Performing tabletop exercises
Covering how to run a tabletop exercise is beyond the scope of this book. However, think of it as an exercise on paper and role playing without the actual operational activities being performed. Since time with the executives of an organization is usually quite limited, a proper scenario can help a lot to guide everyone through scenarios such as threat analysis, escalation, response decisions, and remediation flow. Let's go over some ideas for tabletop exercises. Some of them are also scenarios that would be impossible to perform as a real-world emulation.
As we mentioned previously, there are red teaming scenarios that are too complex or expensive to perform and some are legally off limits. Such scenarios often entertain more strategic and analytical aspects that are best explored on paper and go beyond typical cyber operational red teaming engagements.
Here are some examples of possible tabletop exercises:
- Blackmail and scenarios...
