Possible cyber AttackScenarios

• Senior Management and their roles
• Blue team responder and their roles
• Facilitator, observer and evaluator roles

In this step the scenario , prerequisites , architecture and communication technicalities are introduced to the participating teams

• One DayWorkshop with Identified team member
• Technical briefing on purple Range
• Tool introduction
• Knowledge dump through recorded videos and assistance
• Preparation Methodology defined
• Definition of Goals
• Explanation of Virtual Team mode of operation
• Email, Phone , Wassap data collection for war - room entry
• Test understanding

• Introduction
• Incident Response Team
• Incident Detection and Reporting
• Incident Assessment and Classification Communication and Stakeholder Management Incident Containment and Mitigation
• Investigation and Forensics
• Business Continuity and Recovery
• Legal and Regulatory Compliance
• Lessons Learned and Improvement
• Training and Awareness
• Plan Maintenance and Review

• Scenario Run for Blue team
• Management team in observer Mode
• Facilitator invokes
• Evaluator to Record
• Team put in two seperate rooms
• Collaboration across rooms through different channels
• Management involved through Evaluation Questions and actions taken
• Collapsed outcome provided at the end of day

• Establish a clear chain of command.
• Identify and isolate the affected systems.
• Communicate with stakeholders and coordinate response efforts.