Run a tabletop and find the decision nobody owns

short · 45 min · Objective 4.7

Task

Run a tabletop exercise against a scenario with a deliberately awkward shape, and find the decisions that have no owner. Tabletops find decision gaps cheaply, and the gaps are always the same kind.

Steps

  1. Write the scenario into /tmp/scenario.md: ransomware detected on a file server at 02:40 on a public holiday, the head of security is unreachable, and the backup system's console is on the same domain.
  2. Work through the first hour in ten-minute increments, writing down every DECISION that has to be made — not every action.
  3. For each decision, name who has the authority to make it. Where the answer is 'the head of security', name the deputy, and where there is no deputy, mark it as a gap.
  4. Add the four injects that expose communication and authority gaps: the corporate email is unavailable; a journalist calls the switchboard; the regulator's notification clock is running (72 hours from awareness, if personal data is involved and GDPR applies); and a ransom note offers a discount for payment within 24 hours.
  5. For the ransom inject, write down who may decide on payment, who checks whether the group is under sanctions, and what the cyber insurance policy requires before any response or negotiation firm is engaged. If the answer to any of those is 'we would find out on the night', it is a gap.
  6. For each inject, record what you would do and what you would need to have prepared in advance to do it.
  7. Collect the gaps into /tmp/gaps.md, each with an owner and a date for closing it, written as YYYY-MM-DD.

Files the Verify reads

The Verify block reads these by name, so save them exactly here:

  • /tmp/decisions.md -- the decisions from steps 2 and 3, one per line starting - , each naming who has the authority as owner: <role>, e.g. - 02:50 isolate the file server from the network -- owner: on-call infrastructure lead.

Verify

grep -c '^- ' /tmp/decisions.md
python3 - <<'PY'
import re
t=open('/tmp/decisions.md').read()
rows=[l for l in t.splitlines() if l.strip().startswith('- ')]
assert len(rows)>=8, 'fewer than eight decisions identified in the first hour'
noowner=[l for l in rows if 'owner:' not in l.lower()]
assert not noowner, 'decisions with no owner recorded: '+str(len(noowner))
gaps=open('/tmp/gaps.md').read()
assert re.search(r'\d{4}-\d{2}-\d{2}', gaps), 'no closing date on any gap'
print(len(rows),'decisions, every one with a named owner')
PY
grep -ciE "out.of.band|deputy|journalist|regulator" /tmp/gaps.md
grep -ciE "ransom|sanction|insur" /tmp/gaps.md

Every decision must carry a named owner and every gap a closing date. A tabletop that produces a list of gaps and no dates is an interesting conversation, and the same gaps will be found again next year — which is the outcome the exercise exists to avoid.

Notes

The out-of-band communication inject catches nearly everyone. The contact list is in the email system, or on the intranet, or on the file server — and the scenario has taken all three away. A printed list in the on-call bag is an unglamorous control that decides how the first hour goes.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.