Attack simulations

Is your organization prepared for a cyber attack?

Real world cyber attacks typically use a combination of “technical” hacking, and “softer” attacks (such social engineering). The best way to reduce the risks of cyber attacks is by practicing your organization-wide response, and stress testing the way your defense layers work together.

Attack simulations help businesses practice and improve their organizational response. They provide an opportunity to face attack scenarios within a safe and controlled environment. Simulating cyber attacks periodically provides the best method for testing and exercising your organization’s cyber security program as a whole, practicing outside-the-box thinking while managing and recovering from a cyber attack, and raising general awareness to cyber security risks and mitigation methods.

Involving organizational leadership

While a majority of the organization’s leadership and staff won’t typically have details of planned simulated scenarios, we encourage having a small group of organizational leaders join the attack team to help coordinate the attack and keep track of the organization’s response.

Having members of the organization’s leadership “behind the scenes” and involved in the “offense” side of the process gives them a first-hand perspective of how cyber attacks – and defenses – work. This has been proven to be an effective means for raising awareness and greatly improving organizations’ overall security.

The process

Define goals and targets

Cyfenders works with you to define a set of goals and targets based on your organization’s unique circumstances. The organization’s risk factors, such as the sensitivity of information it manages, the technologies it uses, as well as recent attack trends are all used to identify potential targets of a real-world attack – making the simulation as realistic as possible.

Plan the attack

With the goals and targets identified, the attack team gathers technical and operational information about the organization, its systems, and its work processes. This information is then used to develop a detailed attack plan which is approved by the organization prior to its execution.

During this process, the attack team will also list the actions it expects to see from the defending team based on your organization’s existing policies and procedures. The expected responses are later compared to the actual responses, and are used to help improve the policies, procedures, and the overall effectiveness of your cyber security program.

Execute

Much like the initial steps of a real attack, simulations will typically try to stay “under the radar” initially, with actions that will become more visible as the simulation progresses. Depending on the unique circumstances of the simulation, and the approved plan of attack, the simulation will likely combine intelligence gathering, technical hacking tactics, and social engineering in an attempt to mimic the actions performed by hackers.

After-action report and debrief

Upon completion of the simulation, the attack team delivers an after-action report detailing the simulation and its results. The report is presented during a debriefing session that brings together members of the attack team, and the organization’s leadership, technical and security teams.

Debriefing sessions are an important and valuable part of the simulation as they help build a complete picture of the attack and the response to it. The session provides an opportunity to examine the organization’s response to the attack in a professional setting that helps improve the organization’s readiness for potential attacks in the future.