CLICK HERE TO DOWNLOAD THIS IMAGE & COLOR IT IN!Un-engaging content. Limited resources. Irrelevant examples.
Yikes.
Any one of these ingredients can spell doom for your cybersecurity tabletop exercise, and ultimately your bottom line. If your TTX doesn't resonate with stakeholders and business owners, then they'll become disengaged.
The solution? A guide (like this one!) which walks you through the mysterious land of IR, and highlights cybersecurity training tools that inspire actual decision-making and engagement.
Read on to learn how to run your best TTX yet, and discover ways to transform findings into profitable takeaways for yourself and your clients.
Don’t worry, we’ll spare you the Star Wars reference. Instead, let’s take a walk down memory lane and pop open a potion of nostalgia to fuel your TTX worldbuilding.
If you're of a certain age, you may have seen the cartoon Where in the World is Carmen Sandiego?
If the name rings a bell, you can probably conjure the image already: red coat, fedora, globe-spanning capers. If not, a quick search will introduce you to one of the great tricksters of educational television.
TL;DR: One of the main draws of that show is the worldbuilding and lore surrounding the character.
She is memorable and distinct.
She is a villain with complexity.
She sports an unmistakable outfit.
And critically: She engages the audience members so well that they don't consciously recognize they're actually learning something while watching.
That’s exactly what IR training specialists need to do with their cybersecurity training sessions. A compelling TTX gives participants a world they can believe in, and a reason to care about what happens next. That's where the best learning (and the greatest value) lies.
“When I’m creating cybersecurity tabletop exercises,” states Sean Todd, CISO at Auditive, “I think about how I can recreate that immersion, that depth of emotion and personality like we see with Carmen Sandiego, and most importantly the buy-in the audience has for the character. Those are critical to making sure that your audience wants to learn and wants to participate.”
As the IR training consultant and “moderator” of the TTX, it’s your responsibility to ensure that stakeholders understand the world you've crafted for cybersecurity training. The first step to this process is cobbling together the basis of your story arc: Your characters, their motivations, and a thrilling, relevant plot.
Once you get at least one or two exercises written completely, you can re-use the world you’ve built and grow your audience's buy-in. This will change you from an outside IR consultant to a storyteller, a truth-seeker, and an active problem-solver with a dedicated seat alongside the team.
Practically speaking, you’ll also spend less time in the setup phase of future trainings since your audience will be familiar with the world you've created. So there’s high ROI involved for you, too.
All you have to do is lay the foundation, then consider each subsequent “scenario” as the next “episode” in a series that protects, defends, and secures your audience’s crown jewels.
Easy, right?
If we’re being realistic, most of your audience will have limited time to devote to your exercises. To help ensure you aren't missing key party members due to scheduling conflicts, consider breaking up the activity across smaller “episodes.”
Here’s an example of how you, the Facilitator, can break an insider threat scenario into bitesize chapters while still having a satisfying conclusion to each “episode.”
This episode lays the foundation for all others. It's your chance to describe the world in which your party members finds themselves. This will also be their first glimpse at evidence indicating that something has gone seriously wrong. At this point, there shouldn’t be enough info to point at a particular suspect, but there should be just enough to leave your party on a tantalizing cliffhanger. For example: "You've found undeniable proof that trade secrets are leaving your systems, but how? Who could be behind this? Can you catch the cyber bandit before they catch on to the investigation?"
In the next episode, your main job will be to help your party discover (and consider) the possibility that there might be one or more insiders helping facilitate the exfiltration from within the castle walls. World-build and explain, giving the party enough information to narrow the suspect pool down to just a few employees. (Our tip? Don’t be afraid to play devil’s advocate to help them really get into it. Go ahead, be chaotic neutral.)
Episode three is a classic mid-season plot twist. In this chapter, help the party commence employee investigations and interrogations. Have them try to find incontrovertible proof of the suspects. Guide them through, making sure that it isn't a false trail riddled with traps. In the end, give the party just enough information to throw suspicion on a higher-level employee (like an executive).
In the final episode, your audience will root out the insider threat network and tie it all together. Celebrate the victory, and follow it up with additional IR training steps, like an engaging debrief.
If you are using an external threat actor, you need to make sure that they are believable and ever-evolving.
For example: You could create a world where your kingdom is consistently targeted by an advanced band of cyber bandits. One scenario could involve them probing your systems, the next could be them successfully ransoming some part of your data, and the final scenario could be them seeking some sort of vengeance for being caught in the first two scenarios.
(Talk about thrilling!)
Once you’ve had a chance to establish your main villain's build, it’s time to infuse personality traits and superficial elements that make the evildoer feel real, believable, and raw. Remember that the more complete a character is, the more consistent and believable they become.
Much like society, your cybersecurity training needs to have a set of rules that governs how things work.
Many IR training experts and consultants have had success using a turn-based game style for their cybersecurity training exercises. If you choose to do this style of training, your participants will be given one action per round; much like a game of Dungeons & Dragons.
This game style has a ton of benefits, like ensuring that all party members have equal chance to contribute to the exercise. It also creates a sense of urgency and resource constraints that would materialize in a real response.
Nobody wants an IR training that drags on, even if they're having fun. Weaving in time constraints adds a splash of realism and boosts engagement.
Here are some creative ways you can add time-based pressure to your cybersecurity training:
Now that you have a well-defined world for your exercise, it’s time to cast excitement on your audience.
We recommend starting promotion a week or two ahead of the exercise by opening up a communication channel (like you would on Slack or Teams) for your audience. You can then use that channel throughout the week or month prior to the IR training to market the event and build some buzz.
Other tools you can wield both in and out of your newly-minted communication channel include:
The best board games involve some element of randomness, and your exercises should be no different. Less linear exercises encourage party members to think on the fly. To achieve this dynamic feeling, try including some event cards (think of the Chance cards in the game Monopoly) to add twists and turns to your exercise.
Here are a few ideas to get you started:
Make sure that when you create these cards, you include a balance of good and bad to balance risk and reward.
Just as a generation of children learned geography by watching Carmen Sandiego, you can master incident response to inspire your organization to learn all about information security threats and responses. All you have to do is use your imagination, create a miniature “world,” and lessen some of the setup time using modern tools. It’s never been easier to create a legendary TTX.
Ally was forged to help Facilitators craft tabletop exercises and conjure After-Action Reports in a flash. From running your first TTX to showing how preparedness improves from one encounter to the next, Ally helps keep the campaign moving.
Are you ready to master incident response training? Start your next TTX with Ally.
Make a cybersecurity tabletop exercise more engaging by giving participants a believable scenario, meaningful choices, and a reason to care about what happens next. Strong worldbuilding, relevant threat actors, time pressure, and unexpected turns help the team move beyond discussing a hypothetical and start making the kinds of decisions they would face during a real incident.
A good cybersecurity tabletop exercise scenario is relevant to the organization, grounded in believable threats, and built around decisions that matter. Give the scenario enough background to make the world feel real, then reveal information progressively through injects or episodes so participants have to investigate, adapt, and decide how their response should unfold.
A cybersecurity tabletop exercise can be structured in rounds or episodes that give participants clear opportunities to respond as the incident develops. Turn-based actions can prevent one voice from dominating the table, while tools like countdown timers, limited pauses, and escalating consequences keep the quest moving and introduce the resource constraints teams may face during a real response.
Add realism to a tabletop exercise by introducing the kinds of uncertainty, pressure, and disruption that complicate real incident response. Time limits, unavailable team members, cloud outages, competing priorities, and other chance encounters force participants to adapt rather than simply follow a predetermined script.
Sean Todd has been in the security field for more than a decade. He has built up security programs to meet the strictest requirements and built a positive and affirmative security.
Read more
About Ally Security
Ally is here to support TTX Facilitators in creating a virtuous cycle where exercises run more swiftly and frequently, deliver greater value, and bring organizations closer to true preparedness.
Dear Asa is your anonymous scroll to share triumphs, tribulations, and “you had to be there” moments. No names. No judgement. Just true incident response tales forged in the heat of battle.
