Cyber crisis exercise: rehearse on the tool you will use on the day

Many organisations now have a business continuity plan, an on-call rota and a set of response sheets stored on a file server. On the day of a cyber attack, part of that set-up often becomes unusable, because the server is encrypted, the email system is compromised or nobody can find the latest version of the crisis directory. A crisis exercise is the way to discover these gaps before an attacker does, provided it runs on the tools that will actually be used on the day.
 

Why rehearse on the back-up tool

 
ANSSI, the French national cybersecurity agency, has published a reference guide on organising a cyber crisis management exercise, and the same idea runs through it: an exercise is only worth something if participants work in conditions close to reality. A crisis team that rehearses in its usual meeting room, with its own laptops and corporate email, learns little about how it would cope if those tools were gone.

Regulation points the same way. DORA requires financial entities to test their continuity plans regularly, and NIS2 asks essential and important entities to include crisis management and business continuity among their security measures. In both cases the organisation must be able to show that its arrangements have been tested.
 

Preparing the platform before the exercise

 
Whaller RESILIENCE is a collaborative platform that is independent of your information system, set up in calm times and ready to activate at any moment. Before running an exercise, a few settings deserve care, because they are what will save time when a real crisis hits.

Directories are imported in batches, with no automatic synchronisation with your information system, so that a compromise cannot spread to the back-up platform. You therefore need to decide who imports these lists and how often, so that leavers and joiners are taken into account. Spheres are then organised by decision circle: one for the strategic team, one for the technical team, one for legal and communications, and another for contacts at your main suppliers. Each sphere is visible only to authorised members.

Finally, anything that must remain available when the file server is encrypted should be stored in advance: response sheets, a crisis directory with numbers that can be reached outside company tools, message templates for each audience, notification templates for the data protection or sector authority, and contact details for your insurer and incident response provider.

Running the exercise on Whaller RESILIENCE

 
The scenario can stay simple: ransomware encrypting the servers on a Friday evening, a data leak announced by an attacker on a forum, or the prolonged outage of a critical supplier. What matters is that participants discover the situation as it unfolds, through messages injected by the facilitation team into the platform’s spheres.

During the exercise, the team uses the tools it would have in a real crisis: discussion threads and instant messaging to communicate, video calls for situation updates, co-editing to keep a single version of the incident log and the agreed messages, and tasks to share out actions. Because every exchange is time-stamped, the facilitators can later rebuild a precise timeline of the decisions taken.

Regulatory deadlines make useful milestones. The team can be asked to prepare a NIS2 early warning within 24 hours, then a notification to the data protection authority within 72 hours. The exercise then shows whether the necessary information is available and whether the right people can be reached.
 

Making the most of the debrief

 
The debrief takes place twice, immediately after the exercise and again a few days later. The timeline kept in Whaller RESILIENCE provides an objective basis for discussion, whether about the time needed to bring the team together, the information that was missing or the decisions that came too late. The resulting action plan can be followed up in a dedicated sphere until the next exercise.

The same platform also serves for crises that have nothing to do with IT, such as an industrial accident, a natural disaster or the evacuation of an employee abroad. A successful exercise therefore benefits the whole business continuity plan. Whaller RESILIENCE is developed and hosted in France, and Whaller holds the Numérique France Garanti label.

Prepare your next exercise with Whaller RESILIENCE

Further reading

• Whaller RESILIENCE: the full presentation
• Cybersecurity: what if your employees became your best line of defence?
• Whaller: sovereign collaborative platform for French defence stakeholders
• Numérique France Garanti: putting an end to unverified sovereignty claims