All tabletop exercises
Third party·Advanced·Mixed audience
Your managed service provider's remote tool starts pushing scripts to every server
The prompt — read this to the room
At 02:10 on a Sunday your on-call engineer sees the managed service provider's remote-management agent running a PowerShell script on every Windows server at once. The script disables backup agents and the EDR service. Your MSP's emergency line rings out. Their status page is fine. You have the console credentials for your own tenant but not for the MSP's master console, and their agent runs as SYSTEM on 340 servers and 1,200 laptops. Within ten minutes, file servers in two offices begin renaming files. What do you pull first?
Total duration
2 h 30 min
People to involve
7
Best fit
Manufacturing, Healthcare, Public
Who to involve
Most important first.
- Incident response lead
- IT operations
- CISO / Head of security
- Vendor / procurement manager
- CIO / CTO
- Legal counsel
- SOC analyst
What it tests
- Cut a trusted third party's access at the network and agent level in minutes.
- Run an incident when the vendor you rely on for operations is part of the problem.
- Recover from backups whose agents the attacker tried to disable.
- Rework the MSP contract and access model: break-glass, least privilege and logging you own.
Outline of activities
- 1The script: recognising a trusted channel turned hostile
- 2Severing the MSP: agents, VPN, accounts and network paths
- 3Containing encryption and protecting backups
- 4Running without your MSP, and working with them when they appear
- 5Recovery sequencing and restoring trust
- 6Contract and architecture changes
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…