All tabletop exercises
Network·Advanced·Mixed audience
Espionage discovered eight months after it began
The prompt — read this to the room
A government agency privately tells your aerospace components firm that an intruder linked to a foreign intelligence service has been in your engineering network for about eight months. They share three indicators and ask you not to tip off the attacker. Your logs go back 90 days. The intruder appears to use legitimate admin tools rather than malware. Your largest customer is a defence prime with contractual reporting duties. Do you watch, or evict? And what do you tell anyone?
Total duration
2 h 30 min
People to involve
7
Best fit
Manufacturing, Public
Who to involve
Most important first.
- CISO / Head of security
- Incident response lead
- SOC analyst
- Legal counsel
- CEO / Managing director
- IT operations
- Board member
What it tests
- Hunt for a living-off-the-land intruder with limited historical telemetry, without alerting them
- Decide between monitoring and eviction, with criteria for switching and a planned eviction day
- Meet contractual and regulatory reporting duties while honouring the agency's request
- Estimate what intellectual property was likely taken and brief leadership on long-term impact
Outline of activities
- 1The agency briefing and the three indicators
- 2Quiet hunting: what to look at without tipping off the intruder
- 3Watch or evict: the decision and its conditions
- 4Reporting duties to the customer and others
- 5Planning a coordinated eviction day
- 6Debrief: logging, retention and the next eight months
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…