Your submission was sent successfully! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates from Canonical and upcoming events where you can meet our team.Close

Thank you for contacting our team. We will be in touch shortly.Close

  1. Blog
  2. Article

joemcmanus
on 10 March 2020

On boxing, tabletop exercises and threat models


‘Everybody has a plan until they get hit. Then, like a rat, they stop in fear and freeze.’ Mike Tyson

At Canonical we have recently performed a series of cyber tabletop exercises (TTX). A TTX is an information security preparedness drill where a cyber incident scenario is played out to improve your tactics, techniques and procedures (TTPs).  When performing a TTX it is important to use the same amount of staff and effort as though a real incident were occuring. This helps to uncover deficiencies in your TTPs and address those issues before a real event occurs. Being as efficient as possible is critical during incident response because as time passes data that can help determine root cause is lost and the attacker may still be causing harm to the environment. 

This past month we performed two TTXs with different groups within Canonical. This type of exercise requires support from the top down, you will be interrupting work for up to a day and it is imperative that the management of each team is behind this effort. At Canonical security is in our DNA and this exercise was performed with full support of everyone within the company. 

When performing a TTX it is important to not only include your engineering teams but also include representatives from each organizational unit; support, web, marketing, etc. For our TTX we measure our success by tracking time from the malicious act, detection, reaction, internal communication, external communication and remediation. Each subsequent TTX should be more efficient than the previous.

To aid in construction of our TTX scenarios the Ubuntu Security team produces threat models of our products and services. By performing a threat model we can identify weaknesses, work with the engineering product owners to prioritize fixes and use the threat model to create realistic TTX events.  We use the STRIDE methodology for threat modelling, which breaks threats in to 6 categories:

  • Spoofing
  • Tampering
  • Repudiation
  • Information disclosure
  • Denial of service
  • Elevation of privilege

Cyber incidents can happen, it is imperative that part of your overall security plan not only include preventative measures but also include reactive plans. As Ben Franklin is often credited with saying “ if you fail to plan, you are planning to fail”.  How we react to an incident is as important as how we strive to prevent them. By exercising your cyber response plans you will be better prepared if a hack happens. If you have any questions about setting up your own threat models or table top exercise just let us know – @ubuntu_sec on twitter.

Related posts


amir-abdelbaki
20 June 2024

From support engineering to UX: Piper’s career progression at Canonical

Ubuntu Article

Career progression is crucial to employee engagement and retention. At Canonical, we encourage employees to develop their own personal development journeys,  giving them the chance to apply internally for roles they are passionate about, even if they come from different technical backgrounds. We love seeing our people grow and develop. We ...


Philip Williams
20 June 2024

Navigating the cost of cloud storage in the public sector

Ceph Article

Like many other industries, organisations in the public sector have been keen to make use of the flexibility offered by cloud computing, but are now observing unpredictable and rising costs. Much of which can be mitigated through careful planning and on-premise infrastructure.  Government guidance now recommends switching to a strategy of ...


Jason Nucciarone
18 June 2024

Ubuntu Summit 2024

Ubuntu Article

We are excited to announce that Ubuntu Summit 2024 will be held in The Hague, the Netherlands this October 25 – 27th! The Ubuntu Summit for the last two years has served as a showcase for the innovative and the ambitious. We aim to shine a light on those who are not satisfied with the ...