All tabletop exercises
Identity·Advanced·Technical audience
From one phished admin to a cloud data breach
The prompt — read this to the room
At 02:15 a help-desk agent reset MFA for a cloud administrator after a convincing phone call. By 03:00 the attacker had registered a new device, created an access key in your production cloud account and disabled two logging trails. By 05:30, 3 TB had left a storage bucket holding customer documents. Your SOC sees an impossible-travel alert at 07:50. The identity, cloud and data teams each hold part of the picture, and each believes someone else is containing it.
Total duration
3 h
People to involve
7
Best fit
Saas, Finance
Who to involve
Most important first.
- Incident response lead
- SOC analyst
- Cloud engineer
- IT operations
- CISO / Head of security
- Privacy officer / DPO
- Developer / DevOps
What it tests
- Establish a single incident command across identity, cloud and data teams within the first hour
- Contain in the right order: sessions and credentials, then cloud keys and roles, then data paths
- Reconstruct the attack timeline despite disabled logging, using alternative evidence sources
- Hand the business a defensible statement of what data left and when
Outline of activities
- 1The alert and the first 30 minutes: who owns this
- 2Identity containment: the help-desk reset, devices, tokens
- 3Cloud containment: keys, roles, persistence and the disabled trails
- 4Data impact: what left the bucket and how you know
- 5Hardening before handover: closing the help-desk path
- 6Debrief: the seams between teams
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…