All tabletop exercises
Ransomware·Starter·Technical audience
Friday night encryption with a skeleton crew
The prompt — read this to the room
It is 23:15 on the Friday before a long weekend. The only on-call engineer gets an alert for mass file renames on a file server, then twelve more servers in five minutes. The SOC is outsourced: it has opened a ticket but cannot isolate hosts without written approval. The IT manager is on a flight until 06:00, the CISO is not answering, and the incident response retainer's hotline wants a contract number nobody on shift has. The attacker is still active. Who can authorise isolation right now, and what do you pull first?
Total duration
1 h 15 min
People to involve
4
Best fit
Any sector
Who to involve
Most important first.
- IT operations
- SOC analyst
- Incident response lead
- CISO / Head of security
What it tests
- Confirm who has authority to isolate systems out of hours, and whether it is written down.
- Practise first containment: isolating hosts, disabling accounts and cutting remote access.
- Test the escalation path and whether the retainer can be activated with what is on hand at night.
- Capture the minimum evidence before systems are changed.
Outline of activities
- 1The first alert and the spread
- 2Finding someone with authority
- 3First containment moves
- 4Calling in help
- 5The Saturday morning handover
- 6Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…