Crisis Table-top exercises can only test a team so far. When there isn't skin in the game, the pressure…
Dave M. — Cyber Security Director
Crisis Table-top exercises can only test a team so far. When there isn't skin in the game, the pressure isn't on, it's easy for people to game the exercise and you don't see the cracks as pressure builds. People know it's going to be an incident (it's not always clear you are in an incident until several hours of responding to an issue that grew arms and legs, and heads and an inexplicably hostile attitude) - and they know they can work their way through it - no real pressure - all smiles and laughs. It's not a test, not really.
I've thought about this recently.
Is it unethical to plan an away day for a leadership team, stick them in a hotel in the middle of nowhere, maybe with a nice spa. Far enough away they can't drop back to the office.
Then fake an incident on them. The people "back in the office" are reporting back, some key people are missing due to illness or similar, "stuff" is going wrong.
Then observe. When would it be an incident? How would they really react?
You can't do that right?, it's..... mean?
4 reactions · 3 comments
Comments
Jeff P.: DAVID WATSON MCKENZIE, this is sarcasm, right? Like dark, British humour? 🤣 Table-top exercises are a wonderfully effective way of practicing for an incident. Leadership, Communications, Finance, HR, IT, all together for a simulated walk-through of their incident response plan (if fortunate enough to have one & find it) is productive because there is no real pressure. I enjoy running exercises BE
Dave M.: Alas having seen multiple companies do the exercise and then have an incident - it is not the same.
Dave M.: Alas having seen multiple companies do the exercise and then have an incident - it is not the same.