All tabletop exercises
M&A·Advanced·Mixed audience
An inherited intruder found after the acquisition closes
The prompt — read this to the room
Ninety days after closing the purchase of a 500-person engineering firm, your team starts connecting its network to yours. EDR, newly installed on their servers, flags a scheduled task that calls out to an external host every six hours. It has existed since before the deal was announced. The two Active Directory forests already share a trust, and 40 of the firm's admins have accounts in your environment. Integration milestones are tied to executive bonuses. Do you cut the trust today?
Total duration
2 h 30 min
People to involve
7
Best fit
Manufacturing
Who to involve
Most important first.
- Incident response lead
- CISO / Head of security
- IT operations
- SOC analyst
- CIO / CTO
- Legal counsel
- CFO / Finance
What it tests
- Scope an intrusion that spans two environments with different tooling, logging and history
- Decide on containment of the forest trust and shared accounts while weighing integration impact
- Establish whether the intruder has crossed into the parent environment
- Identify the legal levers (warranties, indemnity, notification) that depend on when the intrusion began
Outline of activities
- 1The EDR finding and the first hour of triage
- 2How connected are we: trust, accounts, shared services
- 3The containment decision and its effect on integration
- 4Evidence that the intruder has moved, or has not
- 5Legal and financial follow-through with the sellers
- 6Debrief: a post-close integration security gate
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…