks, insurers and two government departments is being exploited at scale. The alert lists a web-shell file name and asks organisations to check for it. Your appliance has that file, created four days ago. The appliance holds 30 days of transfers, including claims files with health information. The vendor says a patch is "coming within 48 hours". Your partners start emailing to ask whether you are affected.

Total duration

2 h

People to involve

Best fit

Finance, Healthcare, Public

Who to involve

Most important first.

Incident response lead
IT operations
CISO / Head of security
Privacy officer / DPO
Legal counsel
Communications / PR
SOC analyst

What it tests

Contain an internet-facing appliance with no patch while keeping critical transfers moving.
Determine which files were taken, using appliance, network and partner evidence.
Coordinate answers to partners who may themselves have notification duties.
Work through regulatory timelines for health and financial data across jurisdictions.

Outline of activities

1The alert: confirm compromise on your appliance
2Contain without a patch: isolate, mitigate, keep business moving
3Scope: which files, whose data, which partners
4Partners and regulators: who tells whom, and when
5Rebuild, patch and decide the appliance's future

Run sheet (Pro)

The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.

Loading…