All tabletop exercises
Cloud·Advanced·Mixed audience
Your cloud region goes down in the middle of an intrusion
The prompt — read this to the room
Your team has spent six hours on an active intrusion in production: an attacker with a stolen engineer session is moving between services, and you are close to cutting them off. At 16:05 your cloud provider posts a major incident for your primary region. Half your services are unreachable, including the logging pipeline and the identity console you were using to contain the attacker. Customers are calling. Your disaster-recovery runbook says to fail over to the secondary region, which is built from the same templates and secrets the attacker may have already read. Do you fail over?
Total duration
2 h 30 min
People to involve
7
Best fit
Saas, Finance, Retail
Who to involve
Most important first.
- Incident response lead
- CIO / CTO
- Cloud engineer
- CISO / Head of security
- CEO / Managing director
- Communications / PR
- SOC analyst
What it tests
- Make a fail-over decision that weighs availability against carrying the intruder into a clean region.
- Keep incident command working when your own tooling and visibility are degraded.
- Communicate an outage honestly without disclosing an unconfirmed security incident prematurely.
- Find the single points of failure shared by your security tooling and production.
Outline of activities
- 1Two incidents at once: who commands what
- 2Lost visibility: what you can still see and do
- 3The fail-over decision: clean region or contaminated copy
- 4Customer and executive communication under two narratives
- 5Recovery and re-establishing containment when the region returns
- 6Resilience gaps in security tooling
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…