All tabletop exercises
DevSecOps / supply chain·Intermediate·Executive audience
An extortion group posts a sample of your source code
The prompt — read this to the room
A message arrives at your CEO's and general counsel's inboxes: "We have 380 GB of your source code, including your payment service and your infrastructure scripts. Sample attached. Pay 40 BTC in five days or we publish everything and send it to your competitors." The sample is real: three repositories, including commit history and a configuration file with what look like live database credentials. Your code host shows a personal access token belonging to a senior engineer cloned 212 repositories eleven days ago from an unfamiliar country. The board meets in two days.
Total duration
1 h 45 min
People to involve
6
Best fit
Saas, Finance
Who to involve
Most important first.
- CEO / Managing director
- CISO / Head of security
- Legal counsel
- CIO / CTO
- Communications / PR
- Board member
What it tests
- Decide on the extortion demand with a clear rationale, including legal and sanctions constraints.
- Treat secrets found in code as compromised and confirm they are rotated.
- Judge the business impact of the code being public: security, competitive and contractual.
- Prepare a board briefing that separates what is known from what is assumed.
Outline of activities
- 1The demand: verify the claim and its source
- 2Immediate risk: secrets in the code and the token that was used
- 3The decision: pay, negotiate, or refuse
- 4Business impact if it goes public
- 5Board briefing and external communication
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…