1 00:00:00,000 --> 00:00:03,960 You found the backup wrap up your go-to podcast for all things 2 00:00:03,960 --> 00:00:06,210 backup recovery and cyber recovery. 3 00:00:06,539 --> 00:00:10,619 In this episode, we'll explore the critical role that tabletop exercises 4 00:00:10,619 --> 00:00:13,290 play when preparing for cyber incidents. 5 00:00:13,619 --> 00:00:18,600 Our guest, Mike Sailor, CEO of Black Swan Security, shares his expertise 6 00:00:18,809 --> 00:00:22,470 on how to effectively plan, execute, and learn from these activities. 7 00:00:22,809 --> 00:00:27,040 We discussed the key components of a successful tabletop exercise, 8 00:00:27,309 --> 00:00:31,719 common pitfalls, and why regular practice is essential for building 9 00:00:31,719 --> 00:00:33,339 organizational resilience. 10 00:00:33,639 --> 00:00:37,719 He also has a few great stories from exercises that he's conducted. 11 00:00:37,960 --> 00:00:40,120 I think you'll find this episode quite useful. 12 00:00:40,870 --> 00:00:40,900 I. 13 00:00:40,900 --> 00:00:41,055 And enjoyable. 14 00:00:41,474 --> 00:00:45,434 By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr. 15 00:00:45,434 --> 00:00:49,665 Backup, and I've been passionate about backup and recovery for over 30 years. 16 00:00:49,874 --> 00:00:50,415 Ever since. 17 00:00:50,415 --> 00:00:53,834 I had to tell my boss that we had no backups of the production 18 00:00:53,834 --> 00:00:55,275 database that we just lost. 19 00:00:55,665 --> 00:00:58,274 I don't want that to happen to you, and that's why I do this. 20 00:00:58,605 --> 00:01:04,035 On this podcast, we turn unappreciated backup admins into Cyber Recovery Heroes. 21 00:01:04,334 --> 00:01:06,315 This is the backup wrap up. 22 00:01:21,799 --> 00:01:22,889 Welcome to the show. 23 00:01:23,846 --> 00:01:27,296 If I could ask you to take just a quick second and press, subscribe 24 00:01:27,296 --> 00:01:31,166 or follow so that you'll always get this content, that would be great. 25 00:01:31,826 --> 00:01:32,816 I am w Curtis. 26 00:01:33,476 --> 00:01:33,896 What? 27 00:01:34,406 --> 00:01:35,036 Oh, yes, 28 00:01:35,051 --> 00:01:35,711 us a comment. 29 00:01:35,756 --> 00:01:35,996 yes. 30 00:01:35,996 --> 00:01:36,926 Leave us a comment. 31 00:01:36,926 --> 00:01:37,976 We love comments. 32 00:01:38,516 --> 00:01:41,726 Um, I'm w Curtis Presson, AKA, Mr. 33 00:01:41,726 --> 00:01:48,006 Backup with me, my vicarious movie watcher Prasanna Malaiyandi. 34 00:01:48,026 --> 00:01:48,476 How's it going? 35 00:01:48,476 --> 00:01:48,936 Prasanna. 36 00:01:49,946 --> 00:01:51,116 I am good Curtis. 37 00:01:51,956 --> 00:01:57,206 I, yeah, I would say I am a vicarious movie watcher, but sometimes I do 38 00:01:57,206 --> 00:02:01,556 watch movies, but they're just like the Bollywood and Hollywood movies, not 39 00:02:02,096 --> 00:02:07,061 Would, would, would you agree that you watch fewer movies than me? 40 00:02:09,041 --> 00:02:12,956 Um, I think that's a statement for the entire world that would be factually 41 00:02:12,976 --> 00:02:13,096 I. 42 00:02:14,831 --> 00:02:19,541 Well, just because I watched three movies yesterday, two at two at the, uh, 43 00:02:19,601 --> 00:02:22,151 at the theaters and, uh, one at home. 44 00:02:23,351 --> 00:02:24,971 Uh, yeah, that's totally fine. 45 00:02:24,971 --> 00:02:25,601 That's normal. 46 00:02:25,661 --> 00:02:28,511 And because I watched Deadpool twice this weekend. 47 00:02:30,011 --> 00:02:35,831 See, I have never met someone who falls asleep at movies so much 48 00:02:37,691 --> 00:02:39,311 Okay, we're not talking about that. 49 00:02:39,371 --> 00:02:40,481 We're not talking about that. 50 00:02:40,751 --> 00:02:44,471 The fact that I had to go back to see Deadpool twice for two reasons. 51 00:02:44,471 --> 00:02:49,271 One that I really enjoyed it the first time and second to figure out what I 52 00:02:49,271 --> 00:02:51,071 missed when I dozed off in the middle. 53 00:02:52,451 --> 00:02:55,121 Dosed off and you didn't even realize you dosed off either. 54 00:02:55,211 --> 00:02:58,361 yeah, I didn't even realize I dozed off till I was watching it the second time 55 00:02:58,361 --> 00:03:00,941 and going, uh, I don't remember this part. 56 00:03:01,601 --> 00:03:03,611 Uh, it makes a lot more sense now. 57 00:03:03,611 --> 00:03:07,481 Well, we should probably get to our actual topic here. 58 00:03:07,841 --> 00:03:12,431 Uh, we once again have the CEO of Black Swan Security. 59 00:03:12,881 --> 00:03:14,021 Mike Sailor. 60 00:03:14,021 --> 00:03:14,981 How's it going, Mike? 61 00:03:16,526 --> 00:03:17,306 It's going well guys. 62 00:03:17,306 --> 00:03:17,486 How are. 63 00:03:18,626 --> 00:03:22,946 Mike, I wanted to talk, uh, you know, we're, you know, in our continuing series 64 00:03:22,946 --> 00:03:30,926 here on, uh, basically preparing for, you know, defeating ransomware, uh. 65 00:03:31,526 --> 00:03:34,766 You know, being able to respond to it effectively. 66 00:03:35,246 --> 00:03:42,116 And one of the topics that comes up a lot, it came up in our last recording, is 67 00:03:42,116 --> 00:03:46,436 this idea of a, uh, a tabletop exercise. 68 00:03:46,976 --> 00:03:52,886 And we, we talk a lot about that a lot, and I know that. 69 00:03:53,291 --> 00:03:57,791 Back when, at my previous employer, when we started showing people what an 70 00:03:57,791 --> 00:04:03,491 actual tabletop exercise looks like, they got really excited because I don't 71 00:04:03,491 --> 00:04:06,431 think that a lot of people do this. 72 00:04:06,611 --> 00:04:13,421 Um, I mean, when, when, when your company's brought in, I'm assuming that 73 00:04:13,601 --> 00:04:15,581 these, well, well, lemme ask you this. 74 00:04:16,511 --> 00:04:19,931 What percentage of the time are you brought in because there's 75 00:04:20,081 --> 00:04:21,971 already been a cybersecurity event. 76 00:04:24,701 --> 00:04:27,701 It is more often than people call us to do a tabletop. 77 00:04:29,336 --> 00:04:30,026 Say that again. 78 00:04:31,331 --> 00:04:33,641 We respond to incidents for 79 00:04:33,866 --> 00:04:33,956 Right, 80 00:04:34,181 --> 00:04:35,201 on their worst day, 81 00:04:35,971 --> 00:04:36,321 right. 82 00:04:37,571 --> 00:04:42,106 in helping them through tabletop exercises for their worst 83 00:04:42,121 --> 00:04:42,411 Okay. 84 00:04:43,166 --> 00:04:43,496 Right. 85 00:04:43,496 --> 00:04:46,496 So you're normally, you're called for the worst day. 86 00:04:46,976 --> 00:04:48,866 You, you wish you were called. 87 00:04:49,241 --> 00:04:50,651 For the practice day. 88 00:04:51,311 --> 00:04:52,061 Um, 89 00:04:52,601 --> 00:04:52,661 Yeah. 90 00:04:52,931 --> 00:04:57,221 and I, I, I wonder just Prasanna, what do you think, like, like what 91 00:04:57,221 --> 00:05:03,641 percentage of companies actually do a, a tabletop exercise like this? 92 00:05:05,271 --> 00:05:06,141 So I. 93 00:05:07,826 --> 00:05:13,736 I am hoping, and I'm being gonna be, gonna be optimistic and say that 94 00:05:13,766 --> 00:05:23,126 probably at least 70% of companies do a tabletop exercise in some part of their 95 00:05:23,126 --> 00:05:26,996 organization, and it may not be a formal tabletop exercise doing everything end 96 00:05:26,996 --> 00:05:31,256 to end, but they do some form of what could be considered a tabletop exercise. 97 00:05:32,081 --> 00:05:33,191 But, okay. 98 00:05:33,221 --> 00:05:36,701 So I should have specified a tabletop exercise for the 99 00:05:36,701 --> 00:05:38,501 purposes of cybersecurity. 100 00:05:39,641 --> 00:05:40,541 What do you think? 101 00:05:40,586 --> 00:05:41,066 Yeah. 102 00:05:41,186 --> 00:05:42,896 Yeah, I would probably say 103 00:05:44,741 --> 00:05:48,821 Yeah, I think, I think you're being generous, but our listeners 104 00:05:48,821 --> 00:05:50,141 are better than the average. 105 00:05:50,171 --> 00:05:54,311 Our listeners are above average, and this is why they're listening to the show. 106 00:05:54,791 --> 00:06:00,491 Uh, so, uh, let's just start from the beginning, Mike. 107 00:06:01,841 --> 00:06:04,901 If somebody wanted to, they've, they've heard, they've heard that they should be 108 00:06:04,901 --> 00:06:10,961 doing tabletop exercises for the purposes of being able to successfully respond to 109 00:06:11,231 --> 00:06:13,151 a cybersecurity event, a ransomware event. 110 00:06:13,841 --> 00:06:18,641 What's the first thing that they should be, uh, doing if they wanna do this? 111 00:06:18,851 --> 00:06:19,181 What, 112 00:06:19,331 --> 00:06:19,991 you get there, 113 00:06:20,141 --> 00:06:20,561 yeah. 114 00:06:20,741 --> 00:06:22,721 define what a tabletop exercise is? 115 00:06:22,961 --> 00:06:23,351 Yeah. 116 00:06:23,381 --> 00:06:23,891 Okay. 117 00:06:23,921 --> 00:06:24,726 That sounds good. 118 00:06:25,301 --> 00:06:30,131 Uh, so, so basically it's a, it's a prac, it's a practice run, right? 119 00:06:30,131 --> 00:06:34,781 It's a practice run where you sit out there and you, you, you, well, 120 00:06:34,781 --> 00:06:37,571 we're gonna define all the things that go into it, but basically you're 121 00:06:37,571 --> 00:06:39,911 sitting around a table talking about. 122 00:06:40,646 --> 00:06:48,086 This fake event that may happen to you at some point, and you basically 123 00:06:48,086 --> 00:06:53,186 talk through, it's like, uh, you know what, um, to go back to movies. 124 00:06:53,186 --> 00:06:55,256 It's like a table read, right? 125 00:06:55,316 --> 00:06:57,506 Uh, you know, you're, you're film. 126 00:06:57,506 --> 00:06:58,406 what a table read is 127 00:06:58,511 --> 00:06:59,261 Oh, shut up. 128 00:06:59,441 --> 00:06:59,801 Oh, come. 129 00:06:59,801 --> 00:07:00,191 Okay. 130 00:07:00,191 --> 00:07:00,551 All right. 131 00:07:00,761 --> 00:07:03,761 A table read is where they get the script for the first time and they 132 00:07:03,761 --> 00:07:07,541 all sit around a table and they just go through and read all the lines. 133 00:07:07,541 --> 00:07:09,101 They don't, they don't act out anything. 134 00:07:09,131 --> 00:07:10,181 They don't actually do the thing. 135 00:07:10,421 --> 00:07:16,001 So it's like a table read, but for, um, yeah, I watch too much movies. 136 00:07:16,541 --> 00:07:20,951 Um, so how, how, how's that for a, a definition, Mike? 137 00:07:22,346 --> 00:07:22,976 It's pretty good. 138 00:07:23,036 --> 00:07:27,506 And I think a good comparison would be, you know, uh, more of a simulation, 139 00:07:27,506 --> 00:07:31,946 like a, a crisis or disaster simulation where there's, you got actors out in 140 00:07:31,946 --> 00:07:36,026 the field and they've got the, the fake, you know, trauma, blood and makeup on, 141 00:07:36,026 --> 00:07:39,896 and people are actually like physically interacting, going out and getting 142 00:07:39,896 --> 00:07:44,096 victims and bringing back, triaging, wrapping 'em up, you know, assessing 143 00:07:44,096 --> 00:07:45,326 them and, and that kind of thing. 144 00:07:45,326 --> 00:07:48,056 That's more of a, a true simulation. 145 00:07:48,546 --> 00:07:48,866 Right. 146 00:07:49,091 --> 00:07:55,061 a tabletop to your, to your comparison to a, a a, a script review. 147 00:07:55,061 --> 00:08:01,001 It's, it's, you're, you're reading from a, a manual, from a script, uh, in 148 00:08:01,001 --> 00:08:03,791 the same room, uh, kind of stationary. 149 00:08:04,351 --> 00:08:04,701 Right, 150 00:08:04,841 --> 00:08:10,121 to apply some, some level of imagination, as you go through the script. 151 00:08:10,301 --> 00:08:10,961 Um, 152 00:08:10,976 --> 00:08:11,066 right. 153 00:08:11,201 --> 00:08:15,311 but yeah, it's table tabletop because you, you, you're all at the 154 00:08:15,311 --> 00:08:16,991 same table or, or virtually at the 155 00:08:17,186 --> 00:08:17,906 hence the name. 156 00:08:17,996 --> 00:08:18,626 Hence the name. 157 00:08:19,676 --> 00:08:20,996 Uh, so good by the way. 158 00:08:20,996 --> 00:08:22,326 Good job Prasanna. 159 00:08:22,501 --> 00:08:23,546 I, I always, 160 00:08:23,856 --> 00:08:24,936 That's why you keep me around. 161 00:08:25,076 --> 00:08:28,496 I always forget to define stuff, so, all right. 162 00:08:28,496 --> 00:08:32,186 So what, so back to my question before I was so rudely interrupted. 163 00:08:32,816 --> 00:08:38,906 Um, what, so if, if we're thinking about doing this, what's the first 164 00:08:38,906 --> 00:08:40,196 thing that we should be doing? 165 00:08:42,656 --> 00:08:46,316 Well, in addition to understanding the, the difference between a tabletop 166 00:08:46,316 --> 00:08:50,156 and a simulation, understanding the, the kind of categorically what are the 167 00:08:50,156 --> 00:08:54,566 different parts of a tabletop, uh, and there's, there's really kind of five. 168 00:08:54,566 --> 00:08:55,136 There's the, the. 169 00:08:56,171 --> 00:09:00,731 Preparation, the planning, the execution, the review, and then the remediation. 170 00:09:01,661 --> 00:09:04,691 and so the preparation part, you, you wanna make sure that 171 00:09:05,021 --> 00:09:07,541 you've kind of got your ducks in a row before you go to the pond. 172 00:09:08,201 --> 00:09:11,801 Uh, and so just jumping into a tabletop, let's do one tomorrow. 173 00:09:11,831 --> 00:09:16,211 You wanna make the, it's not as, it's not gonna be as valuable as if you've done the 174 00:09:16,541 --> 00:09:19,211 analysis of, are we ready for a tabletop? 175 00:09:20,156 --> 00:09:24,746 And when you talk about cyber, cyber, cyber, tabletop exercises are related 176 00:09:24,746 --> 00:09:29,066 to cyber incidents like ransomware or denial of service attacks, or the theft 177 00:09:29,066 --> 00:09:33,656 of intellectual property or, uh, you know, employee misconduct type of thing. 178 00:09:34,226 --> 00:09:36,776 All right, so what, what do we have in place? 179 00:09:37,976 --> 00:09:41,396 As far as procedures and incident response plan, do we, do we know who the 180 00:09:41,396 --> 00:09:44,276 key smart people effective people are? 181 00:09:44,276 --> 00:09:48,566 Do we know management's expectations for communication and escalation? 182 00:09:48,566 --> 00:09:52,406 Do we have management's blessing to have the authority to respond to this incident? 183 00:09:52,406 --> 00:09:53,576 And who's gonna be in charge? 184 00:09:53,576 --> 00:09:58,586 And so there's this, the litany of, are we even prepared to do a tabletop? 185 00:09:59,396 --> 00:10:00,116 So that's the. 186 00:10:00,566 --> 00:10:00,856 Yeah. 187 00:10:00,946 --> 00:10:04,276 and for the prepared one too, Mike, I guess one of the things 188 00:10:04,276 --> 00:10:06,826 is like doing a tabletop exercise. 189 00:10:07,066 --> 00:10:09,736 You want it to be valuable, but it could potentially also be. 190 00:10:10,601 --> 00:10:12,401 Expensive, quote, unquote, expensive, right? 191 00:10:12,401 --> 00:10:15,011 Just because the number of people you're pulling in, who you're 192 00:10:15,011 --> 00:10:18,791 pulling from their normal daily jobs, right, to do this exercise. 193 00:10:18,791 --> 00:10:22,091 So you don't want it to just be like a waste of time for everyone. 194 00:10:23,246 --> 00:10:23,606 Agreed. 195 00:10:24,011 --> 00:10:26,681 Yeah, I, I, I, well, let me ask you this. 196 00:10:26,681 --> 00:10:27,431 Let me, let me. 197 00:10:28,376 --> 00:10:31,166 Let me argue with you and tell me why I'm wrong and that's okay. 198 00:10:31,406 --> 00:10:37,976 Um, what if the purpose of this tabletop exercise is to show just 199 00:10:37,976 --> 00:10:44,606 how badly we are prepared, uh, or poorly, just how poorly we are prepared 200 00:10:44,966 --> 00:10:46,646 for, for a cybersecurity event. 201 00:10:47,096 --> 00:10:49,796 Um, there could be some value in that. 202 00:10:49,916 --> 00:10:53,726 It might be highly demoralizing and I agree that, that, you 203 00:10:53,726 --> 00:10:55,496 know, Prasanna, it would be, um. 204 00:10:56,516 --> 00:10:57,026 Expense. 205 00:10:57,026 --> 00:10:58,736 There is a cost associated with it. 206 00:10:59,186 --> 00:11:00,891 Uh, what, what do you think of that, Mike? 207 00:11:02,606 --> 00:11:08,336 I've only seen that as, as a successful tactic one time in like 14 years. 208 00:11:08,786 --> 00:11:13,706 Uh, and the reason for that is, you know, if, if you're the, the technology. 209 00:11:15,026 --> 00:11:18,686 or the security executive, and your job is to protect the company and make sure 210 00:11:18,686 --> 00:11:23,696 things can continue operation in the face or as a result of an incident or disaster. 211 00:11:25,916 --> 00:11:30,536 let's say you've been asking for budget and resources for years and you're 212 00:11:30,536 --> 00:11:32,006 not getting it for whatever reason. 213 00:11:32,006 --> 00:11:36,026 So hey, let's do a tabletop to show the magnitude of deficiency 214 00:11:36,116 --> 00:11:38,186 that we are are currently in 215 00:11:38,336 --> 00:11:38,726 Right. 216 00:11:38,786 --> 00:11:40,046 management can. 217 00:11:40,511 --> 00:11:42,251 Can see that we, we need the help. 218 00:11:43,181 --> 00:11:46,121 what that does then is it documents your deficiency. 219 00:11:46,556 --> 00:11:46,946 Mm-Hmm. 220 00:11:46,961 --> 00:11:47,441 now 221 00:11:47,611 --> 00:11:47,671 to 222 00:11:47,711 --> 00:11:52,451 discoverable, it's, it's also discoverable if you have an event and you get sued. 223 00:11:52,841 --> 00:12:00,491 Um, but also politically, don't know of many, uh, many technology or security 224 00:12:00,491 --> 00:12:04,091 executives that wanna put themselves in that position of documented failure. 225 00:12:05,231 --> 00:12:09,551 and management is gonna see that as, oh, you're just trying to get leverage. 226 00:12:10,316 --> 00:12:12,506 So it, politically it's a bad move. 227 00:12:13,286 --> 00:12:16,406 I've only seen it, successful one time. 228 00:12:16,646 --> 00:12:20,636 Um, and that was a pretty unique situation where the, the management 229 00:12:20,636 --> 00:12:24,566 team was, was pretty collaborative and, uh, it wasn't for leverage. 230 00:12:24,566 --> 00:12:27,926 It wasn't because they weren't getting the resources. 231 00:12:27,926 --> 00:12:30,836 It was true learning experience for, for everybody. 232 00:12:30,836 --> 00:12:32,006 And it was quite a while ago. 233 00:12:32,366 --> 00:12:33,446 So that went really well. 234 00:12:33,446 --> 00:12:34,556 E everybody went into it. 235 00:12:35,351 --> 00:12:38,411 the same page with the same expectation of, of learning 236 00:12:38,411 --> 00:12:39,851 and identifying weaknesses. 237 00:12:40,301 --> 00:12:46,211 But today, in, in most of the environments that I experience, uh, or, or work 238 00:12:46,211 --> 00:12:48,191 with, they, that wouldn't go over well. 239 00:12:48,611 --> 00:12:48,941 Yeah, that's, 240 00:12:49,001 --> 00:12:50,351 IT shop security guys, 241 00:12:50,386 --> 00:12:50,466 that's, 242 00:12:50,681 --> 00:12:53,861 they want, they want to, they wanna practice before they go to the game. 243 00:12:54,251 --> 00:12:58,151 yeah, that, that's a really good point about the fact that you know that 244 00:12:58,151 --> 00:13:01,811 it's discoverable and also that, um. 245 00:13:02,561 --> 00:13:05,651 Politically, it, it is a, it is a difficulty, right? 246 00:13:05,861 --> 00:13:11,021 It's one thing like, like I've done in, in, uh, you know, in my backup and 247 00:13:11,021 --> 00:13:17,441 recovery days, I've documented, um, you know, I've basically demonstrated, 248 00:13:17,441 --> 00:13:19,212 hey, we are unable to meet. 249 00:13:19,836 --> 00:13:19,956 I. 250 00:13:20,036 --> 00:13:22,856 The recovery time objective that you have specified. 251 00:13:23,246 --> 00:13:27,326 Uh, and, and so that's kind of where, what I was thinking, but it's probably 252 00:13:27,326 --> 00:13:28,526 a little bit different than here. 253 00:13:28,976 --> 00:13:33,296 Um, and because in there what you're demonstrating is the deficiency 254 00:13:33,296 --> 00:13:38,216 of the system that you had, you know, that, that you have not the 255 00:13:38,216 --> 00:13:39,866 deficiency of the team itself. 256 00:13:40,706 --> 00:13:41,156 Um. 257 00:13:41,621 --> 00:13:42,101 in place. 258 00:13:42,566 --> 00:13:43,736 Yeah, so it's okay. 259 00:13:43,736 --> 00:13:47,456 So you're saying the first thing we do is we, so, so it sounds like we 260 00:13:47,456 --> 00:13:53,036 need an incident response plan before we do, um, a tabletop exercise. 261 00:13:53,786 --> 00:13:57,956 But you probably also need to figure out like what you're planning, like what 262 00:13:57,956 --> 00:14:00,056 scenario you're planning to run, right? 263 00:14:00,056 --> 00:14:02,786 So then you can make sure that you have those other steps, right? 264 00:14:03,776 --> 00:14:04,286 Correct. 265 00:14:04,286 --> 00:14:06,446 And, and there's hundreds of scenarios. 266 00:14:06,446 --> 00:14:09,476 So one of the part of, part of that analysis, which scenarios do we 267 00:14:09,476 --> 00:14:13,826 want to do, we want to base our, do we want to include on an instant 268 00:14:13,826 --> 00:14:18,236 response plan, and then eventually te train on, in our tabletop, you need 269 00:14:18,236 --> 00:14:20,216 to do an analysis of your business. 270 00:14:20,216 --> 00:14:21,326 What, what's the most likely. 271 00:14:22,106 --> 00:14:24,806 Threats and, and, and it could be any threat. 272 00:14:24,806 --> 00:14:27,206 But then what, what impact would that have? 273 00:14:27,206 --> 00:14:33,986 So you want the most likely, or the likely, but most impactful, uh, 274 00:14:34,076 --> 00:14:39,356 threats then flesh out your playbook to then train on in your tabletop. 275 00:14:40,481 --> 00:14:43,241 Is there a list of common scenarios somewhere? 276 00:14:43,241 --> 00:14:47,891 I know it's gonna be unique for every company, but you like it's 277 00:14:47,891 --> 00:14:50,201 one of those things where maybe you're not even thinking about 278 00:14:50,201 --> 00:14:51,936 some of these scenarios, so I. 279 00:14:53,036 --> 00:14:53,336 How 280 00:14:53,426 --> 00:14:53,846 Be sure. 281 00:14:54,086 --> 00:14:54,656 approach that? 282 00:14:54,656 --> 00:14:58,256 Is that pulling in people like you who are experts at this and 283 00:14:58,256 --> 00:15:01,076 can help them figure out what are 284 00:15:01,166 --> 00:15:01,406 there's a. 285 00:15:01,496 --> 00:15:01,976 scenarios? 286 00:15:02,426 --> 00:15:02,666 Yeah. 287 00:15:02,831 --> 00:15:08,141 a lot of different, uh, exercises and activities that can happen, uh, that lend 288 00:15:08,141 --> 00:15:11,231 itself to, to good input to that exercise. 289 00:15:11,231 --> 00:15:13,571 And one of those is a business impact analysis. 290 00:15:13,571 --> 00:15:16,241 Go find out all the critical stuff in your business that helps your 291 00:15:16,241 --> 00:15:18,401 business run and make money from that. 292 00:15:18,401 --> 00:15:25,121 Then you, you, you often get those, um, those meantime to recovery type. 293 00:15:26,021 --> 00:15:29,711 Metrics, like how long can this process be offline before we start 294 00:15:29,711 --> 00:15:32,711 losing a lot of money, type of things. 295 00:15:32,861 --> 00:15:34,811 So there's, that's great input. 296 00:15:35,171 --> 00:15:40,481 Well then if, if you've got this list of critical things that if our 297 00:15:40,481 --> 00:15:44,981 unavailable impact your financials or your operations or your reputation 298 00:15:44,981 --> 00:15:49,481 or whatever it is, then from that you can then start to think, well, what 299 00:15:49,481 --> 00:15:52,121 threats would impact that process? 300 00:15:53,096 --> 00:15:56,366 And what are the common, what's, what, what are all the common themes 301 00:15:56,366 --> 00:16:01,166 like, uh, internet access or email access, or our phone system or this 302 00:16:01,166 --> 00:16:07,286 critical, you know, our, our ERP or financial system or, and then, and 303 00:16:07,286 --> 00:16:08,966 then just keep working backwards. 304 00:16:09,291 --> 00:16:09,581 Yeah. 305 00:16:09,626 --> 00:16:10,616 Uh, and then 306 00:16:13,016 --> 00:16:16,016 truly just more, most likely, statistically, most likely 307 00:16:16,016 --> 00:16:16,946 threats that are out there. 308 00:16:16,946 --> 00:16:21,476 Ransomware is huge, uh, in any environment where you've got end users that. 309 00:16:21,761 --> 00:16:24,011 Interact directly with your production environment. 310 00:16:24,431 --> 00:16:28,631 Uh, but ransomware has a couple of different flavors and one is delivered 311 00:16:28,631 --> 00:16:34,151 via phishing emails and downloads, and the other one is delivered through. 312 00:16:34,796 --> 00:16:38,006 Unauthorized access as a result of vulnerabilities or some other 313 00:16:38,006 --> 00:16:39,236 weakness in your environment. 314 00:16:40,556 --> 00:16:43,196 So again, what's the most likely scenario there? 315 00:16:43,226 --> 00:16:47,486 Is it hacking into our network or are users clicking on 316 00:16:47,486 --> 00:16:48,326 something they shouldn't? 317 00:16:48,566 --> 00:16:52,106 And what controls do we have in place and what would the impact be? 318 00:16:52,106 --> 00:16:55,136 And so I'm kind of going down that, that rabbit hole now, but. 319 00:16:56,141 --> 00:16:59,021 Sitting back and, and thinking, for example, if, if we are a 320 00:16:59,021 --> 00:17:00,851 company that develops new stuff. 321 00:17:00,851 --> 00:17:03,521 So our intellectual property is very important to us. 322 00:17:04,001 --> 00:17:08,081 The threat would be insider threat, stealing our intellectual property 323 00:17:08,081 --> 00:17:12,731 when they go to a competitor or, uh, you know, nation state hacking us 324 00:17:12,731 --> 00:17:14,261 to get our intellectual property. 325 00:17:14,921 --> 00:17:20,681 Or we're transferring data, whether it's backup tapes or to a cloud, or to a, uh, 326 00:17:20,681 --> 00:17:24,551 you know, we design the stuff, but we ship it off to a, a place to manufacture it. 327 00:17:24,821 --> 00:17:26,501 And the process for doing that. 328 00:17:26,921 --> 00:17:30,821 So that could be all be related to intellectual property theft. 329 00:17:31,181 --> 00:17:32,111 Well, what's the impact? 330 00:17:32,111 --> 00:17:33,671 Well, I'm sure there's financial impact. 331 00:17:33,671 --> 00:17:36,401 There's market, market share impact. 332 00:17:36,401 --> 00:17:39,011 There's legal impact, uh, reputation. 333 00:17:39,551 --> 00:17:44,291 Um, and so is that more important than ransomware? 334 00:17:44,291 --> 00:17:46,931 Shutting down our environment for two weeks or a 335 00:17:47,086 --> 00:17:49,636 Yeah, that, that, that's a really good point. 336 00:17:49,636 --> 00:17:53,056 You know, you, earlier you talked about, you know, what's highly likely 337 00:17:53,056 --> 00:17:57,556 and what's impactful and that, um, you know, you, you need to do a balance. 338 00:17:57,586 --> 00:18:01,366 Of course, there's nothing wrong with doing multiple tabletop exercises, right? 339 00:18:01,726 --> 00:18:06,616 Um, do the, do the less likely but more impactful, the more likely, but less 340 00:18:06,616 --> 00:18:09,826 impactful, um, what might be more likely. 341 00:18:09,986 --> 00:18:11,006 more than one 342 00:18:11,321 --> 00:18:11,561 Good. 343 00:18:11,936 --> 00:18:12,986 exercise. 344 00:18:13,466 --> 00:18:16,796 You know it, it sounds like this all day, all week thing. 345 00:18:17,021 --> 00:18:17,321 Right, 346 00:18:17,606 --> 00:18:20,786 Most tabletop exercises last maybe an hour or two. 347 00:18:21,356 --> 00:18:25,226 And so if, if you've, if you've got the, the ability to allocate 348 00:18:25,226 --> 00:18:29,786 resources to an entire day, you might be able to get two or three, uh, 349 00:18:30,401 --> 00:18:30,671 right. 350 00:18:32,381 --> 00:18:36,581 So we figure out, we figured out the. 351 00:18:38,396 --> 00:18:41,576 You know how prepared we are and whether or not we're prepared to do this, we 352 00:18:41,576 --> 00:18:49,496 have decided the scenario or scenarios that we're, uh, going to do what's next. 353 00:18:50,951 --> 00:18:53,921 So now we need to determine, um, the format. 354 00:18:54,071 --> 00:18:55,991 Is it, is it just the core team? 355 00:18:56,561 --> 00:18:57,581 Uh, so. 356 00:18:57,971 --> 00:19:02,771 The incident response lead, the subject matter experts, the stakeholders involved, 357 00:19:02,771 --> 00:19:05,921 that, that would provide input and decision making, that kind of thing. 358 00:19:06,551 --> 00:19:09,971 then there's the third parties, like external legal counsel and your 359 00:19:09,971 --> 00:19:11,861 insurance company and law enforcement. 360 00:19:12,851 --> 00:19:17,291 and then there's the observers, uh, other, other people in management or your board, 361 00:19:17,411 --> 00:19:20,861 uh, or other employees that, uh, maybe. 362 00:19:21,611 --> 00:19:26,291 be good to observe, uh, the intricacies of incident response and what's involved. 363 00:19:26,291 --> 00:19:28,901 There's, there's a feedback on that's usually pretty good. 364 00:19:28,901 --> 00:19:30,761 Like I had no idea it was that complicated. 365 00:19:32,051 --> 00:19:35,741 and so that there, there might be value there, but most, most organizations that 366 00:19:35,741 --> 00:19:39,131 are doing their first tabletop wanna kind of keep it tight in case they mess up. 367 00:19:39,131 --> 00:19:40,541 They don't want everybody to know where they're. 368 00:19:41,441 --> 00:19:46,121 Whether their deficiencies are, but that next stage after you've determined 369 00:19:46,331 --> 00:19:51,161 the scenario is to, uh, identify or define who's gonna participate, 370 00:19:51,851 --> 00:19:53,471 gonna run and moderate this. 371 00:19:54,176 --> 00:19:56,096 Exercise, usually that's a third party. 372 00:19:56,186 --> 00:20:00,386 Uh, have an objective, uh, you know, someone that's not been in the weeds every 373 00:20:00,386 --> 00:20:03,686 day and doesn't know all the intricacies so they can, they can ask some good 374 00:20:03,686 --> 00:20:05,666 questions and throw some good curve balls. 375 00:20:05,936 --> 00:20:09,056 Uh, you know, just when your team knows what the all the plays are, 376 00:20:09,146 --> 00:20:13,616 uh, the, the moderator can, can, uh, throw a monkey wrench in there and see 377 00:20:13,616 --> 00:20:15,926 how, how, how, how the team reacts. 378 00:20:16,201 --> 00:20:16,681 this start, 379 00:20:16,796 --> 00:20:17,126 sure you have. 380 00:20:17,851 --> 00:20:19,741 this starts to sound like d and DA little bit. 381 00:20:20,971 --> 00:20:22,916 And I thought that's where you were gonna go earlier. 382 00:20:23,306 --> 00:20:25,766 Uh, when you were gonna explain how a tabletop went. 383 00:20:25,796 --> 00:20:31,736 It, it is very much like a, a role-based, uh, table game, uh, table based game. 384 00:20:31,796 --> 00:20:36,176 And then, uh, make sure you've got a good scribe, somebody that can take good notes. 385 00:20:36,506 --> 00:20:38,846 And one of the things that you wanna make sure you highlight 386 00:20:38,876 --> 00:20:40,676 are what we call the aha moments. 387 00:20:40,676 --> 00:20:43,766 Like, oh yes, you know, you can tell when there's an aha moment. 388 00:20:45,656 --> 00:20:47,066 Those aha moments can be good. 389 00:20:47,066 --> 00:20:49,886 Like, Hey, that's a great idea, or, I'm glad we did it that way. 390 00:20:49,886 --> 00:20:52,196 And they could also be the, I didn't think of that. 391 00:20:52,916 --> 00:20:56,846 and so we need to capture all the good and the bad and, and the, the curious. 392 00:20:57,326 --> 00:21:04,916 Um, so you, you've gotta put that kind of planning into, um, into game day 393 00:21:05,261 --> 00:21:09,371 So deciding, deciding who's deciding who's gonna be there 394 00:21:09,581 --> 00:21:10,961 and who's gonna do what role. 395 00:21:11,861 --> 00:21:12,191 Right. 396 00:21:13,241 --> 00:21:15,431 And then, and then some, some ground rules. 397 00:21:15,491 --> 00:21:18,911 Uh, so I always start with some ground rules and I make sure everybody that's 398 00:21:18,911 --> 00:21:20,621 participating and agrees with those. 399 00:21:20,621 --> 00:21:25,601 And, uh, one of those ground rules needs to be that this tabletop is a safe place. 400 00:21:26,021 --> 00:21:30,551 We're here to, to talk and collaborate and, and, and, uh, go through this 401 00:21:30,551 --> 00:21:32,411 exercise for the benefit of the company. 402 00:21:32,801 --> 00:21:34,151 You know, there's no stupid questions. 403 00:21:34,151 --> 00:21:39,041 No one's gonna be fired because you didn't know, or, or you, you challenge, uh. 404 00:21:39,926 --> 00:21:43,766 Um, a decision or, or a comment, uh, it's meant to be 405 00:21:43,826 --> 00:21:46,166 productive and, uh, constructive, 406 00:21:46,721 --> 00:21:47,531 No blame 407 00:21:48,326 --> 00:21:48,776 correct. 408 00:21:52,526 --> 00:21:52,946 Yeah, 409 00:21:53,171 --> 00:21:54,221 you actually 410 00:21:54,536 --> 00:21:54,836 go ahead. 411 00:21:55,091 --> 00:21:58,421 to execute or, so you've set, so you've found the people, you know 412 00:21:58,421 --> 00:22:00,641 the scenario, you set the rules. 413 00:22:01,781 --> 00:22:04,031 I'm guessing you just sort of play the game. 414 00:22:05,231 --> 00:22:05,681 Right. 415 00:22:05,771 --> 00:22:09,821 And so you, you start the tabletop with, uh, uh, and sometimes it's, 416 00:22:09,821 --> 00:22:13,541 it's good to provide some statistics or maybe some background information 417 00:22:13,571 --> 00:22:18,161 to support the, the magnitude or the gravity, uh, of the exercise. 418 00:22:18,161 --> 00:22:18,641 So. 419 00:22:18,986 --> 00:22:22,886 Maybe recent statistics on cyber or whatever that particular threat is. 420 00:22:23,336 --> 00:22:26,246 Um, if you're gonna invite law enforcement, a lot of times they'll 421 00:22:26,246 --> 00:22:29,816 bring those numbers and do a short presentation, uh, which has 422 00:22:29,816 --> 00:22:31,376 always been good and interesting. 423 00:22:31,826 --> 00:22:35,846 Uh, you lay out the ground rules, uh, you describe at a high level 424 00:22:35,846 --> 00:22:37,496 what the scenario is gonna be. 425 00:22:37,856 --> 00:22:41,666 Um, and then you start with step number one. 426 00:22:41,876 --> 00:22:46,136 Uh, so and so observed this, or this event happened and it was 427 00:22:46,136 --> 00:22:48,296 reported to whoever who then. 428 00:22:48,641 --> 00:22:52,901 Uh, reviewed it, uh, categorized it, classified it as an incident 429 00:22:52,961 --> 00:22:57,431 of whatever priority, and kicks off the, the incident response. 430 00:22:57,851 --> 00:23:01,871 And then you hand it over to whoever that person is and say, so what do you do next? 431 00:23:02,591 --> 00:23:04,631 I call Jim and this is what I do. 432 00:23:04,631 --> 00:23:05,531 And then you go to Jim. 433 00:23:05,531 --> 00:23:06,701 All right, Jim, you got the call. 434 00:23:06,701 --> 00:23:07,661 What do you do next? 435 00:23:08,081 --> 00:23:10,481 And you just, it, it's truly role playing. 436 00:23:10,661 --> 00:23:12,191 Um, turn by turn and. 437 00:23:12,266 --> 00:23:14,861 the list right of their playbook, if you will. 438 00:23:15,611 --> 00:23:17,261 and there is a little bit of discussion. 439 00:23:17,261 --> 00:23:18,911 All right, so why did you do that, Jim? 440 00:23:18,911 --> 00:23:20,081 Or what do you think about that? 441 00:23:20,081 --> 00:23:22,031 Or how do you think that could have gone differently? 442 00:23:22,121 --> 00:23:24,731 Um, and so there is a little bit of interaction. 443 00:23:24,731 --> 00:23:24,761 Uh. 444 00:23:26,021 --> 00:23:28,331 In process, but for the most part, right? 445 00:23:28,331 --> 00:23:28,451 Yeah. 446 00:23:28,451 --> 00:23:30,881 Everybody's gonna talk about what their role and responsibility 447 00:23:30,881 --> 00:23:33,521 and activities are, and, and we're gonna capture all that. 448 00:23:33,551 --> 00:23:35,981 And if it, if it's lined up with the playbook that we 449 00:23:35,981 --> 00:23:37,331 came to the game with, great. 450 00:23:37,961 --> 00:23:40,721 But in many cases, I would say at least half. 451 00:23:41,441 --> 00:23:44,201 got some action items that come out of this to make things better. 452 00:23:44,576 --> 00:23:45,746 You know, one of the thing, 453 00:23:46,031 --> 00:23:46,211 oh, 454 00:23:46,496 --> 00:23:54,536 one of the things that I've seen from, um, common cyber events has been that it, 455 00:23:55,376 --> 00:24:00,146 it doesn't start, the cyber event doesn't start with, you get this big message on 456 00:24:00,146 --> 00:24:02,876 your screen, you've been attacked, right? 457 00:24:03,116 --> 00:24:05,666 It starts with, you know, the. 458 00:24:06,191 --> 00:24:11,801 West wing air conditioner unit is not working the way it's supposed to. 459 00:24:12,911 --> 00:24:13,181 Right? 460 00:24:13,781 --> 00:24:17,441 It's like you have this random, random thing. 461 00:24:17,441 --> 00:24:18,941 It's like, oh, that's odd. 462 00:24:19,301 --> 00:24:20,771 Why is that happening? 463 00:24:21,041 --> 00:24:25,061 Uh, when, why it's happening is that you have an underlying security event, right? 464 00:24:25,061 --> 00:24:25,661 That's happening. 465 00:24:26,111 --> 00:24:31,571 Um, I, I wonder what, when you, when you do these, when you do a tabletop. 466 00:24:32,216 --> 00:24:35,816 Is that the kind of thing you give them, or do you give them a little bit more 467 00:24:35,816 --> 00:24:42,056 blatant, you know, um, you know, you, you've, you, you know it's happened. 468 00:24:43,196 --> 00:24:46,316 So one of the, one of the good things about a moderator that's been through 469 00:24:46,316 --> 00:24:51,296 a lot, uh, is that to your point, you know, this, this weird thing 470 00:24:51,296 --> 00:24:55,736 happened and we want to address, we want to triage this, we wanna stop the 471 00:24:55,736 --> 00:24:57,986 bleeding, stop the, stop the incident. 472 00:24:57,986 --> 00:25:00,356 But at the same time, there's gotta be some people. 473 00:25:00,716 --> 00:25:04,226 Tasked with determining root cause, worst patient, zero. 474 00:25:04,706 --> 00:25:08,366 Uh, what were the things, the, the symptomatic things or the observable 475 00:25:08,366 --> 00:25:14,486 things that could have been escalated prior to this bad thing really happening? 476 00:25:15,146 --> 00:25:17,846 so to that point, and I think your analogy's a good one. 477 00:25:18,221 --> 00:25:24,641 Is that we're not just addressing truly techno uh, technology based, uh, events 478 00:25:24,641 --> 00:25:27,371 and metrics and observable things. 479 00:25:27,371 --> 00:25:30,611 We also want to go back to the people, the eyes and the ears 480 00:25:30,611 --> 00:25:32,021 see something, say something. 481 00:25:32,321 --> 00:25:35,411 So do we have a good security awareness program? 482 00:25:36,971 --> 00:25:43,601 did Bob or Sally see that air conditioning thing misbehaving some time ago? 483 00:25:43,601 --> 00:25:45,131 Weeks, days, months. 484 00:25:46,121 --> 00:25:49,811 is there a way to, is, is there even a mechanism for them to report that? 485 00:25:49,811 --> 00:25:53,651 Because if they just make a comment to a coworker or a supervisor, well then 486 00:25:53,651 --> 00:25:58,091 there's gotta be a way to communicate that to people that need to know. 487 00:25:58,091 --> 00:26:00,041 So is, is there even a mechanism for that? 488 00:26:00,041 --> 00:26:01,211 But to your point, right? 489 00:26:01,211 --> 00:26:02,381 So we, we want to. 490 00:26:03,146 --> 00:26:07,466 We want to expand the value, uh, of the tabletop as far as we can 491 00:26:07,466 --> 00:26:10,916 without diluting the, the focus. 492 00:26:11,336 --> 00:26:18,656 Um, but those observable, teachable, um, expandable moments, uh, 493 00:26:18,656 --> 00:26:20,246 are, are definitely brought up. 494 00:26:20,486 --> 00:26:22,676 Um, and so that's a good, I'm glad you brought that up. 495 00:26:22,706 --> 00:26:26,336 'cause that's a absolutely, it's, it's the moderator's job. 496 00:26:27,131 --> 00:26:31,061 Uh, to know how far outside the true storyline we can go, how 497 00:26:31,061 --> 00:26:34,511 far off the path can we go and still add value to the exercise? 498 00:26:35,216 --> 00:26:39,386 And so it looks like the moderator has a critical role to play in 499 00:26:39,386 --> 00:26:41,876 the actual execution of the, 500 00:26:42,311 --> 00:26:42,461 Mm-Hmm. 501 00:26:42,506 --> 00:26:44,336 of the tabletop exercise. 502 00:26:46,541 --> 00:26:49,361 And I know you mentioned sometimes a lot of this comes with experience. 503 00:26:49,751 --> 00:26:51,761 How do you even find the right moderator? 504 00:26:52,481 --> 00:26:52,571 Right. 505 00:26:54,026 --> 00:26:56,366 Because like you mentioned, you probably don't want someone who's 506 00:26:56,366 --> 00:27:00,146 internal who knows the details of the systems and the inner workings. 507 00:27:00,836 --> 00:27:04,976 You want someone who's experienced in cyber instance incidences or 508 00:27:04,976 --> 00:27:06,656 whatever else you're focused on. 509 00:27:07,646 --> 00:27:10,496 But how do you, as a company, like I'm going out and seeking 510 00:27:10,496 --> 00:27:12,146 out a moderator, how do I know? 511 00:27:12,146 --> 00:27:15,176 Like what are the questions I would ask to be able to determine, is that a good 512 00:27:15,176 --> 00:27:17,516 moderator for my tabletop exercise or not? 513 00:27:18,366 --> 00:27:21,906 Usually there's, there's profiles for, for tabletop moderators. 514 00:27:21,906 --> 00:27:23,616 They're also call 'em breach coaches. 515 00:27:23,976 --> 00:27:29,136 Uh, and they, they run from the, kind of the gamut, from true cyber focused. 516 00:27:29,951 --> 00:27:34,211 You know, former CISOs and, and people that have been in the trenches, uh, 517 00:27:34,211 --> 00:27:36,251 that actually had to wear those shoes. 518 00:27:36,851 --> 00:27:39,611 Uh, and then some other breach coaches are on more of the 519 00:27:39,611 --> 00:27:41,651 advisory or even legal side. 520 00:27:41,711 --> 00:27:44,921 Like one of my, one of my favorite breach coach collaborators is 521 00:27:44,921 --> 00:27:48,191 an attorney and he's been a cyber attorney his whole career. 522 00:27:48,191 --> 00:27:49,481 He is never spent a day in it. 523 00:27:50,471 --> 00:27:54,101 Uh, but he's been involved in hundreds of breaches, so he's seen. 524 00:27:54,461 --> 00:27:58,001 The battleground, and he is been through the game he's seen what, 525 00:27:58,061 --> 00:27:59,501 what's worked and what's not. 526 00:27:59,621 --> 00:28:03,221 And then based on all that experience, also giving some good advice on how 527 00:28:03,221 --> 00:28:07,271 to, how to make them more resilient to, to future, uh, incidents. 528 00:28:07,271 --> 00:28:12,641 So my advice would be, uh, and you can search, usually it's called, 529 00:28:12,671 --> 00:28:14,591 you know, tabletop exercises. 530 00:28:14,591 --> 00:28:18,041 You know, the, the, the service providers out there usually list it. 531 00:28:18,506 --> 00:28:19,166 Like that. 532 00:28:20,156 --> 00:28:23,096 and then for those that are providing the service from that company, you've 533 00:28:23,096 --> 00:28:26,876 got a, a profile, usually like a resume that you can, you can review. 534 00:28:27,066 --> 00:28:29,706 And it seems like the, the. 535 00:28:30,431 --> 00:28:35,351 Actual experience with actual events would be a really big, because 536 00:28:35,351 --> 00:28:39,161 like you said, they can draw on all of these different things that 537 00:28:39,161 --> 00:28:43,661 have happened to them, um, both in terms of how the event got started. 538 00:28:44,306 --> 00:28:47,336 And things that happen throughout the event, right? 539 00:28:47,546 --> 00:28:50,456 It's like, okay, well now you just lost power or whatever, 540 00:28:50,456 --> 00:28:53,846 whatever types of things that happened throughout a cyber event. 541 00:28:54,236 --> 00:28:59,096 Um, you've got to have a lot of experience to be able to 542 00:28:59,096 --> 00:29:01,106 draw on those kinds of things. 543 00:29:01,826 --> 00:29:04,256 And, and I'll, I'll, I'll make an example that, that you 544 00:29:04,256 --> 00:29:05,726 can probably truly relate to. 545 00:29:05,756 --> 00:29:11,306 'cause that backup tape drive works the same every day and it works good. 546 00:29:11,306 --> 00:29:12,776 And you know, you know the hiccups. 547 00:29:12,806 --> 00:29:16,076 I guarantee you that does not work the same on the day. 548 00:29:16,076 --> 00:29:16,856 You have an incident. 549 00:29:16,856 --> 00:29:17,906 You've gotta restore something. 550 00:29:17,966 --> 00:29:19,526 It's just, that's a Murphy's Law 551 00:29:19,991 --> 00:29:20,471 Yeah. 552 00:29:21,296 --> 00:29:21,866 someone. 553 00:29:23,006 --> 00:29:27,146 Moderating your, your tabletop, that's familiar with how Murphy's Law works? 554 00:29:27,221 --> 00:29:27,461 Yeah. 555 00:29:27,461 --> 00:29:27,611 I. 556 00:29:28,331 --> 00:29:35,201 I often, uh, say that the success rate of backups is inversely proportional to the 557 00:29:35,561 --> 00:29:38,801 degree to which you need that data, right? 558 00:29:39,171 --> 00:29:39,491 Absolutely. 559 00:29:39,731 --> 00:29:39,941 Yeah. 560 00:29:40,051 --> 00:29:40,291 Absolutely. 561 00:29:40,481 --> 00:29:40,901 Yeah. 562 00:29:41,351 --> 00:29:45,881 Um, all right, so we've, we've, so we've done our event, right? 563 00:29:46,451 --> 00:29:52,091 Um, and we, you know, you had, you had a good scribe captured those aha moments. 564 00:29:52,451 --> 00:29:55,001 Um, now what, and no one cried. 565 00:29:55,151 --> 00:29:56,201 Maybe somebody cried. 566 00:29:56,531 --> 00:29:57,131 Um. 567 00:29:58,316 --> 00:29:58,496 I've, 568 00:29:58,541 --> 00:29:58,871 But 569 00:29:58,976 --> 00:29:59,336 happen. 570 00:29:59,801 --> 00:30:03,071 I'm sure, I'm sure this is so hard. 571 00:30:03,461 --> 00:30:05,471 Um, I could just see that. 572 00:30:06,006 --> 00:30:06,226 Um, 573 00:30:06,386 --> 00:30:09,716 Well one of the things, one of the things too, and before we get off the, 574 00:30:09,806 --> 00:30:16,016 uh, off of the execution part, uh, I wanna stress the importance of, um. 575 00:30:16,901 --> 00:30:17,831 Accountability. 576 00:30:18,311 --> 00:30:22,871 So even though it's a safe place, we don't want to happen is walking 577 00:30:22,871 --> 00:30:27,191 through a scenario and somebody go, well, let's just assume we do. 578 00:30:27,221 --> 00:30:29,021 We do have that, and let's move on. 579 00:30:29,681 --> 00:30:34,331 Let's just assume, don't we need to move, we need to work through this because we 580 00:30:34,331 --> 00:30:35,771 need to know how it's gonna flesh out. 581 00:30:36,221 --> 00:30:41,441 So I wanna stress that, that when you're playing this game, don't just 582 00:30:41,876 --> 00:30:42,356 No, it's not. 583 00:30:43,631 --> 00:30:44,081 right? 584 00:30:44,441 --> 00:30:45,221 Uh, because. 585 00:30:45,986 --> 00:30:50,276 And I've got a, a case study where we assumed, or I say we, it was the, 586 00:30:50,636 --> 00:30:53,696 the response leader, let's assume we have that and let's move on. 587 00:30:54,146 --> 00:31:04,166 And kind of, um, uh, not directly, but I tried to passively come back to 588 00:31:04,166 --> 00:31:07,856 it multiple times during the tabletop and each time it was met with, let's 589 00:31:07,856 --> 00:31:08,966 assume we have that and move on. 590 00:31:10,556 --> 00:31:13,706 Not, not six weeks after the exercise. 591 00:31:13,706 --> 00:31:17,186 They actually got hit with that, that particular incident in real life. 592 00:31:17,606 --> 00:31:22,286 And that assumption, uh, really came back to bite him because they 593 00:31:22,286 --> 00:31:25,736 assumed this in the tabletop, it was not captured as a remediation item. 594 00:31:26,516 --> 00:31:30,776 Um, and that was one of the downfalls of their, of their incident response. 595 00:31:31,331 --> 00:31:31,721 That, 596 00:31:31,911 --> 00:31:32,516 was false. 597 00:31:32,516 --> 00:31:32,696 Right. 598 00:31:33,161 --> 00:31:34,061 that reminds me, 599 00:31:34,106 --> 00:31:34,381 that is true. 600 00:31:35,121 --> 00:31:36,501 Yeah, I like that. 601 00:31:36,556 --> 00:31:40,551 And I, I can see that, I can see wanting to do that. 602 00:31:40,641 --> 00:31:42,921 It's like, okay, we don't have that person here. 603 00:31:43,371 --> 00:31:46,521 Let's just assume that we have the thing right. 604 00:31:46,791 --> 00:31:48,081 Nope, he's not here. 605 00:31:48,201 --> 00:31:49,221 What do we do if he's not here? 606 00:31:49,671 --> 00:31:50,211 right. 607 00:31:50,316 --> 00:31:50,526 He's 608 00:31:50,571 --> 00:31:50,961 Yeah. 609 00:31:51,096 --> 00:31:52,146 He gets hit by a bus. 610 00:31:52,476 --> 00:31:52,866 Yep. 611 00:31:53,346 --> 00:31:53,636 Yeah. 612 00:31:53,676 --> 00:31:54,636 and I've done that too. 613 00:31:54,636 --> 00:31:54,996 All right. 614 00:31:54,996 --> 00:31:56,586 You're the incident response team leader. 615 00:31:56,586 --> 00:31:57,426 Let's go through this. 616 00:31:57,426 --> 00:32:00,726 And halfway into the incident response, I go, all right, you fell sick. 617 00:32:00,726 --> 00:32:03,096 'cause that pizza you ate for lunch took you out. 618 00:32:03,096 --> 00:32:06,336 And so who's, who's, who's, who's the assistant coach. 619 00:32:06,816 --> 00:32:08,406 And we actually ran into a problem there. 620 00:32:08,436 --> 00:32:10,926 'cause three people thought they were the assistant coach. 621 00:32:11,316 --> 00:32:12,246 And so there's a 622 00:32:12,351 --> 00:32:12,381 Uh. 623 00:32:12,816 --> 00:32:13,476 of, you know, right. 624 00:32:13,476 --> 00:32:14,406 Who's gonna take charge. 625 00:32:14,856 --> 00:32:15,726 But then, sorry. 626 00:32:15,726 --> 00:32:18,516 So after, after we finish the execution and we've got. 627 00:32:19,956 --> 00:32:20,526 and good notes. 628 00:32:20,526 --> 00:32:22,266 We, we wanna review, we want to debrief. 629 00:32:22,266 --> 00:32:27,606 We wanna make sure that what we heard, what we collected, uh, what we documented, 630 00:32:27,936 --> 00:32:31,536 uh, was, uh, concise and, and accurate. 631 00:32:32,166 --> 00:32:36,876 And then naturally, as, as, you know, maybe, maybe I'm saying something, I'm 632 00:32:36,876 --> 00:32:42,366 responding to something or I'm walking through my activity, my playbook and 633 00:32:42,366 --> 00:32:46,656 my part's done, I hand it off to you and now I'm listening to your response. 634 00:32:46,986 --> 00:32:52,026 Naturally as, as people with responsibility and instant response. 635 00:32:52,026 --> 00:32:55,716 I'm gonna think about what you're saying and, well, what 636 00:32:55,716 --> 00:32:56,586 could I have done different? 637 00:32:56,586 --> 00:32:58,446 Or, or maybe I've got thoughts about what you're saying. 638 00:32:58,446 --> 00:33:02,466 So the, the debrief gives an opportunity for the participants to add more comment 639 00:33:02,466 --> 00:33:07,056 or thought or, you know, something came to mind or, you know, um, me 640 00:33:07,056 --> 00:33:08,616 add to that or let me correct that. 641 00:33:09,066 --> 00:33:10,446 And so the debrief is important. 642 00:33:10,446 --> 00:33:13,866 Before everybody leaves, we want to capture all that before the end, 643 00:33:13,896 --> 00:33:16,026 before people go back to their day job. 644 00:33:16,776 --> 00:33:24,276 All right, well then the scribe and the moderator to over the, the coming days 645 00:33:24,336 --> 00:33:30,006 to make sure that there aren't any un un untied strings or unle questions. 646 00:33:30,006 --> 00:33:33,906 And we're gonna, you know, there's an opportunity to, to ping the, 647 00:33:33,906 --> 00:33:36,851 the participants one more time, uh, because maybe they also made 648 00:33:37,051 --> 00:33:38,436 reference to something and, all right. 649 00:33:38,436 --> 00:33:38,826 Well. 650 00:33:39,636 --> 00:33:41,946 Lemme know when you get back to your desk, you know, type of thing. 651 00:33:42,186 --> 00:33:44,976 So we, we've, we've got a period of time to wrap this up, and then 652 00:33:44,976 --> 00:33:49,206 we want to document this in a summary with detailed action items. 653 00:33:49,266 --> 00:33:49,476 All right? 654 00:33:49,476 --> 00:33:52,296 This is what came out of the, the tabletop. 655 00:33:52,386 --> 00:33:54,936 Uh, we, we, we need to update this. 656 00:33:55,026 --> 00:33:58,926 Uh, we need to find a resource when, when Bob doesn't show up, we need 657 00:33:58,986 --> 00:34:03,396 to talk to our insurance company about having a, a good contact. 658 00:34:03,696 --> 00:34:07,446 We need management's approval for, uh, when to involve law 659 00:34:07,446 --> 00:34:08,856 enforcement, whatever it is. 660 00:34:09,426 --> 00:34:09,576 We've 661 00:34:09,696 --> 00:34:09,756 Yeah. 662 00:34:09,786 --> 00:34:14,586 this action plan we need, we need that stuff to be addressed. 663 00:34:14,586 --> 00:34:16,956 It came out of this incident response as things that we need 664 00:34:16,956 --> 00:34:18,216 to do to be more effective. 665 00:34:18,216 --> 00:34:23,226 It has to get done, and that is as important as conducting the exercise 666 00:34:23,226 --> 00:34:28,506 because you now know where your weaknesses are where, where, where you need to 667 00:34:28,506 --> 00:34:29,766 improve in order to be effective. 668 00:34:29,766 --> 00:34:34,476 Without that stuff, you're going to fail the response to whatever that incident is 669 00:34:35,016 --> 00:34:37,296 and more than likely back to Murphy's Law. 670 00:34:37,611 --> 00:34:40,581 That particular incident that you just trained on that you didn't fix is 671 00:34:40,581 --> 00:34:42,081 gonna happen sooner than it would've. 672 00:34:44,196 --> 00:34:44,706 Yeah. 673 00:34:45,006 --> 00:34:48,066 Uh, well, you know what, this brings brought up a thought for me. 674 00:34:48,066 --> 00:34:51,426 You know, we talk a lot about doing disaster recovery testing, and, 675 00:34:51,936 --> 00:35:00,486 um, so my question is, what is, is there a, is there a, is there a pass 676 00:35:00,486 --> 00:35:03,486 or fail for a tabletop exercise? 677 00:35:03,846 --> 00:35:08,166 You know, what's considered a success is something, is, you know, I, I would think. 678 00:35:08,961 --> 00:35:09,291 I don't know. 679 00:35:09,351 --> 00:35:10,251 I'll, I'll stop talking. 680 00:35:10,491 --> 00:35:12,681 What would be considered a success and what be, what 681 00:35:12,686 --> 00:35:13,636 would be considered a failure? 682 00:35:14,961 --> 00:35:20,691 There is, and, and what what success is would depend on what the incident is. 683 00:35:20,691 --> 00:35:24,531 So if like it was incident, if it was intellectual property theft, success 684 00:35:24,531 --> 00:35:26,271 would be determining how it happened. 685 00:35:26,616 --> 00:35:29,646 Having enough evidence to prosecute whoever did it 686 00:35:29,796 --> 00:35:30,936 right, that would be success. 687 00:35:31,776 --> 00:35:36,816 in, uh, ransomware success would be a hundred percent or majority. 688 00:35:37,656 --> 00:35:41,196 Recoverability without having to pay a ransom while also figuring out 689 00:35:41,256 --> 00:35:43,086 how the ransom infection happened. 690 00:35:43,146 --> 00:35:44,976 That would be ideal success. 691 00:35:45,336 --> 00:35:47,766 But there's, there's levels of success as well. 692 00:35:48,126 --> 00:35:51,996 Uh, simply getting the, the company back up and running with minimal financial 693 00:35:51,996 --> 00:35:54,606 impact, uh, would be considered success. 694 00:35:55,026 --> 00:35:58,356 Uh, and so defining success is one of those criteria that you 695 00:35:58,356 --> 00:36:02,226 definitely want to, uh, lay out at the beginning of an incident. 696 00:36:02,586 --> 00:36:05,526 Uh, based on what's going on, here's what we're gonna focus on. 697 00:36:05,696 --> 00:36:06,116 Mm-Hmm. 698 00:36:06,261 --> 00:36:09,561 our target is, and that's collaboration with management. 699 00:36:09,561 --> 00:36:13,491 That's not just it, you know, setting the, setting the bar and, and, 700 00:36:13,491 --> 00:36:14,751 and shooting for that objective. 701 00:36:14,751 --> 00:36:16,011 It needs to be collaborative. 702 00:36:17,631 --> 00:36:20,601 and then absolutely there's failures. 703 00:36:20,601 --> 00:36:20,661 I. 704 00:36:21,951 --> 00:36:26,751 is not being prepared, not understanding the business, not, not having good, 705 00:36:27,501 --> 00:36:30,981 not having identified the right resources that you need to be effective 706 00:36:30,981 --> 00:36:33,321 in response, not getting along. 707 00:36:33,351 --> 00:36:36,291 I've seen that several times in an incident response tabletop, people 708 00:36:36,291 --> 00:36:37,971 just, I'm not working with you anymore. 709 00:36:38,871 --> 00:36:39,621 I, I quit. 710 00:36:39,771 --> 00:36:40,821 I haven't had it, and I quit. 711 00:36:40,826 --> 00:36:44,901 But there's definitely people that, that have had some, some contentious 712 00:36:44,901 --> 00:36:48,351 or, you know, some animosity and you put 'em in a room in a. 713 00:36:48,351 --> 00:36:51,206 And you're, you're, you're pointing fingers, all right, you're next. 714 00:36:51,206 --> 00:36:52,796 And they're like, yeah, I'm not playing anymore. 715 00:36:52,946 --> 00:36:54,146 And, and I've seen that. 716 00:36:55,536 --> 00:36:55,866 Wow. 717 00:36:56,256 --> 00:36:57,131 Yeah, that would be a. 718 00:36:57,181 --> 00:37:01,976 that brings, brings sli a uh, uh, a risk that needs to be addressed. 719 00:37:02,216 --> 00:37:05,186 Maybe that person shouldn't have that responsibility. 720 00:37:06,591 --> 00:37:09,921 And I think at least doing this exercise, right, so you've gone 721 00:37:09,921 --> 00:37:11,421 through this entire process. 722 00:37:11,691 --> 00:37:15,711 You figured out the remediation steps or the gaps that you have today. 723 00:37:16,521 --> 00:37:21,021 think that's such a huge step forward for a company because now you can figure 724 00:37:21,021 --> 00:37:22,341 out, okay, how do I address those? 725 00:37:22,341 --> 00:37:24,081 What are the skillsets I need to bring in? 726 00:37:24,411 --> 00:37:28,341 What are things I need to modify my processes in order to make 727 00:37:28,341 --> 00:37:31,851 sure that I am able to recover from some of these incidents? 728 00:37:32,751 --> 00:37:36,801 And it is really huge too in, in, in very well established environments 729 00:37:36,801 --> 00:37:38,631 that have never been tested. 730 00:37:38,631 --> 00:37:40,851 They're, they're so complacent with how everything's always worked. 731 00:37:41,181 --> 00:37:41,931 Everything's fine. 732 00:37:41,931 --> 00:37:43,581 Everything's worked well forever. 733 00:37:44,781 --> 00:37:44,811 I. 734 00:37:44,811 --> 00:37:45,461 I've been here for 20 years. 735 00:37:45,521 --> 00:37:46,691 Well, that's great. 736 00:37:46,991 --> 00:37:51,011 It's worked well from your perspective without any outside influence. 737 00:37:51,041 --> 00:37:52,121 Let's add some of that. 738 00:37:52,431 --> 00:37:52,791 Hmm. 739 00:37:52,881 --> 00:37:53,211 Yeah. 740 00:37:53,861 --> 00:37:56,021 perspective outside influence and see how things go. 741 00:37:56,466 --> 00:38:01,121 Yeah, I, I, um, you know, talking about, you know, the way people interact, it, 742 00:38:01,141 --> 00:38:04,626 it, it would seem, and while, while it is a safe space, you know, you're, 743 00:38:04,686 --> 00:38:09,936 you're observing and you, you get to see how different people do under pressure. 744 00:38:10,326 --> 00:38:14,226 Um, you know, I'm, I'm thinking back to, I used to work for this company 745 00:38:14,736 --> 00:38:17,466 that used to u that used to ask. 746 00:38:17,811 --> 00:38:20,991 Really bizarre interview questions. 747 00:38:21,201 --> 00:38:24,441 Not as bizarre as the, like how to put an elephant in a refrigerator. 748 00:38:24,441 --> 00:38:27,321 I dunno if you're familiar with that series of questions. 749 00:38:27,741 --> 00:38:32,961 They were more like you're writing a shell script and instead of pound bank, 750 00:38:32,961 --> 00:38:38,511 Bens h at the top, you put Pound bank, Ben Echo what would happen, right? 751 00:38:38,811 --> 00:38:42,141 And it, and it was for, it had two purposes. 752 00:38:42,386 --> 00:38:42,846 One was. 753 00:38:44,211 --> 00:38:47,631 If you could successfully answer the question, um. 754 00:38:48,021 --> 00:38:50,841 Then it showed that you had a really good knowledge of internals, 755 00:38:51,051 --> 00:38:54,291 but if you couldn't answer the question, it was just as important 756 00:38:54,291 --> 00:38:55,761 to see how you responded to that. 757 00:38:56,451 --> 00:38:56,871 Right. 758 00:38:57,111 --> 00:38:59,991 And if basically, and we had interviewers just walk out 759 00:39:00,261 --> 00:39:01,971 like, this is a stupid question. 760 00:39:02,271 --> 00:39:03,771 This is, no one would do that. 761 00:39:03,771 --> 00:39:06,591 No one would put Ben Echo at the top of the script. 762 00:39:06,771 --> 00:39:08,331 Shell script, this is stupid. 763 00:39:08,331 --> 00:39:09,831 And they would just literally walk out. 764 00:39:10,521 --> 00:39:11,991 Okay, you failed the interview. 765 00:39:13,161 --> 00:39:13,401 Right. 766 00:39:14,346 --> 00:39:18,516 And so I would, I would think that that's, that, you know, you talked about dynamics, 767 00:39:18,516 --> 00:39:22,146 you talked about pe, people getting, uh, you know, animosity to each other. 768 00:39:22,536 --> 00:39:26,466 And, and I'm sure that at some point there, even though we're not supposed 769 00:39:26,466 --> 00:39:30,246 to, I'm sure there's been some yelling and a few tabletop exercises. 770 00:39:30,576 --> 00:39:32,016 Would that be a fair assumption? 771 00:39:33,001 --> 00:39:36,656 There has and, and, well, not yelling, but definitely raising the voice. 772 00:39:36,696 --> 00:39:37,176 Yeah. 773 00:39:37,266 --> 00:39:37,656 Yeah. 774 00:39:38,526 --> 00:39:39,906 Um, yeah. 775 00:39:40,746 --> 00:39:41,526 And, and. 776 00:39:42,381 --> 00:39:48,171 So I think the only, the only truly failed tabletop exercise, in my opinion, would 777 00:39:48,171 --> 00:39:50,781 be one that, that just, you just never do. 778 00:39:51,291 --> 00:39:51,711 Right? 779 00:39:51,771 --> 00:39:58,821 Um, and I think that that's what multiple people, I, I think that's what a majority 780 00:39:58,821 --> 00:40:04,131 of people are doing or not doing, is that they're just not doing these for fear. 781 00:40:05,451 --> 00:40:10,761 Of those things for fear of being exposed, for fear of whatever. 782 00:40:10,911 --> 00:40:17,361 But the only thing I can say to them is, well, you know, um, it, you know, 783 00:40:17,366 --> 00:40:22,161 it, it, it remind, have you seen, um, Glen Gary, Glen Ross, the movie? 784 00:40:23,661 --> 00:40:24,831 Um, okay. 785 00:40:24,831 --> 00:40:24,951 It, it. 786 00:40:26,181 --> 00:40:30,471 If you watch nothing else, just watch the opening scene with, uh, Alec Baldwin. 787 00:40:31,161 --> 00:40:34,791 And, uh, there's a li he's, he's, he's yelling and screaming at 788 00:40:34,791 --> 00:40:36,861 these, um, at these salesmen. 789 00:40:37,161 --> 00:40:40,371 And he basically, he said, one of the lines he says is, you, you, you 790 00:40:40,371 --> 00:40:43,041 can't handle what I'm, what I'm, what I'm saying to you right now, 791 00:40:43,041 --> 00:40:45,981 if you can't handle this, how are you gonna handle the abuse that you 792 00:40:45,981 --> 00:40:47,811 get when you go out on a sales call? 793 00:40:48,021 --> 00:40:49,761 Like if you can't handle a tabletop. 794 00:40:50,931 --> 00:40:55,581 Imagine an actual cybersecurity event where you didn't do a tabletop and 795 00:40:55,581 --> 00:40:58,071 you're, you're not prepared at all. 796 00:40:58,401 --> 00:41:01,311 Um, which I think is the majority of situations. 797 00:41:01,311 --> 00:41:01,611 Right. 798 00:41:02,361 --> 00:41:02,931 Um. 799 00:41:03,141 --> 00:41:08,601 And, but I think there's a misconception there in that tabletop is this 800 00:41:08,661 --> 00:41:12,351 point in time thing, uh, that they don't, that they're afraid of. 801 00:41:12,381 --> 00:41:13,701 'cause they're afraid that they're gonna fail. 802 00:41:13,701 --> 00:41:17,421 But really the intent of doing a tabletop requires that you do 803 00:41:17,421 --> 00:41:19,581 some planning ahead of game day. 804 00:41:19,581 --> 00:41:19,941 So that. 805 00:41:20,176 --> 00:41:20,526 Right. 806 00:41:20,916 --> 00:41:24,876 better prepared to play the game and that that preparation is where 807 00:41:24,876 --> 00:41:29,646 someone like me would really walk you through you need to be successful in a 808 00:41:29,646 --> 00:41:33,756 tabletop and make sure that that's in place before we we go play the game. 809 00:41:34,166 --> 00:41:34,456 Yeah. 810 00:41:34,926 --> 00:41:35,076 Yeah. 811 00:41:35,076 --> 00:41:39,156 And I think if you define the success of the tabletop is a successful 812 00:41:39,156 --> 00:41:45,576 tabletop helps uncover, um, weaknesses that we can then go address. 813 00:41:45,726 --> 00:41:46,056 Right. 814 00:41:46,206 --> 00:41:47,706 That would be a successful tabletop. 815 00:41:47,886 --> 00:41:48,066 Yeah. 816 00:41:48,796 --> 00:41:49,016 It 817 00:41:49,236 --> 00:41:49,681 And if, and 818 00:41:49,701 --> 00:41:50,211 expected. 819 00:41:50,401 --> 00:41:50,691 yeah. 820 00:41:50,721 --> 00:41:53,541 tabletop I've ever done has had opportunity for improvement. 821 00:41:54,261 --> 00:41:58,161 Yeah, it's just like when, uh, Pana, you know that I say this a lot that we, 822 00:41:58,161 --> 00:42:02,541 when we used to do disaster recovery exercises, we define success as. 823 00:42:03,576 --> 00:42:08,556 Because we would do a DR test where, uh, I was the one in charge of backups, but 824 00:42:08,556 --> 00:42:10,416 I was not the one running the DR test. 825 00:42:11,046 --> 00:42:17,916 And a, a, a success was they, they made it from A to to Z using 826 00:42:18,006 --> 00:42:21,276 nothing but my documentation and never having to ask me a question. 827 00:42:21,456 --> 00:42:26,466 Never once did we succeed by, by that standard, right? 828 00:42:26,826 --> 00:42:29,376 Everyone has, uh, deficiencies. 829 00:42:30,011 --> 00:42:33,011 In every part of it, in the job of doing this. 830 00:42:33,011 --> 00:42:36,761 And I like, by the way, I like you talk, you said it, it, it's, a lot 831 00:42:36,761 --> 00:42:38,051 of people see it as a point in time. 832 00:42:38,261 --> 00:42:41,321 Another thing is that you don't just do one tabletop and then move on. 833 00:42:41,711 --> 00:42:42,641 You do regular tabletops. 834 00:42:43,331 --> 00:42:47,321 What, what do you think is a, is a, a good frequency for people to do that? 835 00:42:48,756 --> 00:42:50,586 As often as possible, uh. 836 00:42:51,666 --> 00:42:53,526 At, at a minimum once a year, 837 00:42:53,771 --> 00:42:53,801 Uh. 838 00:42:53,826 --> 00:42:57,966 you pick, because once a year is really as, as often as. 839 00:42:58,986 --> 00:43:01,926 You know, collectively the business reassess itself. 840 00:43:02,406 --> 00:43:05,106 You know, that's where we update our strategy, uh, both on the business 841 00:43:05,106 --> 00:43:06,636 side and the technology side. 842 00:43:07,026 --> 00:43:09,816 That's where we look at our, if, if we've got audit work or risk 843 00:43:09,816 --> 00:43:11,736 assessments, we look at all those things. 844 00:43:12,126 --> 00:43:14,226 So once a year is, is common. 845 00:43:14,676 --> 00:43:15,966 Twice a year would be great. 846 00:43:15,966 --> 00:43:17,556 Quarterly would be amazing. 847 00:43:17,856 --> 00:43:20,766 And if you're doing 'em quarterly, you're really cutting this down to. 848 00:43:21,441 --> 00:43:25,131 You know, a a, a well-oiled machine, you know, doing 'em once a year. 849 00:43:25,131 --> 00:43:29,961 That's probably two hours on game day plus maybe an hour or two of, 850 00:43:29,996 --> 00:43:34,221 of planning ahead of, and then all the logistics of, you know, people. 851 00:43:34,836 --> 00:43:38,736 People's schedule and everything, if you do them quarterly, you can 852 00:43:38,736 --> 00:43:41,166 break u Usually it's a smaller group. 853 00:43:42,096 --> 00:43:46,326 you can really focus tactically on whatever the scenario is and just, you 854 00:43:46,326 --> 00:43:50,466 know, just record it in a team session and you don't even have to have a, a scribe. 855 00:43:50,946 --> 00:43:59,766 Um, and it becomes this, this, this, uh, scheduled event that, that you just, 856 00:44:00,426 --> 00:44:02,076 know, it's, it's like going to practice 857 00:44:02,211 --> 00:44:03,981 Yeah, and you're developing muscle memory. 858 00:44:04,126 --> 00:44:05,661 Did, did you just say muscle memory 859 00:44:06,006 --> 00:44:06,606 I did say 860 00:44:06,891 --> 00:44:08,121 at the same time? 861 00:44:08,391 --> 00:44:09,111 Look at that. 862 00:44:09,381 --> 00:44:09,981 I love it. 863 00:44:10,041 --> 00:44:10,641 I love it. 864 00:44:10,641 --> 00:44:11,301 That's a great way to. 865 00:44:11,526 --> 00:44:15,246 the other thing to consider with tabletops is, uh, it's actually a 866 00:44:15,246 --> 00:44:17,886 benefit in, in a couple of ways. 867 00:44:17,886 --> 00:44:21,696 You're, and especially if you expand the, the participation to 868 00:44:21,696 --> 00:44:24,576 include your insurance company and law enforcement, some others. 869 00:44:25,356 --> 00:44:30,696 improving the perceived effectiveness of your organization to people that want 870 00:44:30,696 --> 00:44:33,366 to help you, you learn something too. 871 00:44:33,396 --> 00:44:36,456 Like a lot of organizations think, I'm not gonna call my insurance 872 00:44:36,456 --> 00:44:41,616 company until I fee, I think I'm gonna have a claim or, recover, so 873 00:44:41,616 --> 00:44:42,696 I'm gonna have to pay the ransom. 874 00:44:42,696 --> 00:44:44,346 So I gotta call my insurance company. 875 00:44:44,736 --> 00:44:47,796 But if you ask the insurance company when, when should we call you? 876 00:44:47,796 --> 00:44:50,256 They're gonna tell you as soon as you think you have a problem. 877 00:44:50,971 --> 00:44:51,231 Yeah. 878 00:44:51,471 --> 00:44:54,441 we've been through a lot of this stuff and we can also help guide you. 879 00:44:54,951 --> 00:44:55,191 Right. 880 00:44:55,251 --> 00:44:58,401 say Bob didn't come to work that day and he's on your incident response 881 00:44:58,401 --> 00:44:59,991 team and he's your database expert. 882 00:45:01,221 --> 00:45:02,121 what are we gonna do now? 883 00:45:02,241 --> 00:45:05,721 Well, your insurance company probably has a vendor on their approved list that's 884 00:45:05,721 --> 00:45:07,341 a database expert that can help you. 885 00:45:07,341 --> 00:45:10,761 And there's, I mean, they're a great resource and a lot of, a lot 886 00:45:10,761 --> 00:45:13,581 of organizations don't realize, or they're hesitant to involve. 887 00:45:13,881 --> 00:45:14,871 Insurance company. 888 00:45:14,871 --> 00:45:15,831 Their insurance company. 889 00:45:15,831 --> 00:45:19,191 When, when something bad happens, they're afraid it's gonna, it's gonna ding them 890 00:45:19,191 --> 00:45:20,661 like getting your windshield repaired. 891 00:45:21,321 --> 00:45:21,621 Yeah. 892 00:45:22,461 --> 00:45:25,491 they're, they're afraid it's gonna impact their, their 893 00:45:25,491 --> 00:45:26,871 premium next year or whatever. 894 00:45:26,871 --> 00:45:30,051 But really what it's doing is adding, it's adding value. 895 00:45:30,171 --> 00:45:33,711 Um, and, and there's a perception there from your insurance company that you guys 896 00:45:33,711 --> 00:45:38,036 are, what, you're being diligent, uh, ahead of, uh, a true incident happening. 897 00:45:39,501 --> 00:45:40,011 All right. 898 00:45:40,401 --> 00:45:41,121 Well, thank you. 899 00:45:41,121 --> 00:45:42,621 Uh, thank you once again, Mike. 900 00:45:43,491 --> 00:45:43,856 You are welcome. 901 00:45:44,481 --> 00:45:45,941 All right, and thanks, Prasanna. 902 00:45:46,461 --> 00:45:47,361 You enjoying this? 903 00:45:48,066 --> 00:45:50,076 I am, I'm learning something new. 904 00:45:50,526 --> 00:45:51,006 It's kind of 905 00:45:51,221 --> 00:45:52,416 I, I love learning. 906 00:45:52,416 --> 00:45:53,106 I love learning 907 00:45:53,136 --> 00:45:57,756 whenever I think about tabletop exercises, for some reason I think about the, uh, 908 00:45:57,786 --> 00:46:00,666 the game battleship for some reason. 909 00:46:01,836 --> 00:46:02,406 you song. 910 00:46:02,406 --> 00:46:03,396 My battleship. 911 00:46:03,666 --> 00:46:04,206 I like it. 912 00:46:05,136 --> 00:46:07,206 All right, well, thanks again to our listeners. 913 00:46:07,206 --> 00:46:08,136 We love you. 914 00:46:08,136 --> 00:46:09,726 Uh, you're why we do this. 915 00:46:09,756 --> 00:46:12,336 Um, and uh, that is a wrap. 916 00:46:15,491 --> 00:46:20,171 The backup wrap up is written, recorded, and produced by me w Curtis Preston. 917 00:46:20,741 --> 00:46:22,211 If you need backup or Dr. 918 00:46:22,211 --> 00:46:25,841 Consulting content generation or expert witness work, 919 00:46:26,141 --> 00:46:28,121 check out backup central.com. 920 00:46:28,841 --> 00:46:31,961 You can also find links from my O'Reilly Books on the same website. 921 00:46:32,621 --> 00:46:36,611 Remember, this is an independent podcast and any opinions that 922 00:46:36,611 --> 00:46:40,511 you hear are those of the speaker and not necessarily an employer. 923 00:46:41,441 --> 00:46:42,131 Thanks for listening.