Cyber Incident Response Tabletop Exercise

Tabletop exercises are vital for implementing a robust CIR (cyber incident response) plan within your organisation. These simulations train your team to respond to real cyber incidents swiftly and effectively by identifying vulnerabilities and weaknesses in your defences.
They foster collaboration among departments, ensuring everyone is prepared and aligned in their roles. By refining response strategies and addressing gaps, tabletop exercises boost your organisation’s resilience against cyber attacks.
Agenda
The significance of CIR and key stages in the incident response process using NIST SP 800-61 Revision 2.
Live CIR tabletop ransomware and phishing attack exercises with audience participation.
Responses and techniques to mitigate the impact of cyber security incidents.
GRCI Law’s CIR products and how they can benefit your organisation.

[@MrZaytova]

This was not a waste of time this is great for company’s that need processes updated or built because certain questions have not been answered or thought of before. Also great exposure for a tabletop exercise.
One recommendation: if not speaking then maybe mute and turn of camera. No need to be on camera/audio if not speaking. Just easier on those presenting and not needing the pressure of just sitting on camera if that person is not the focus at the time.

[@carmendestefano1780]

This went right over your head at the speed of light, didn't it? Lmao

[@pramodppal]

How do you take polls in the PPT ?

[@vernimotinga1277]

where can I find these slides

[@neilbaal6758]

If half of HR clicked link and entered their credentials then threat actor has likely captured an authentication token and has logged into one of the accounts, they could set a mass forwarding rule or copy off emails, or exfiltrate documents, so as well as resetting all of the HR users passwords you should revoke all sessions, this would force out the threat actor who could no longer login as the password is changed and the user would be prompted for MFA.

[@jcornwall6228]

Spot on. That's exactly what we do. Revoking tokens and resetting passwords are definitely a must

[@neilbaal6758]

Agreed, shame it was missed here, makes me wonder is this all theory being presented