Latest / CYBR.Signal / Practicing Tabletop Exercises

Transcript

Practicing Tabletop Exercises · CYBR.Signal

• 0:00
  SPEAKER_00: And hello everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:03
  SPEAKER_00: I think we've all heard the idea that it takes 10,000 hours of practice to be an expert in something.
• 0:11
  SPEAKER_00: Now I've read some places somewhere that have, I don't know, disproven that, but basically just say it's it's a false premise.
• 0:19
  SPEAKER_00: There's different ways of practicing and that kind of thing.
• 0:23
  SPEAKER_00: But in general, the concept is you've even if you don't think that that's exactly right, you you've got to take time and practice to be good at something, no matter what it is, in general, or to be an expert at it anyway, but you you definitely need to practice.
• 0:39
  SPEAKER_00: So that's that concept, that idea immediately came up in my mind when my friend Peter posted on the idea of practicing for tabletop exercises.
• 0:54
  SPEAKER_00: So, yeah, I've talked about tabletop exercises on here uh a lot, but he made a great point that he made an analogy that it looked like if you're playing hockey, or if you're in a, I think he said Philharmonic, you know, like an orchestra, something like that.
• 1:12
  SPEAKER_00: If you're in those, or if you're going to see those, you're going to see a hockey game, or you're going to see an orchestra play and spend the money, the hundreds and you know, possibly thousands of dollars to go see something like that, that you expect it to be really good.
• 1:28
  SPEAKER_00: And you expect it to be good, and usually it's going to be good, typically, especially if you're seeing a profess a professional hockey team or a professional football team or a professional orchestra, because they practice a lot.
• 1:41
  SPEAKER_00: They practice a whole lot.
• 1:43
  SPEAKER_00: And he used that analogy to say, why do we limit ourselves to one to four tabletop exercises per year?
• 1:51
  SPEAKER_00: We have to practice those in order to get good at them.
• 1:54
  SPEAKER_00: And it's a great point.
• 1:55
  SPEAKER_00: You you absolutely do have to practice it.
• 1:56
  SPEAKER_00: Now, I I don't think Peter would say that you have to practice 10,000 hours to be obviously that a little crazy.
• 2:04
  SPEAKER_00: But it what it also brought up in my mind was me being at uh customer a few weeks ago and kind of sitting on the sidelines while I performed a tabletop exercise.
• 2:16
  SPEAKER_00: And I think I've mentioned it on Cyber Sunday before this particular instance, but this tabletop exercise was not limited or was not uh among the like IT and the cybersecurity group.
• 2:28
  SPEAKER_00: And it was it was broader than that at a higher level with business unit leaders from all kinds of different business units, legal and finance, and think it was HR and some other groups in there.
• 2:42
  SPEAKER_00: So the point is that if you're at that level, uh that that's the kind of level of tabletop exercise you're doing.
• 2:49
  SPEAKER_00: It's extremely hard to get them together more than probably a couple times a year to do a half day exercise like they did that way.
• 2:58
  SPEAKER_00: And I I know that actually doesn't sound like a whole lot, but I mean that those people have got a lot of work to do that's not cybersecurity focused.
• 3:06
  SPEAKER_00: They've got to do a lot of other stuff.
• 3:08
  SPEAKER_00: Same way, just if you're just in cybersecurity, you've still got to do your day-to-day job.
• 3:13
  SPEAKER_00: So, how do you do tabletop exercises more than a few times a year when everybody's got other stuff to do, especially if they're not in cybersecurity?
• 3:24
  SPEAKER_00: So somebody made the point down in the comments, and I'll post, I'll put a link to Peter's post in this.
• 3:30
  SPEAKER_00: They made a comment of using tools like Threat Gen, my my buddy Clint, and his uh his company, which I've been involved with a lot, where they do tabletop exercises with a tool.
• 3:41
  SPEAKER_00: And that's a great idea.
• 3:43
  SPEAKER_00: It's the efficiency that you need to build into that process in order to get the practice you need without having to take all of those people into a room multiple times a year and going over that.
• 3:57
  SPEAKER_00: So there's efficiencies you can build in using tools.
• 4:00
  SPEAKER_00: And AI, yes, I said it, everybody drink, has enabled that a lot, and Clint is using that in his tool.
• 4:07
  SPEAKER_00: There's also a matter of just having plans in place that people can review on a regular basis.
• 4:14
  SPEAKER_00: You could tell that that team, that company I was at, they had a pretty good plan.
• 4:18
  SPEAKER_00: There was some gaps in it, and they that's why they were doing it to find that out.
• 4:22
  SPEAKER_00: But getting a plan in place like that is absolutely what you need.
• 4:26
  SPEAKER_00: Does that mean you have to get everybody in the room to practice that plan multiple times a year?
• 4:30
  SPEAKER_00: Maybe, maybe not.
• 4:31
  SPEAKER_00: Can you use tools with that plan in it or have people review that plan?
• 4:36
  SPEAKER_00: Yes.
• 4:37
  SPEAKER_00: Do you need to do the practice to find out where the gaps are in the plan?
• 4:41
  SPEAKER_00: Absolutely.
• 4:42
  SPEAKER_00: 100% agree with Peter on that.
• 4:44
  SPEAKER_00: Again, I don't think he would mean you've got to get people together 40 times a year, but you do have to get people together, but you've got to figure out ways of being more efficient with it so everybody in their different roles can keep doing their jobs.
• 4:57
  SPEAKER_00: So think about ways of being efficient with your tabletop exercises, of getting that knowledge in people's head of how the path needs to work, of practicing it, reviewing it, being efficient with it, maybe limiting those things to an hour when you do them if you can do them.
• 5:13
  SPEAKER_00: Those are the kind of things you do, you need to do so you can practice those tabletop exercises, but not be such a heavy burden that nobody wants to do them.
• 5:21
  SPEAKER_00: Because that's what you run into the danger of is like everybody's like, this is too heavy of a burden.
• 5:26
  SPEAKER_00: I can't do it.
• 5:27
  SPEAKER_00: So let me know what you think.
• 5:28
  SPEAKER_00: Give me some other ideas you've got for building efficient tabletop exercises and doing that throughout the year.
• 5:33
  SPEAKER_00: Talk to you next time.