No Industry IS Safe

In response to what we see happening around us, Online's Risk, Security, and Privacy team of cybersecurity professionals have designed Tabletop Exercises specifically to meet the requirements of organizations looking to build a strong incident response plan and strengthen their security posture.

As technology is becoming more valuable to businesses and is evolving at a rapid pace, it is important to improve defense strategies and processes to be able to quickly identify and respond to vulnerabilities before they are exploited. Data breaches and ransomware attacks are on the rise due to increased remote work environments, expanded supply chains, and highly sought-after PII and sensitive data. Incident response and cybersecurity are more important now than ever before, and organizations are tasked with integrating new policies and procedures into their general IT operations to protect against costly security breaches.

In this post, we want to share some additional information about Tabletop Exercises, why we think they are so valuable, and how they work.

What is a Tabletop Exercise?

A Tabletop Exercise is a hands-on simulation designed to bring organizational awareness to potential security incidents and to identify gaps in your incident response plan. Additionally, this type of interactive exercise identifies areas for more focused training as organizations look to protect themselves against security breaches.

In a controlled environment, Tabletop Exercises are designed to be low-stress and are customized to the unique business requirements of each organization. They allow teams to come together in a safe place to assess the in-place procedures and plans, leaving the session with deliverables to build into the existing security program.

In 2022, data breaches in the top five industries – Healthcare, Financial, Pharmaceutical, Technology, and Energy – in the US cost businesses an average of $5.25 million USD per incident, with 82% reporting more than one breach annually.

Although, Healthcare has the highest number of reported security breaches over all other sectors, critical infrastructure organizations were also impacted greatly. 28% of those in financial services, industrial, technology, energy, transportation, communication, education and public sector industries reported ransomware attacks, while 17% experienced a breach because of a business partner being compromised.

The top five countries and regions for the highest average cost of a data breach were the United States at USD 9.44 million, Canada at USD 5.64 million, and the EMEA regoin at USD 17.36 million.
Source: IBM

Sourc: IBM

Right-Sized Tabletop Exercise

Online’s security team has put together a bundle of services to identify the needs of your business and integrate security measures that meet the requirements of your evolving security program – from Security Risk Assessments to Incident Response Planning and Tabletop Exercises.

Working with our clients, our cybersecurity professionals facilitate workshops to train representatives from each part of the business on the concepts of security incident response preparation and execution – Tabletop Exercises are key components of each workshop. The Tabletop Exercises are customized using real-life scenarios as learning events and are intentionally designed to address common threats and ultimately train participants to know how to respond to incidents before they happen.

The typical format for Tabletop Exercises involves:

1 – Set the Stage.

A successful tabletop simulation is a direct result of preparation, so we dig deep and work to ensure the exercises are designed to be realistic and simulate attacks that are relevant to the business.

2 – Get the Right People in the Room.

Determining who should be involved in the exercises is critical to a successful outcome. Around the table, we'll bring in Operations, IT, Security management, and other members from Incident Response teams. We encourage including members from Human Resources, Legal, C-Suite, senior management, and risk/compliance. You will quickly discover how these scenarios touch every part of the organization!

3 – Encourage Discussion.

Facilitator-led group discussions, with a focus on process and dialogue, start the exercise to review the effectiveness of strategies and tactics. A lot can be discovered in an open forum discussion in a round table format, failures and all.

4 – Add Complex Challenges.

The introduction of additional challenges to the presented scenarios are introduced to widen the scope of cybersecurity problem-solving. As the name indicates, these exercises present simulated cyberattack situations for your team to navigate.

5 – Key Takeaways.

There is always something to learn in every organization. Following the exercise, participants will better understand how to handle a security incident of any shape, size, and type. Together, we will review the gaps and failures identified, discuss action items to help improve security weaknesses and build on the strengths within the organization.

Over and over again we hear from workshop participants how helpful and eye-opening the Tabletop Exercises are. What excites us, even more, is how we are seeing the outcomes from these sessions help mature the security program, and ultimately the security posture of participating organizations.

If you are interested in learning more about the Tabletop Exercises our RSP team delivers, we’d love to hear from you. Get in touch today.

Follow this link to find additional information about our Cybersecurity Advisory Services >>>