Initial commit - 611 cybersecurity skills across all subdomains

2026-07-24 05:30:58 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,48 @@
+# Standards & References - Ransomware Tabletop Exercise
+
+## Exercise Standards
+
+### FEMA HSEEP (Homeland Security Exercise and Evaluation Program)
+- Standardized methodology for exercise design, conduct, and evaluation
+- Defines exercise types: seminars, workshops, tabletops, drills, functional, full-scale
+- Provides templates for exercise plans, evaluation guides, and AARs
+- https://www.fema.gov/emergency-managers/national-preparedness/exercises/hseep
+
+### NIST SP 800-84: Guide to Test, Training, and Exercise Programs
+- Framework for developing IT plan test and exercise programs
+- Section 4.3: Tabletop exercises for incident response testing
+- Covers exercise scoping, objectives, scenario development, and evaluation
+
+### CISA Tabletop Exercise Packages (CTEPs)
+- Free downloadable exercise scenarios for critical infrastructure sectors
+- Ransomware-specific scenarios updated to reflect current threat landscape
+- https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages
+
+## Ransomware-Specific Guidance
+
+### CISA #StopRansomware Guide
+- Ransomware response checklist that exercises should validate
+- Decision tree for ransom payment considerations
+- Recovery priority guidance
+
+### NIST IR 8374: Ransomware Risk Management
+- Identifies exercise testing as a key control in the Recover function
+- Recommends annual tabletop exercises with escalating complexity
+
+### FBI/CISA Joint Advisories
+- AA24-131A: Black Basta Ransomware
+- AA23-136A: BianLian Ransomware Group
+- AA23-158A: CL0P Ransomware Gang Exploiting MOVEit
+- Use these as source material for realistic exercise scenarios
+
+## Regulatory Notification Requirements (for Scenario Design)
+
+| Regulation | Notification Timeline | Authority |
+|-----------|----------------------|-----------|
+| GDPR (EU) | 72 hours | Supervisory Authority |
+| HIPAA (US Healthcare) | 60 days (individuals), ASAP (HHS if >500) | HHS OCR |
+| SEC (US Public Companies) | 4 business days (Form 8-K) | SEC |
+| PCI DSS | 72 hours | Card brands/acquiring bank |
+| NY DFS (23 NYCRR 500) | 72 hours | NY DFS |
+| CCPA (California) | "Expedient time" | California AG |
+| NIS2 (EU) | 24 hours (early warning), 72 hours (full) | National CSIRT |
@@ -0,0 +1,139 @@
+# Workflows - Ransomware Tabletop Exercise
+
+## Workflow 1: Exercise Planning (4-6 weeks before)
+
+```
+Start
+  |
+  v
+[Define exercise objectives] --> What gaps are we testing?
+  |
+  v
+[Select scenario type]
+  |-- Double extortion (data theft + encryption)
+  |-- Supply chain ransomware (vendor compromise)
+  |-- Cloud ransomware (SaaS/IaaS targeted)
+  |-- Critical infrastructure disruption
+  |
+  v
+[Choose threat actor model] --> LockBit / ALPHV / Cl0p / Rhysida
+  |
+  v
+[Identify participants]
+  |-- Executive leadership (CEO, CFO, COO)
+  |-- IT/Security (CISO, SOC, IR team)
+  |-- Legal (General Counsel, external counsel)
+  |-- Communications (PR, media relations)
+  |-- Operations (business unit leaders)
+  |-- HR (employee communications)
+  |-- External partners (IR firm, insurance)
+  |
+  v
+[Develop scenario with 4 phases and injects]
+  |
+  v
+[Prepare materials: SITREPs, inject cards, evaluation scorecard]
+  |
+  v
+[Schedule 3-4 hour block, distribute pre-reading]
+  |
+  v
+End
+```
+
+## Workflow 2: Exercise Execution
+
+```
+Exercise Start
+  |
+  v
+[Facilitator opening brief] (10 min)
+  |-- Ground rules, objectives, scope
+  |-- "This is discussion-based, no wrong answers"
+  |
+  v
+[Phase 1: Initial Detection] (30 min)
+  |-- Distribute SITREP 1
+  |-- Discussion: Who, what, when, initial actions
+  |-- Inject: Additional information changes situation
+  |-- Document decisions on worksheet
+  |
+  v
+[Phase 2: Escalation] (30 min)
+  |-- Distribute SITREP 2
+  |-- Discussion: Scope of impact, containment actions
+  |-- Inject: Double extortion element introduced
+  |-- Document decisions
+  |
+  v
+[Break] (10 min)
+  |
+  v
+[Phase 3: Critical Decision Points] (45 min)
+  |-- Distribute SITREP 3
+  |-- Discussion: Ransom payment, law enforcement, notification
+  |-- Inject: Public pressure from media/customers
+  |-- Document decisions with rationale
+  |
+  v
+[Phase 4: Recovery and Communication] (45 min)
+  |-- Distribute SITREP 4
+  |-- Discussion: Recovery priority, timeline, customer comms
+  |-- Inject: Recovery complication (infected backup, key system fails)
+  |-- Document decisions
+  |
+  v
+[Hot wash / Debrief] (20 min)
+  |-- Each functional area shares top insight
+  |-- Facilitator highlights key observations
+  |-- Immediate gap identification
+  |
+  v
+Exercise End
+```
+
+## Workflow 3: After-Action Report Development
+
+```
+Exercise Complete
+  |
+  v
+[Collect all documentation within 24 hours]
+  |-- Decision worksheets
+  |-- Facilitator notes
+  |-- Evaluation scorecards
+  |-- Observer notes (if separate observers present)
+  |
+  v
+[Score each evaluation area (1-5)]
+  |
+  v
+[Identify strengths (what worked well)]
+  |
+  v
+[Identify gaps with severity rating]
+  |-- Critical: Would prevent effective response
+  |-- High: Would significantly delay/complicate response
+  |-- Medium: Would reduce response quality
+  |-- Low: Minor improvement opportunity
+  |
+  v
+[Develop remediation actions]
+  |-- Each gap gets: action, owner, deadline, priority
+  |-- Must be specific and measurable
+  |
+  v
+[Draft AAR within 5 business days]
+  |
+  v
+[Review AAR with exercise sponsor]
+  |
+  v
+[Distribute AAR to participants]
+  |
+  v
+[Track remediation actions quarterly]
+  |
+  v
+End
+```