All tabletop exercises
DevSecOps / supply chain·Advanced·Mixed audience
Your signed software update is backdoored and customers have installed it
The prompt — read this to the room
A customer's security team calls your CISO at 07:30. Their EDR flagged your desktop agent, version 9.4.1, released nine days ago and signed with your code-signing certificate, making outbound connections to a domain registered last month. Your engineers confirm the binary contains code that is not in your repository. Telemetry says 3,100 customer organisations have installed 9.4.1, including hospitals and two government agencies. The customer says they will post their findings publicly at noon. Your auto-update service is still offering 9.4.1 right now.
Total duration
2 h 45 min
People to involve
7
Best fit
Saas
Who to involve
Most important first.
- CISO / Head of security
- CEO / Managing director
- Legal counsel
- Developer / DevOps
- Communications / PR
- Customer support
- CIO / CTO
What it tests
- Stop distribution and give customers usable guidance within hours, not days.
- Decide on certificate revocation knowing it may break legitimate installs.
- Coordinate disclosure with an affected customer, government agencies and the public.
- Weigh regulatory and contractual reporting duties, including possible securities disclosure.
Outline of activities
- 1The call: confirm and stop distribution
- 2Customer protection: indicators, guidance and a clean build
- 3The certificate: revoke, re-sign and the fallout
- 4Disclosure: the customer, agencies, regulators and the press
- 5Investigation: how the build was compromised
- 6Trust recovery: what you promise customers next
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…