All tabletop exercises
Third party·Intermediate·Mixed audience
An attacker in your supplier portal changes bank details and plants files
The prompt — read this to the room
Accounts payable at your industrial equipment manufacturer pays $860,000 to a long-standing steel supplier, and three days later the supplier asks where its money is. The bank details on file were changed through your supplier self-service portal two weeks ago, by a login using the supplier's own account. The same account uploaded six updated 'drawing packages' that your design engineers have since opened. Two other suppliers report odd password-reset emails from your portal. The portal is run by a SaaS vendor your procurement team chose. What do you check, freeze and tell suppliers today?
Total duration
1 h 45 min
People to involve
6
Best fit
Manufacturing
Who to involve
Most important first.
- Vendor / procurement manager
- CISO / Head of security
- CFO / Finance
- SOC analyst
- IT operations
- Legal counsel
What it tests
- Stop further payment-detail changes and start fund recovery
- Determine where the supplier account was compromised: your portal, the SaaS vendor or the supplier's side
- Assess and contain the uploaded files on engineering workstations
- Notify suppliers and work out liability with the SaaS vendor and the supplier
Outline of activities
- 1The missing payment
- 2Freeze: payments, portal changes, files
- 3Where was the account compromised?
- 4Suspicious drawings on engineering machines
- 5Supplier notice, recovery and liability
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…
More third party exercises
- Your help-desk SaaS provider is breached and its tokens into your systems are stolen1 h 45 min · Intermediate · Mixed
- Your managed service provider's remote tool starts pushing scripts to every server2 h 30 min · Advanced · Mixed
- Your payroll provider goes down two days before payday1 h 15 min · Starter · Executive