Incident Response Exercises

Last updated Feb 27, 2023

• Seed
• Security

• 3 main forms
  • Tabletop
    • Least costly
    • Facilitator presents a scenario and the responders explain what action they would take
    • Does not use computer systems
    • Usually uses flashcards
  • Walkthroughs
    • Facilitator present a scenario, like in tabletop
    • Responders demonstrate rather than explain what actions they would take
  • Simulations
    • Most costly
    • Red team attempts and intrusion while blue team operates response and recovery controls
    • White team moderates and evaluates the exercise