All tabletop exercises
Identity·Intermediate·Executive audience
Do we switch off single sign-on?
The prompt — read this to the room
Your incident response firm believes the attacker who compromised your identity provider can still get back in, but cannot yet prove how. Their recommendation: take single sign-on offline for all 3,000 staff for up to 24 hours from 18:00 tonight while they rebuild trust. That means no email, no CRM, no payroll system, no ticketing and no remote access. Sales has a quarter-end close in two days. Customers know nothing yet. The CEO wants a decision from the room by 17:00. What do you decide, and what are you accepting by deciding it?
Total duration
1 h 30 min
People to involve
7
Best fit
Saas
Who to involve
Most important first.
- CEO / Managing director
- CIO / CTO
- CISO / Head of security
- CFO / Finance
- Communications / PR
- Legal counsel
- HR
What it tests
- Weigh business disruption against continued attacker access when the evidence is incomplete.
- Set out the alternatives to a full shutdown and the residual risk of each.
- Agree how the company works and communicates during a planned identity outage.
- Record the decision, its owner and the conditions for reversing it.
Outline of activities
- 1The recommendation and the evidence behind it
- 2Options short of a full shutdown
- 3The 17:00 decision
- 4Running the business without single sign-on
- 5Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…