7. Table Top Incident Response Exercises with Kai Thomsen

Kai Thomsen, who was with Audi at the time of the session and now is with Dragos, goes over the why and how of ICS Incident Response Tabletop exercises.
You should have an Incident Response Plan before you run a tabletop exercise. The tabletop exercise is to train the team on the plan and make sure the plan has an actual chance of working. This will also help the team think critically through a thought exercise.
Some tips that caught my attention:
- He also suggests small scale “fire drills”, for the SOC, without the prior warning so they get used to the stress.
- Use VM’s from previous incidents for table top exercises
- Large-scale tabletops should involve leadership, but don’t make them look bad.
My favorite quote, “don’t create scenarios where everybody loses”.