How can you choose between live and tabletop simulations for Incident Response Scenarios?

Live simulations are more realistic & better than tabletop exercises for incident response because they are more realistic, test technical capabilities, and can help organizations identify & address vulnerabilities in their incident response plans while improving their incident response times. The NHS's experience in 2017 with the WannaCry ransomware attack shows that tabletop exercises are insufficient to prepare for a real-world attack. If you are serious about protecting your organization from cyberattacks, you should consider conducting live simulations as part of your incident response plan which includes Security professionals working on Operational work roles as participants & stakeholders as the target audience of the exercise.

Organization must develop and maintain a process to respond quickly and effectively to manage failures of security controls. This ensures that as the external threats bypass the security controls, the organization platform protection is restored, damages are contained and reversed and all supporting processes and infrastructure are adjusted to maintain protection for customer data ongoing. Tabletop exercises are not realistic but they are good to raise IR awareness and assess the maturity of staff and IR team. Members of the core and extended IRT shall engage in training and drills to verify they can effectively fulfil the roles required in the IR procedure. Overall testing your IRP is the key to readiness for the real time incident.

Tabletop simulations aren't enough to secure IT infrastructure because they are not realistic and do not test technical capabilities. The City of Atlanta, Georgia, conducted a live simulation of a ransomware attack in 2016. The simulation exposed several vulnerabilities in the city's IT systems and helped the city to improve its incident response plan. As a result, the City of Atlanta was able to recover from the WannaCry attack much more quickly than the NHS. If you are serious about protecting your organization's IT infrastructure, you should consider conducting live simulations as part of your security plan. Participants are unable to predict the outcomes of various technical decisions unless they are implemented in real-time.

Here are some factors to consider when choosing between live simulations and tabletop exercises: - 1. Size and complexity: Larger organizations may need live simulations, smaller ones may be okay with tabletop exercises. 2. Budget and time: Live simulations are more expensive and time-consuming. 3. Risk: Live simulations are riskier than tabletop exercises. 4. Learning objectives: Live simulations test technical skills, tabletop exercises test knowledge, awareness, and judgment. I suggest, in addition to these factors, one must also consider the organization's specific needs and work culture, employee nuances, etc. One of the best ways to choose is to conduct a cost-benefit analysis (CBA).

To choose between live and tabletop simulations for Incident Response Scenarios, I combine both approaches, using tabletop walkthroughs and different live simulations, ensuring senior staff are well-prepared through general briefings, and then review the outcomes against about 50 criteria to identify areas for improvement, which makes the process both thorough and engaging.

I have experienced a live simulation exercise helping a BFSI sector company I was working for detecting a ransomware attack in real-time via a FIM solution. The company conducted regular live simulation exercises which included Managerial as well as Technical personnel. The exercise was first planned in a Tabletop fashion and then implemented as a Live Simulation. During one such exercise, the company's FIM solution detected a ransomware attack. The company contained the attack and prevented damage. This exercise helped the company improve its incident response plan and response time as well. Eventually, the cyber security team in that company learned to use the FIM solution to detect ransomware.