All tabletop exercises
Physical·Intermediate·Mixed audience
An unescorted stranger is found inside your colocation cage
The prompt — read this to the room
A colocation provider’s night technician calls your on-call engineer at 22:40. He found a man in a high-visibility vest inside your company’s locked cage, holding a laptop with a cable plugged into a top-of-rack switch. The man said he was ‘from the network team’ and left before site security arrived. The front desk logged him following one of your contractors through the entry mantrap two hours earlier. Your cage hosts the card payment platform for 2 million customers. What do you check first, and who do you call?
Total duration
1 h 45 min
People to involve
6
Best fit
Finance, Retail
Who to involve
Most important first.
- Physical security / facilities
- IT operations
- Incident response lead
- CISO / Head of security
- Vendor / procurement manager
- Legal counsel
What it tests
- Scope a possible hands-on network intrusion: what was connected, what could have been reached.
- Get evidence (CCTV, access logs, visitor records) from a provider before it is overwritten.
- Hold the provider and the contractor to their contractual and procedural obligations.
- Decide whether the event triggers card-industry or regulatory notification.
Outline of activities
- 1The call: a stranger in the cage with a laptop on your switch
- 2First steps: the switch, the cage, the evidence
- 3How he got in: mantrap, contractor and provider controls
- 4Was cardholder data at risk? Notification decisions
- 5Fixing escort, cage and port controls
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…