Your submission was sent successfully! Close

  1. Blog
  2. Article

on 10 March 2020

On boxing, tabletop exercises and threat models

‘Everybody has a plan until they get hit. Then, like a rat, they stop in fear and freeze.’ Mike Tyson

At Canonical we have recently performed a series of cyber tabletop exercises (TTX). A TTX is an information security preparedness drill where a cyber incident scenario is played out to improve your tactics, techniques and procedures (TTPs).  When performing a TTX it is important to use the same amount of staff and effort as though a real incident were occuring. This helps to uncover deficiencies in your TTPs and address those issues before a real event occurs. Being as efficient as possible is critical during incident response because as time passes data that can help determine root cause is lost and the attacker may still be causing harm to the environment. 

This past month we performed two TTXs with different groups within Canonical. This type of exercise requires support from the top down, you will be interrupting work for up to a day and it is imperative that the management of each team is behind this effort. At Canonical security is in our DNA and this exercise was performed with full support of everyone within the company. 

When performing a TTX it is important to not only include your engineering teams but also include representatives from each organizational unit; support, web, marketing, etc. For our TTX we measure our success by tracking time from the malicious act, detection, reaction, internal communication, external communication and remediation. Each subsequent TTX should be more efficient than the previous.

To aid in construction of our TTX scenarios the Ubuntu Security team produces threat models of our products and services. By performing a threat model we can identify weaknesses, work with the engineering product owners to prioritize fixes and use the threat model to create realistic TTX events.  We use the STRIDE methodology for threat modelling, which breaks threats in to 6 categories:

  • Spoofing
  • Tampering
  • Repudiation
  • Information disclosure
  • Denial of service
  • Elevation of privilege

Cyber incidents can happen, it is imperative that part of your overall security plan not only include preventative measures but also include reactive plans. As Ben Franklin is often credited with saying “ if you fail to plan, you are planning to fail”.  How we react to an incident is as important as how we strive to prevent them. By exercising your cyber response plans you will be better prepared if a hack happens. If you have any questions about setting up your own threat models or table top exercise just let us know – @ubuntu_sec on twitter.

Related posts

Bill Wear
30 November 2023

MOTL: Minis Forum N33 NUC

Cloud and server Article

Part 1: The hardware setup As a first attempt at trying MAAS outside the lines (MOTL), let’s pick a random, inexpensive Next Unit of Computing (NUC). Indeed, let’s start with a Minis Forum N33, which is older and “out of print.” The relevant forum is offline, and manuals are hard to Google up. Nice challenge. ...

Serdar Vural
30 November 2023

Fast and reliable telco edge clouds with Intel FlexRAN and Real-time Ubuntu for 5G URLLC scenarios

Cloud and server Article

Intel and Canonical have been collaborating to deliver advanced infrastructure that can run the networks of the future. More and more, we see edge cloud systems deployed closer to end users and systems to meet the ever-increasing demand for faster edge networks that can rapidly deliver business services and boost productivity. This requir ...

29 November 2023

Meet Canonical at CES 2024

Ubuntu Article

It’s that exciting time of year, CES is almost here. With 2880+ exhibitors, the Consumer Electronics Show (CES) has cemented its position as the premier event for unveiling the latest technological advancements. With each passing year, CES becomes an even more integral platform for showcasing groundbreaking innovations. Join us at booth 9 ...