Tabletop Exercises, IR Playbooks, and Program Metrics

The IR program is the sum of its practices — tabletops, playbooks, and post-mortems are the feedback loops that prevent the same incident from happening twice.

Tabletop Exercise Design

TABLETOP EXERCISE TEMPLATE
===========================
Exercise: Ransomware + Data Exfiltration
Duration: 2 hours
Participants: CISO, SOC Lead, Legal Counsel, CFO, IT Director, Communications Lead
Facilitator: IR Program Manager

SCENARIO OVERVIEW:
[Provided to facilitator only — not shared with participants in advance]
A ransomware group (double extortion) gains access via a compromised vendor VPN credential,
dwell time = 3 weeks, deploys ransomware at 11 PM Friday, claims to have exfiltrated 
50,000 customer records including SSNs.

INJECTS (events introduced by facilitator at timed intervals):

T+0 min: "Your EDR detects mass file encryption on 3 file servers. Multiple encrypted 
file extensions appearing. SOC is paging. It is 11:15 PM."
  → Tests: After-hours escalation procedure, who gets the first call?

T+15 min: "Ransomware note found on file servers demands $2M in Bitcoin within 72 hours. 
Note claims attacker has exfiltrated customer records."
  → Tests: Who is the decision authority on payment consideration?
  → Tests: OFAC awareness — who knows to check the sanctions list?

T+30 min: "IT confirms 40 of 200 servers are encrypted. Backup system is also encrypted 
because it was on the same network segment."
  → Tests: Recovery planning without backups, knowledge of recovery options

T+45 min: "A reporter from the local news calls the main switchboard asking about 
'reports of a cyberattack.'"
  → Tests: Media protocol — who is authorized to speak? What do they say?

T+60 min: "Legal confirms customer data includes SSNs for California and EU residents. 
Time: Saturday 2 AM."
  → Tests: GDPR 72-hour clock awareness. State breach notification. Who owns this?

T+75 min: "FBI Cyber Division calls offering assistance."
  → Tests: LE engagement protocol, evidence preservation concerns

T+90 min: Debrief
  → What decisions were hard? What information was missing? What processes failed?

FACILITATOR OBSERVATION CHECKLIST:
☐ Was decision authority clear for each major decision?
☐ Were the right people reachable after hours?
☐ Did legal know the GDPR 72-hour clock started?
☐ Did anyone mention OFAC before the payment discussion?
☐ Was the communication protocol clear (media, employees, customers)?
☐ Were evidence preservation concerns mentioned before remediation?

IR Playbook Template

# PLAYBOOK: Ransomware Response

**Trigger**: EDR alert for mass file rename/encryption OR encrypted file extensions 
detected on file/print servers OR user reports inability to open files

**Severity**: P1 — Immediate response required
**On-Call Contact**: SOC Manager → CISO → Legal (in this order)

---

## Phase 1: FIRST 30 MINUTES — Triage and Verify

☐ Verify alert is not false positive:
  → Count of affected file extensions vs. baseline (>50 in 5 min = confirmed)
  → Check file server for ransom note: C:\Windows, C:\Users\Public, each data directory

☐ Preserve volatile evidence (BEFORE isolation):
  → netstat -ano >> C:\IR\netstat_[timestamp].txt
  → tasklist /v >> C:\IR\tasklist_[timestamp].txt
  → Take memory image if time permits (winpmem)

☐ ISOLATE affected systems:
  → Block at switch level (VLAN change) OR
  → Firewall ACL blocking all traffic from affected subnets
  → Do NOT power off — memory evidence lost

☐ Notify: SOC Manager — verbal, immediately
  → "Confirmed ransomware on [systems]. I have isolated. Requesting escalation to P1."

---

## Phase 2: 30-90 MINUTES — Scope and Escalate

☐ Identify patient zero: which system was encrypted FIRST (earliest timestamp)
☐ Map lateral movement: who did patient zero connect to in the 24h before encryption
☐ Identify initial access vector (EDR + email gateway + VPN logs)
☐ Assess backup status: are backups intact and not on encrypted network segment?

☐ Notify: CISO — call if 9PM-7AM, page if unresponsive
  → Brief: "Ransomware confirmed on [X] systems since [time]. Isolated. 
           Investigating scope. Backups [status]. Legal notification [pending/complete]."

☐ Notify: Legal Counsel — call after-hours line
  → "We have a confirmed ransomware incident. Data exfiltration may be involved. 
    Need breach notification assessment. Please call back immediately."

---

## Phase 3: 2-12 HOURS — Investigation and Decision

☐ Run full EDR timeline on patient zero
☐ Review VPN logs for unusual access in 30 days before incident
☐ Identify any data exfiltration evidence (DNS, netflow, proxy logs)
☐ OFAC check if payment discussion begins (legal counsel leads)

☐ Decision point: Pay vs. Restore?
  Decision authority: [Name, Title]
  Required information: Backup viability, exfiltration scope, ransom amount, OFAC status

---

## Communication Templates

**Internal (all staff) — approved by CISO before sending:**
"We are experiencing a technical issue affecting [systems]. IT is working to restore 
service. Please do not attempt to access [affected systems]. We will provide an update 
by [time]. Contact the helpdesk for urgent requests."

**Legal notification — insert in call:**
"[Date/time], we are notifying you of a potential data security incident. 
Systems affected: [list]. Data at risk: [categories]. Investigation ongoing.
We need immediate legal guidance on breach notification obligations."

Program Metrics Dashboard

IR PROGRAM METRICS — Q3 2024
==============================

DETECTION METRICS:
  MTTD (Mean Time to Detect): 4.2 hours (Q2: 6.8 hours) ↓ Improving
  Dwell time (confirmed incidents): 18 hours median (target: <24 hours) ✓
  Detection source breakdown:
    - EDR alert: 67%
    - User report: 22%
    - External notification: 11%
  Alert false-positive rate: 34% (target: <20%) ⚠ Needs improvement

RESPONSE METRICS:
  MTTC (Mean Time to Contain): 2.1 hours (Q2: 3.4 hours) ↓ Improving
  MTTE (Mean Time to Eradicate): 14 hours (stable)
  MTTR (Mean Time to Recover): 28 hours (Q2: 31 hours) ↓ Improving

PROGRAM MATURITY:
  Playbook coverage: 78% of incident types (target: 90%) ⚠
  Post-mortem completion: 100% of P1/P2 incidents ✓
  Post-mortem action completion (60 days): 61% (target: 80%) ⚠
  Tabletop exercises this quarter: 2 (target: 1/quarter) ✓

OPEN RECOMMENDATIONS FROM Q2:
  [Priority 1] Implement VLAN isolation capability for remote containment — Owner: Network — DUE: Oct 1
  [Priority 1] Document after-hours legal counsel contact — Owner: Legal — OVERDUE ⚠
  [Priority 2] Deploy deception technologies (honeypots) — Owner: SOC — DUE: Dec 31

Retrieval Practice

After a major incident, the post-mortem reveals that the analyst who first received the alert did not escalate for 4 hours because 'I wasn't sure if it was real.' This 4-hour delay gave the attacker time to exfiltrate data. How would a blameless post-mortem handle this, and what recommendations would it generate?

Reveal answer

Blameless framing: the analyst made a reasonable decision given the information they had at the time. The question is: what systemic conditions made uncertainty the rational response? Investigation questions: (1) What did the alert look like? Was it clearly labeled as high-severity ransomware, or was it an ambiguous 'suspicious file activity' with a medium severity? (2) Was there escalation criteria in the playbook that the analyst could reference? Or was escalation based on personal judgment? (3) Had the analyst seen similar alerts that turned out to be false positives? High false-positive rate trains analysts to be skeptical of real alerts — false positive management is a systemic issue. (4) Was the analyst authorized to escalate a P1 at 2am, or did they fear waking someone for a false alarm? (5) Were there other data points the analyst could have checked to verify (backup system alert, user reports) that they were unaware of? Blameless recommendations: (1) Update the playbook to include explicit escalation criteria: 'If alert shows >10 file renames in 60 seconds, escalate to P1 regardless of certainty — false positives are acceptable at P1 threshold.' (2) Add a 'verify in 15 minutes and escalate if not conclusively resolved' rule for ambiguous high-severity alerts. (3) Review and reduce alert false-positive rate for file activity detection (the root cause of analyst skepticism). (4) Add a 'when in doubt, escalate' principle to the IR program charter — emphasize that false alarms are preferred over delayed response. The blameless approach generates 4 systemic improvements from one incident; a blame-based approach generates 'tell the analyst to escalate sooner' — which changes nothing about the next analyst in the same situation.