Your Complete Guide to a Successful Cyber Attack Tabletop Exercise

If you read our monthly cyber attack, ransomware attack and data breach updates, you’ll know how cyber attacks are everywhere. They’re becoming increasingly sophisticated and proliferated. It is absolutely essential for businesses to fortify their defences with the greatest agility and precision. And one of the most important and powerful tools in the arsenal of cybersecurity preparedness is the Cyber Security Tabletop Exercise.

In this comprehensive guide, we delve into all the details of Cyber Crisis Tabletop Exercises (also known as Cyber Drills).  We show you what makes them critical to boosting your cyber resilience.  

This comprehensive guide includes: 

1. 1. What are Cybersecurity Drills? 
   2. Why are Cyber Attack Drills so important?
   3. Best Practices for a Successful Cyber Tabletop Exercise
   4. Key Benefits of Cyber Tabletop Exercises
   5. Key components of an effective Cyber Drill Exercise
   6. Who should participate in Cyber Tabletop Exercises? 
   7. Cyber Tabletop Exercise Scenarios to rehearse for 
   8. How to Make the Most of Your Cyber Security Drill? 
   9. Why Choose Specialised External Facilitators for your Cyber Security Drills?  

What are Cyber Crisis Tabletop Exercises? 

Cybersecurity tabletop exercises test your organisation’s ability to successfully respond to cybersecurity incidents. They have emerged as a key component of cyber incident management. 

Focussed more on the human element, these cyber drills simulate cyber tabletop exercise scenarios that mimic real-world cyber threats to your specific organisation. They allow you to gauge the ability of your security team and other important stakeholders to respond correctly to security incidents. They then allow you to refine your cyber incident response plans and strategy. You can also identify the need to provide more training in Cyber Incident Planning and Response if required. 

These exercises must involve key stakeholders and give them a chance to rehearse the incident response and disaster recovery plans. With regular Tabletop Exercises, your incident response plans, ransomware response checklists and other communication templates become a part of the muscle memory. This means that there are lesser chances of them taking a wrong decision or acting in haste during the panic that a cyber attack induces. 

The best part is that this testing happens in a controlled environment and absolutely no disruption to regular business operations. Think of it as an inexpensive Pentest! It allows you to evaluate your organisation's ability to detect, respond to, and recover from cyber incidents. The debrief session is an ideal chance to plug any gaps that currently exist in your cybersecurity posture. 

Why are Cyber Attack Tabletop Exercises So Important? 

Cyber Attack Tabletop Exercises are based on the same logic as that in the aviation industry which trains pilots on a flight simulator bi-annually. The flight simulator presents pilots with several aviation emergencies and tests how they respond to those potentially disastrous situations. For a pilot to pass his simulation exam, they must be really well-versed with the technology of the aircraft they are flying. They also need to be conversant with the checklists provided by the airline and the aircraft manufacturer. 

These flight simulators not only test the pilot’s mettle, but also allow them to practise for emergencies that they (hopefully) don’t see on a regular basis in air. However, if they unfortunately do have an engine failure or a bird-hit, they almost instinctively know what to do as they’ve been rehearsing for it regularly throughout their aviation career. 

This sort of instinctive good decision-making is precisely what Cyber Tabletop Exercises can achieve if done correctly and regularly.  

This analogy, hopefully, explained what makes Cybersecurity Drills critical in the current threat landscape. In the next section, we look at specific ways in which you can make the most of your Tabletop Drills.  

Best Practices for Conducting Cyber Attack Tabletop Exercises 

Cyber Tabletop Exercises must be conducted with a razor-sharp focus on the scenario being rehearsed and the outcomes expected. While we always recommend hiring an external facilitator for your cyber drill, it may not always be possible. You can always check out our Masterclass on How to Conduct an Effective Cyber Tabletop Exercise created by one of the world's leading cyber drill facilitator. 

We have also created several free resources that use you can use to make sure you get the most out of your tabletop exercise: 

1. Cyber Tabletop Exercise Template 
2. Top Cybersecurity Tabletop Exercise Scenarios
3. Cyber Tabletop Exercise PPT

Use these resources in combination with the points covered next and you'll definitely be in a better position to plan and produce an effective internal workshop. 

• Define clear objectives: Clearly define the objectives and desired outcomes of the tabletop exercise. Whether it is testing incident response plans, evaluating the effectiveness of communication channels, or identifying vulnerabilities, having specific goals ensures the exercise remains focused and meaningful.
  
  
• Develop realistic and detailed scenarios: Design scenarios that are actually relevant to your organisation and organisational context. The threats discussed should be those that could actually impact your business and its most critical assets. Use our comprehensive list of scenarios and pick and improvise on one that suits your needs the most. This also enables participants to engage with the exercise more effectively and draw practical insights from the experience.
  
  At Cyber Management Alliance, our expert facilitators are known to spend a lot of time with the key point of contact from the client’s side. We take time to understand the business, the various organisational functions and work with the client representative to come up with a scenario that will actually hit home for the participants.  
  
  
• Choose the stakeholders carefully: Involve individuals from different departments and levels of seniority to gain a comprehensive understanding of the organisation's cybersecurity preparedness. This diversity helps uncover different perspectives, identifies communication gaps, and highlights areas where coordination is crucial.
  
  If you want a more focussed approach, then you can opt for Cyber Tabletop Exercises that are tailored to specific groups of participants. For example, we run different types of workshops for varied audiences including: 

1. Cyber Attack Tabletop Exercise for Executives
2. Technical Cyber Attack Tabletop Exercise
3. Operational Cyber Attack Tabletop Exercise
   
   

• Encourage open and constructive discussions: Foster an environment where participants feel comfortable sharing their insights, concerns, and ideas. Encourage open discussions to facilitate knowledge sharing, collaboration, and the exploration of alternative approaches to addressing cyber threats.
  
  
• Document lessons learned: After the exercise, the facilitator shares a detailed report or Executive Summary with their observations from the exercise and how each participant contributed. This report contains critical key takeaways and lessons learned. 
  
  This executive summary serves as a valuable resource for future reference, enabling the organisation to implement necessary improvements and measure progress over time.

The Significance of Cybersecurity Tabletop Exercises

1. Realistic Scenario Simulations: One of the most compelling reasons to conduct tabletop exercises is that they simulate real life attack scenarios. Ideally, your cyber security drill scenario should be specific to your organisation, industry and geography. The scenario, if prepared by an expert (more on that later), should feel extremely real to the participating team members. 
   
   A realistic and bespoke scenario can truly bring out the impact that a real cyber attack could have on your business. It not only builds awareness but also encourages participants to think and act like they would in case of an actual information security disaster.   
   
   A well-designed Cyber Tabletop Exercise scenario will evolve over layers. The facilitator should ideally introduce new information over different phases and use injects at specific intervals to make the scenario as lifelike as possible.  
   
   

2. Stakeholder Collaboration: Effective cybersecurity involves collaboration among various departments and teams within an organisation. Tabletop exercises provide a platform for stakeholders, including IT, legal, HR, PR and management and incident response teams to come together and collaborate. This approach ensures that everyone understands their roles and responsibilities during a cyber crisis. 
   
   More importantly, however, it helps participants see the critical role other colleagues and teams play in overall cybersecurity. This tremendously improves inter-departmental collaboration and communication and minimises chances of blame-games during stressful attack situations. 

3. Evaluation of Incident Response Capabilities: Tabletop exercises serve as a litmus test for the effectiveness of your cyber incident response plans and cyber resilience abilities. They allow for the identification of gaps and bottlenecks in your incident response process.
   
   As you rehearse your response to calamities caused by cyber crime, you’ll clearly begin to see where your organisational weaknesses lie. In many cases, facets of incident response that you have never thought about will emerge. 
   
   These could be as basic as - who will talk to the press about the incident. They could also be as pertinent as - do you need to enlist the services of external cybersecurity experts or Cyber Incident Response Retainer Services.  
   
   

4. Decision-Making Practice: Cybersecurity tabletop exercises offer an opportunity for decision-makers to practise critical thinking under pressure. The scenarios are usually evolving and layered, forcing participants to make quick, informed decisions. This practice enhances decision-making skills and fosters a proactive response to cyber threats. 
   
   The primary idea is that participants learn how to think in a crisis situation. The Cyber Security Drills sharpen their decision making capabilities and help them understand the importance of quick but calm thinking under pressure. 
   
   

Key Components of a Cybersecurity Tabletop Exercise 

• Fact Finding - Tabletop exercises have to be in tune with your specific business. Building on the analogy above, there’s no point in a pilot rehearsing for disasters on an Airbus when he’ll actually be flying a Boeing, is there? When choosing an external facilitator, make sure they’re deeply committed to detailed fact finding about your business’s systems, processes, vulnerabilities and threats. They should also gather information about your third-parties, technology stack and regulatory protocols.
  
  

• Scenario Development - If your facilitator is making you practise with a generic scenario, run away! The scenario is everything in a cybersecurity drill and that’s why at Cyber Management Alliance we only do bespoke scenarios. Our facilitators spend a lot of time with the client to create a scenario that’s deeply contextual and extremely relevant to their specific business structure. If the scenario doesn’t feel real, don’t expect real reactions and responses from your team.
   

• Stakeholder Participation - For the success of your Cyber Attack Tabletop Exercise, it is imperative to choose the correct group of participants. Involve a diverse group of stakeholders, including IT personnel, legal experts, public relations, and management representatives. You may also choose to conduct a specific type of Crisis Exercise in which case the participant group should reflect that.
  
  

• Expert Facilitation - This is an absolute essential. Appoint a skilled facilitator who can guide the exercise, introduce new challenges, and keep participants engaged.They must have the right balance of technical knowledge and people skills. We delve more deeply into this later.
  
  

• Documentation - It’s important to thoroughly document the exercise to evaluate where the gaps exist. Documentation also helps in understanding the lessons learned, participants’ responses and feedback and the facilitator’s view on your organisational cyber resilience. Post-exercise analysis and improvement is as important to the drill as post-incident analysis is after a security event.

Recommended Participants in a Cyber Tabletop Exercise 

It’s important to choose the stakeholders who take part in the Cyber Tabletop Exercise carefully. Depending on the type of exercise - technical, operational or executive - the participants must reflect a good mix of organisational departments. 

Here’s a general list of stakeholders we recommend should be involved in Cyber Security Drills: 

Executive: 

• Board/Directors, CEO, Chairpersons, Executive Directors, Board of Directors 
• Executive Leadership (COO, CIO, CISO, IT Director)
• Head of Information Security 
• Head of Audit 
• Head of Compliance
• Legal Head
• Human Resources Head
• PR & Communications Lead              
  
  

Technical:    

• Systems Architects
• Network Specialists
• Windows / Linux specialists
• Cloud Infra Specialists
• SoC / Security analysts
• IT Security engineers
• Database Administrators
• Technical/Configuration specialist
• Product owners
• Change Management Expert
  
  

Operational:  

• Crisis Management Team, Cybersecurity Incident Response Team
• Crisis Communications Team
• Middle Management 
• Operations Managers
• Legal and Public Relations Team representatives 
• Regulatory, Data Privacy Team
• Human Resources Team
• Business Continuity Managers/Teams

Cyber Tabletop Exercise Scenarios to Rehearse For 

There is a wide range of cyber security drill scenarios that you can rehearse with. Some of the most common and relevant ones are as under: 

1. Ransomware Attack
2. Supply Chain Attack
3. Enterprise system compromise
4. Cyber Extortion
5. Critical DB Exfiltration
6. Azure/AWS Outage
7. Active Directory Compromised
8. Insider Data Exfiltration
9. DDoS Attack on Website
10. Financial Systems Compromised

We recently hosted what was one of the largest in-person Cyber Attack Tabletop Exercises in London. The exercise, a part of our flagship Wisdom of Crowds event, saw participation from some of the leading Information Security professionals in the UK. They worked together in groups to create extremely useful, collaborative content on Attack Scenarios, Threat Actors to Watch out for and the most critical Assets to protect. 

Read more on the top Cyber Security Tabletop Exercise Scenarios in our free download containing this wealth of user-generated collateral. 

How to Make the Most of Your Cyber Security Drill? 

A successful cyber crisis tabletop exercise has certain specific nuances. Unlike a traditional training, the objective here is not merely transferring knowledge and/or answering questions. 

The success of a Cyber Security Drill rests on how well the participants have been empowered to respond better to cyber attacks. It’s about them and the organisation feeling more confident in their preparedness against cyber crime. 

Below are some of the important aspects of a Cyber Security Tabletop Exercise that actually make it effective: 

1. Clear Objectives and Goals: Before diving into the intricacies of cybersecurity, it's imperative to establish clear objectives and goals for your workshop. What do you want your participants to achieve by the end of the session? Are you aiming to enhance their understanding of cybersecurity best practices, improve incident response, or strengthen their ability to detect threats? 
   
   Defining specific, measurable, achievable and relevant objectives will guide your workshop's content and activities. These goals will serve as the foundation upon which you build your workshop, ensuring that every component aligns with your desired outcomes.
   
   Setting clear goals also involves a focus on the stakeholders. Do you want to enhance the Board’s engagement with cybersecurity? Do you want to upskill your technical team? Are you more focused on operational continuity after an attack? 
   
   At Cyber Management Alliance, we have created specific Tabletop Exercises to cater to specific stakeholders - the operational tabletop exercise, the executive tabletop exercise and the technical tabletop exercise. The idea is that each exercise should clearly meet the organisation’s core goals from the cyber drill. 
   
   
2. Bespoke Scenarios: One size does not fit all when it comes to cybersecurity tabletop exercises. You have to find a facilitator who is deeply committed to fact finding and scenario building. 
   
   They must spend time with the assigned representative from your business to truly understand the operations, the current technology stack and the relevant threats and risks. The scenario must be specific to your business. This is the only way to truly engage the participants and elicit the right responses from them. 
   
   The scenario must also have the right injects (geopolitical, media, regulatory etc.) for the exercise to be truly fruitful. 
   
   

3. Engaging and Empowering Participants: Passive learning rarely leads to effective cybersecurity knowledge retention or good decision-making. To keep your participants engaged and to empower them with practical skills, the exercise has to mandatorily be interactive. 
   
   It should be peppered with opportunities for participants to apply their knowledge through hands-on exercises, simulations, and role-playing scenarios. 
   
   We often use the ‘Group Discussion’ format during our cybersecurity drills to allow participants to work together, share inputs and foster a collaborative learning environment. 
   
   
4. Expert Facilitators: This one goes without saying - Scenario Creation, Realistic Simulation and Engagement all depend on how good the facilitator is. 
   
   If your facilitator hasn’t been a cybersecurity practitioner, the chances of your participants being fully engaged are slim. But just being in the trenches of cybersecurity incident response isn't enough - you need to look for someone who is known to be interactive. 
   
   Ideally choose a facilitator who conducts cyber security drills on a regular basis and is a skilled communicator. Technical knowledge, real-world experience and awareness of latest trends and vulnerabilities are, of course, critical. 

5. Post-Exercise Evaluation: The exercise should be followed by an evaluation report. We, at Cyber Management Alliance, for example, provide our clients with a Management Report or an Executive Summary after the drill. 
   
   This report answers the single most critical question - How Ready Are You to Deal with a Cyber Attack, Data Breach or Ransomware Attack? 
   
   The report or evaluation should contain a summary of the exercise, how effective it was and where the gaps lay. More importantly, it should also contain recommendations from the facilitator on how to enhance Incident Response capabilities and what weaknesses need to be worked upon immediately.    
   
   

Why Choose Specialised External Facilitators for your Cyber Security Drills?

It's natural for many organisations to want to conduct their cyber drills internally. The motivation usually is that it appears to be a more cost effective and convenient option. 

However, in this case, the potential drawbacks far outweigh the benefits. Outsourcing this critical process to experts offers a more neutral, realistic, and comprehensive evaluation of your organisation's preparedness. By doing so, you'll be better positioned to defend against the ever-evolving threat landscape of cyber and ransomware attacks. 

It’s important to remember - the cost of hiring a specialised facilitator will never surpass the cost of a mismanaged cyber incident. 

Here are some of the most important reasons why you should bring in external expertise: 

1. Neutrality - When you conduct a tabletop exercise internally, it's challenging to maintain neutrality. Your in-house team may be too close to the organisation's systems and processes, making it difficult to simulate a truly objective and realistic scenario. They also don’t have preference for a particular department over another.
   
   An external facilitator brings an unbiased perspective, ensuring that the exercise closely mirrors the unpredictability of a real-life cyberattack. Further, no participant will feel that the feedback shared by the facilitator is coloured by their personal preferences. This improves the likelihood of everyone working on the post-exercise recommendations seriously.  
   
   

2. Expertise - Cyber attacks are complex and continually evolving. Running an exercise without the guidance of cybersecurity experts can result in oversights and inaccuracies. Experienced facilitators possess in-depth knowledge of ransomware tactics, attack techniques, and malicious software, enabling them to craft compelling scenarios that mimic the latest threats accurately. This expertise is invaluable in helping your organisation identify vulnerabilities and fine-tune your response strategy.Their evaluation and feedback is also more valuable as it is based on years of real-world experience. 
   
   

3. Realistic Testing - An effective tabletop exercise should recreate the chaos and urgency of an actual attack. Professional facilitators have the experience to inject realism into the exercise, challenging your team to make critical decisions under pressure. They can simulate the rapid escalation of a ransomware incident or data breach, allowing your organisation to gauge its readiness and identify areas that require improvement. 
   
   

4. Comprehensive Evaluation - A cyber crisis tabletop exercise isn't just about going through the motions; it's an opportunity to assess your organisation's response capabilities comprehensively. External facilitators can provide objective evaluation of your team's performance, highlighting strengths and weaknesses. Their feedback can inform necessary enhancements to your incident response plan, ensuring that your organisation is better equipped to handle a real ransomware attack. And as discussed above, this feedback is generally more appreciated as it comes from an objective outsider.