Run a tabletop and find the decision nobody owns

short · 45 min · Objective 4.8

Task

Run a tabletop exercise against a scenario with a deliberately awkward shape, and find the decisions that have no owner. Tabletops find decision gaps cheaply, and the gaps are always the same kind.

Steps

  1. Write the scenario into /tmp/scenario.md: ransomware detected on a file server at 02:40 on a public holiday, the head of security is unreachable, and the backup system's console is on the same domain.
  2. Work through the first hour in ten-minute increments, writing down every DECISION that has to be made — not every action.
  3. For each decision, name who has the authority to make it. Where the answer is 'the head of security', name the deputy, and where there is no deputy, mark it as a gap.
  4. Add the three injects that expose communication gaps: the corporate email is unavailable; a journalist calls the switchboard; and the regulator's notification clock is running.
  5. For each inject, record what you would do and what you would need to have prepared in advance to do it.
  6. Collect the gaps into /tmp/gaps.md, each with an owner and a date for closing it.

Verify

grep -c '^- ' /tmp/decisions.md
python3 - <<'PY'
import re
t=open('/tmp/decisions.md').read()
rows=[l for l in t.splitlines() if l.strip().startswith('- ')]
assert len(rows)>=8, 'fewer than eight decisions identified in the first hour'
noowner=[l for l in rows if 'owner:' not in l.lower()]
assert not noowner, 'decisions with no owner recorded: '+str(len(noowner))
gaps=open('/tmp/gaps.md').read()
assert re.search(r'\d{4}-\d{2}-\d{2}', gaps), 'no closing date on any gap'
print(len(rows),'decisions, every one with a named owner')
PY
grep -ciE "out.of.band|deputy|journalist|regulator" /tmp/gaps.md

Every decision must carry a named owner and every gap a closing date. A tabletop that produces a list of gaps and no dates is an interesting conversation, and the same gaps will be found again next year — which is the outcome the exercise exists to avoid.

Notes

The out-of-band communication inject catches nearly everyone. The contact list is in the email system, or on the intranet, or on the file server — and the scenario has taken all three away. A printed list in the on-call bag is an unglamorous control that decides how the first hour goes.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.