All tabletop exercises
Cloud·Intermediate·Mixed audience
A researcher finds your customer exports in a public storage bucket
The prompt — read this to the room
A security researcher emails your support address on a Friday afternoon. They have found a cloud storage bucket, publicly listable, that holds nightly CSV exports from your customer platform: names, email addresses, phone numbers and partial payment details for roughly 210,000 customers in the EU, UK and US. They attach a screenshot of the file list and say they will publish a write-up in seven days. Your cloud team confirms the bucket is yours and was made public eighteen months ago for a one-off analytics project. Access logging on it was never switched on.
Total duration
1 h 45 min
People to involve
6
Best fit
Retail, Saas, Finance
Who to involve
Most important first.
- CISO / Head of security
- Privacy officer / DPO
- Legal counsel
- Cloud engineer
- Communications / PR
- Customer support
What it tests
- Contain the exposure and preserve what evidence exists before anyone changes the bucket further.
- Reach a defensible breach-notification decision when you cannot prove who accessed the data.
- Handle a researcher with a publication deadline constructively, without threats or bribes.
- Assign ownership for storage that outlives the project that created it.
Outline of activities
- 1Triage the researcher's report and confirm what is exposed
- 2Contain and preserve: lock down the bucket, keep what logs exist
- 3Assess risk with no access logs: what can and cannot be known
- 4Decide on notification across jurisdictions and to customers
- 5Respond to the researcher and prepare for publication day
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…