How to Orchestrate a Cyber Security Incident Tabletop Exercise
summary
Walks through concrete tabletop scenarios: a SQL injection that stays 10 months undetected because logs aren’t centralized, an Active Directory script that locks every account (5-fail lockout for 30 minutes, attacker runs every 31 minutes) and mitigations like backup domain admin accounts and an account-lockout analyzer, and a mass phishing campaign that forces a company-wide password reset versus targeted resets. Covers needed log sources, SIEM/central collector, MITRE ATT&CK, Pyramid of Pain, and tools (Hybrid Analysis, VirusTotal, Joe’s Sandbox) and which detections actually work.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 1:28What is a security incident
- 3:40Real incident case study
- 5:31Importance of logging and detection
- 6:38Indicators of compromise explained
- 7:41Data vs intelligence in IR
- 9:07Six phases of incident response
- 10:33Preparation phase and tabletop exercises
- 12:23Designing tabletop exercises
- 13:31Formal tabletop exercise structure
- 16:22Interactive tabletop exercise demo 1
- 18:27Interactive tabletop exercise demo 2
- 22:12Interactive tabletop exercise demo 3
- 29:09Handling a data breach scenario
- 30:14Q&A and closing remarks
related talks
59mBackdoors & Breaches: Live Tabletop Exercise Demo
01h 08mBackdoors & Breaches: Live Tabletop Exercise Demo
49mTraining for Incident Response: The Red, the Blue, and the Ugly
40mAs Worlds Collide: Responding to Cyber Events in a Converged IT/OT Universe
54mSOCcing: Responding to a Cyber Incident
40mAdversary Simulation: Close the Gaps in Your Security Posture
40mIncident Response – How to Give the Advantage to the Hackers!
27mThe Offensive Approach to Cybersecurity