The basis of our simulation is Bayes Bank vs D34DThr34t. Your “players” will be the CISO, CEO, CFO and CIO of that enterprise. Create a background page for the enterprise. Flesh out the infrastructure of the enterprise – what systems do they have, and what defensive controls would they have put in place? What level of security training and awareness would their users have? Try to be realistic – there is no way a small enterprise could possibly have a multi-million dollar budget for security appliances, a SOC and threat hunters, for example. You can assume that the players are reasonably well-informed. For example, the CISO is someone not unlike yourself – he understands the principles of cyber security, including incident response and risk management and was involved in writing many of the policies the enterprise has adopted. You should assume that the CIO is technically aware – he is not as engaged with cyber security as the CISO, but he has a greater knowledge of the enterprise’s systems and networks. You should assume that the CEO and CFO are aware of the cyber risk situation of the enterprise, but have only general awareness of threats, exploits, etc. The objective of your game is to teach your C-Suite the possible paths that a cyber security incident or breach could take, and expose them to the consequences of poor decisions. Next, select an appropriate adversary – for example, a motorcycle gang (Nefarious) is unlikely to have any interest in exploiting a government department (Ministry of Infrastructure Development) but they may well take an interest in somewhere they can make money or obtain illicit drugs.Next, develop the TTP’s your adversary would use; are they sophisticated hackers, novices, or a criminal syndicate who will pay others for their skills?Map the TTP’s against the cyber kill chain. For each stage, what technique or exploit could your adversary use the enterprise? Once you have done that, consider what evidence would be revealed by the controls of the defending enterprise. Would they see evidence of reconnaissance, for example? Could they spot delivery of malware at the firewall level? What would happen if the adversary is capable of developing and delivering a zero-day exploit? At what point will the enterprise become aware of suspicious activity? Is it worth notifying the CISO? Consider at what point the CISO may have to involve the CIO, CEO and CFO (remember, they are participants in this simulation exercise, so the attack should be serious enough for them to have to make some decisions). You should make the players apply the principles of analysis and synthesis in deciding how to respond to the events. At a lower level, you can assume the existence of some staff who are capable of undertaking technical tasks and who can respond to questions from your players. For example, you might offer the players the chance to ask the question, “How many of our systems are infected with this malware?”. Your answer could be any of several possibilities, ranging from “We have only found the malware on one system”, through “We have only found the malware on one system – so far” and “We’re not sure – we think the malware may have infected the Active Directory domain controller and has spread to other servers” to “We have no idea – it’s popping up everywhere and the Help Desk phone is ringing continually as more and more people report they cannot get any work done”.
Use the order calculator below and get started! Contact our live support team for any assistance or inquiry.
[order_calculator]