Effective cyber defense is a combination of people, technology, and processes. Clearly defined roles and responsibilities, employee education, and high level of awareness of potential risks, together with the use of carefully selected modern technologies, provide robust protection against cyber-attacks for organizations.
The primary objective of cyber defense is not only to prevent an attack, but to ensure system resilience and business continuity. In the event of an incident, the organization must be able to continue operating with minimal financial, operational, and reputational consequences. Therefore, defense capabilities must be continuously evaluated and improved.
Attackers continuously enhance and adapt their attack techniques. According to available analyses, attackers are primarily focused on identifying vulnerabilities on endpoints, i.e., workstations and mobile devices, and infiltrating organizations via VPN access. Various studies estimate that the human factor is involved in approximately 60% of security incidents. Given this high percentage, the question is no longer whether an incident will occur, but how quickly it will be recognized, who makes the decisions and how communication will be managed.
Can You Be Sure That Your Defense Truly Works?
Procedures and plans often look good “on paper”, but it is necessary to verify how they function in practice. Several key questions must be clearly defined and understood across the entire organization:
- Who makes the decisions? Who leads the incident response team and what is required for key “go/no-go” decisions? Who declares a security incident?
- What does the escalation process look like? Who is informed and at what point?
- How are teams across different departments coordinated? Which departments need to be involved – IT Support, IT Infrastructure, Legal, PR, the Management?
- Who is responsible for communication towards employees, clients, media, regulatory authorities, and insurers?
- What recovery timeframe is expected? Are the planned recovery time and recovery scope realistic?
If all employees are familiar with these procedures and are able to apply them in practice, it can be said that cyber defense is effective in this segment. However, it is important to periodically evaluate knowledge and readiness. One of the most effective methods is conducting Tabletop exercises.
What Are Tabletop Exercises?
Tabletop exercises are structured simulation exercises in which participants walk through a realistic security incident scenario. The objective is to evaluate organizational preparedness, the clarity of procedures and the ability to make decisions under pressure.
Exercises are conducted in controlled conditions, but reflect real business circumstances and time pressure. Participants are assigned roles and responsibilities, and the scenario develops through different phases of an incident, building awareness of the distinction between a security event, including an activity with the potential for a threat, and a security incident, where malicious activity has been confirmed.
For example: If an employee receives a suspicious e-mail and reports it to the security team, this is considered a security event. If the employee opens the attachment and malicious software (e.g. Ransomware) begins encrypting data, this constitutes a security incident. Clear classification is essential to ensure that a critical incident does not pass without appropriate escalation.
Tabletop exercises are recommended practice under recognized standards and methodologies such as ISO 27001, NIST CSF and ISO 22301 for Business Continuity Management.
Example of a Tabletop Scenario
It is Monday, at 8:30 a.m. The Sales Department is submitting a major proposal. The Accounting Department is processing payroll and initiating salary payments. The Infrastructure Department is preparing the replacement of key firewall devices.
The IT Support and Information Security Department detects increased traffic towards malicious addresses, while at the same time issues arise with the availability of web services, websites, and critical applications. A Distributed Denial-of-Service (DDoS) attack is suspected, affecting remote work and web services.
Participants in the exercise are assigned defined roles and responsibilities and are required to verify:
- Who leads the incident and maintains situational awareness
- Who owns specific activities (SOC, Network, Infrastructure, Applications)
- When a crisis is declared and the Crisis Management Team activated
- How services and business processes are prioritized
- How internal and external communication is carried out
Participants in the exercise discuss the information available, categorize the event, and decide which steps will be taken.
WHAT IF THE STORY BECOMES PUBLIC?
While efforts are underway to resolve the incident, new developments frequently occur and additional pressures arise. The number of calls to the Service Desk and Customer Support have increased. Clients begin asking questions regarding availability and security. Media inquiries are received, and information spreads through online channels and social media.
For this reason, Tabletop exercises also include non-technical incident management decisions, including: what is communicated externally and what remains internal, who provides statements and in what tone, how Legal, PR and operational teams are aligned, and how the decision-making process is documented for regulatory and insurance purposes.
THE MOST DIFFICULT QUESTION – TO PAY THE RANSOM OR NOT?
According to recent analyses, Ransomware is present in 44% of security incidents. However, there is a growing trend of organizations refusing to pay (64%).
Within a Tabletop exercise, the decision on whether to pay a ransom is analyzed in accordance with defined management procedures and risk assessments:
- Reviewing contractual obligations towards clients and partners
- If cyber insurance is in place, informing and involving the insurer and the Legal Department
- Assessing sanctions-related and reputational risks
- Developing a recovery plan and communication plan
When making the decision, it is important to consider that even when a decryption key is provided, recovery may be slow and parts of the system may remain damaged. Participants are encouraged to assess the organization’s readiness to continue operations, including implemented Business Continuity Planning (BCP) and Disaster Recovery (DR) solutions, as well as post-recovery integrity validation.
What Do You Gain After a Tabletop Exercise?
A high-quality exercise concludes with a concrete analysis of what and how can be improved in the security event management process. The result is an After Action Report, which includes an analysis of successful and unsuccessful steps, together with an Action Plan for process owners and deadlines to close identified gaps and raise the organization’s security level.
Tabletop exercises also enable verification of regulatory compliance. They ensure that reporting deadlines towards competent authorities are not merely theoretical, but that it is clearly defined who gathers the facts, who approves the content and who submits the notification.
Under the GDPR, supervisory authorities must be notified within 72 hours of becoming aware of a security incident when it is probable that it carries a risk to the rights and freedoms of natural persons.
For entities subject to the NIS2 Directive, deadlines for reporting a “significant” incident include an early signal (within 24 hours), an additional notification (within 72 hours) and a final report (generally within one month), subject to national implementation specifics.
Regular Tabletop exercises transform documented plans into genuine operational readiness. When an incident occurs, it is no longer the time for improvisation, but for a rehearsed reaction.
KING ICT Helps Strengthen Security, Ensure Compliance and Manage Risks Effectively
KING ICT, through its CSOC (Cyber Security Operations Center), provides continuous monitoring, threat detection, and response services, together with experience in managing incident situations and coordinating multiple teams.
In addition, we conduct the described Tabletop simulation exercises, tailored to organizational architecture, processes and regulatory obligations.
Through realistic scenarios, we evaluate decision-making, processes and communication, delivering a measurable improvement plan as the result.
Visit the KING ICT CSOC page to learn more about our services.
Contact us for an initial discussion
