alphaPlan · Cybersecurity · Cheat-sheet 09

Capstone Talk-through Drill

A five-part story of a week under attack that you talk through, alone or in a group, to put the whole course to work.

Ideas to remember

01A talk-through drill (tabletop exercise, TTX) is a story you discuss, not a test: nobody touches a real system.
02Monday is phishing and a stolen password; a familiar looking sign-in page that asks for your email password is the moment the outcome could change.
03Tuesday is an account takeover that MFA and a quick report can stop: approval prompts you did not start mean someone has your password.
04Wednesday is payment fraud (BEC), beaten by confirming a change of bank details on a number you already had on file.
05Thursday is ransomware, where a recent, tested backup is the real defence and paying gives no guarantee.
06Friday is reporting and trust, where early honesty costs less than silence.

Tabletop exercise (TTX): A guided scenario teams talk through to rehearse an incident before they ever have one.
Inject: One part of the scenario: a new event that the group reads, then decides how to answer.
Confidence rating: Your 1 to 5 rating before and after the drill; a number that stays low shows where to look next.
Ransomware: Files encrypted with a demand for payment to unlock them; the way in here was an 'invoice' attachment.

Rate your confidence from 1 to 5 before you start and again at the end, and set aside about 45 minutes.
Alone: write down your decision for each part before reading the next one, honestly, as on a busy day.
In a group: read each part aloud, give everyone two minutes, then discuss.
At every step ask one question: what is the calm, simple thing to do here?
Walk back through the week in the debrief and map each turn onto the course.

Treating the drill as a test of cleverness; it is a rehearsal of habits, and none of the fixes needed a security team.
Trusting an invoice because the number matches a real order; the supplier itself may have been breached weeks earlier.
Thinking a backup made 'a while ago' will save you; it must be recent and tested.

Found something unclear, outdated or improvable? Suggest an improvement