All tabletop exercises
Third party·Intermediate·Mixed audience
Your help-desk SaaS provider is breached and its tokens into your systems are stolen
The prompt — read this to the room
Your help-desk software provider emails all customers at 18:00: an attacker accessed its production environment and "may have obtained" OAuth tokens that customers granted for integrations. Your instance has integrations with your CRM, your file-sharing platform and your code host, all granted with broad scopes two years ago by someone who has since left. The provider's notice gives no indicators, no timeline and a link to a status page. Your support team has 4,000 open tickets, many with customer attachments. The provider's account manager is not answering.
Total duration
1 h 45 min
People to involve
6
Best fit
Saas, Retail
Who to involve
Most important first.
- Vendor / procurement manager
- CISO / Head of security
- SOC analyst
- Privacy officer / DPO
- Customer support
- Legal counsel
What it tests
- Revoke and re-issue third-party integration tokens fast, knowing what breaks.
- Hunt for use of the provider's tokens in your own logs without waiting for the provider.
- Get useful information from a vendor under pressure, using contract terms where needed.
- Decide whether customer data in tickets is a notifiable breach and who notifies whom.
Outline of activities
- 1The notice: what it says and what it leaves out
- 2Cut the integrations and keep support running
- 3Hunt in your own logs for token use
- 4Working the vendor: questions, contract and escalation
- 5Customer data in tickets: notification analysis
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…