CLICK HERE TO DOWNLOAD THIS IMAGE & COLOR IT IN!Inside: A warlock sabotages ConnectWise’s cloud backup spell, cyber bandits (with a weird hatred for groceries) wreak havoc on a bustling merchants guild, and Ally opens a new portal for securely sharing After-Action Reports beyond your account.
What Happens When Your Cloud Backup Spell Fails?
When disaster strikes, cloud backups can serve as the ultimate recovery spell for resurrecting fallen systems. But what happens when an evil warlock sabotages your backup plan?
That's the predicament ConnectWise Cloud Backup customers are facing, following a recent cyber siege. The service remains suspended, leaving organizations unable to cast their recovery spells (unless they've got a second option tucked away somewhere). Meanwhile, potentially compromised client environments must be investigated individually to determine if rogues slipped past defenses amidst the chaos.
For MSPs and other cyber service providers, this is a scenario worth running. Imagine one of your most trusted vendors has been compromised, leaving your clients vulnerable and your strongest restoration spell unusable.
Run this as a standalone TTX, or unleash it as a surprise inject when your party believes victory is within reach. The next time someone declares "We'll just restore from backups" during an exercise, you'll have a nasty little curse ready to unravel their plans.
Your allies in IR,
Rob & Scout
Chaos in the Ahold Delhaize Merchants Guild
Commerce was booming across the Ahold Delhaize merchants guild, as grocery stalls like Food Lion, Giant, and Stop & Shop were bustling with townspeople. But when a band of cyber bandits threatened to disrupt trade, the guild was forced to shutter critical systems to contain the threat. While its physical stores remained open, online ordering, pharmacy operations, and other services were disrupted.
For Facilitators, this real-life incident presents a challenging scenario: How do you keep the marketplace moving while its underlying infrastructure is under siege? Which systems do you shutter to contain the threat, and how do you keep essential goods flowing to those who need them?
Explore the full Ahold Delhaize Incident Briefing for the complete tale, or run it as a TTX with your own org. We've added this as a 90-minute executive exercise to Ally's Scenario Library, featuring four injects that challenge your party to balance containment, business continuity, communication, and recovery.
Can your party keep the townspeople fed while containing the threat?
Share Your After-Action Reports Outside of Ally
.jpg)
Fashioned by Elvira!
Ally's new report sharing feature allows Facilitators to share full TTX After-Action Reports with clients and stakeholders, without requiring them to have an Ally account. Think Google Docs-style sharing infused with:
No more unnecessary barriers between your party and After-Action Reports. This simple, secure portal lets you get the right insights into the right hands.
That's all the wisdom we can squeeze onto this parchment! We'll return with a new batch of tales, tools, and tidings in next month's enchanting edition of Lore & Order. Fare thee well!
P.S. The next chapter of TTX Thursday takes place November 12. Claim your seat at the table and join live us at 2 PM ET!
Robert Henley is the Co‑Founder of Ally Security and brings over 15 years of experience in cybersecurity strategy, corporate development, and incident response. He’s passionate about helping organizations run more effective tabletop exercises.
Read more
About Ally Security
Ally is here to support TTX Facilitators in creating a virtuous cycle where exercises run more swiftly and frequently, deliver greater value, and bring organizations closer to true preparedness.
Dear Asa is your anonymous scroll to share triumphs, tribulations, and “you had to be there” moments. No names. No judgement. Just true incident response tales forged in the heat of battle.
