-: Glad to be with you today,
and to share this information with you.
I've been in IT for a lot longer
than I have not been in IT.
So some of you might recognize me.
I started at Nebraska Medicine on March one.
Prior to that, I worked for the University of Nebraska.
I was based in Lincoln.
I started at UNL back at the start of 2014,
but prior to that I worked at Emporia State University
in Emporia, Kansas.
So I've been in it a long time,
in security for about the last 15 years.
So welcome, I hope you'll have fun.
I know you just all had lunch,
and you probably wanna just kind of relax,
but I'm gonna make you do something here,
so hope you're ready for it.
Here's the agenda.
I wanna leave time for all of you,
so we're just gonna scoot right through this.
Here's what I want you to learn from this.
This is gonna be a tabletop exercise.
For those of you that don't know
what a tabletop exercise is,
it's basically a test run of your incident response plan.
And we like to do them in information security
so that when there is an information security event
or incident we can quickly pivot
and do what needs to be done to collect evidence,
to contain, to eradicate the whatever is going on.
Make sure that we've got everything clean
and get the systems back up.
So this is kind of what we're gonna emulate today.
When you do a tabletop exercise
you pretend that
you all don't know
all the information at the same time.
So you have to deploy different ways
of getting information out to kind of replicate
what would happen in a real life incident.
There's many roles,
and I'm glad to see that we have quite a few participants,
because I think there's enough roles for at least 17 people.
But we can have duplicate.
But anyways, there's different roles,
and different ways that people
add to the incident response efforts.
You're gonna learn today how important it is
to share information,
and to share it in a timely manner.
And I'm using a different type of approach.
So I am using a murder mystery,
well a mystery motif.
You've probably been to a mystery theater,
where maybe it included food,
and you're given roles and booklets,
and you are going to role play.
And there is some information that you can share.
And in the booklet there's gonna be information
that you do not share.
And so I've kind of created this incident
to reflect like a murder mystery evening or event.
And if you've ever been to a mystery theater
you know that it can go for a little while.
We have 50 minutes,
so we're not gonna get through the entire incident.
I'm not even sure we'll get through
what I want us to get through.
We're gonna try.
But what I want you to do is to have fun with your role,
share the information that needs to be shared,
keep the stuff secret that you're supposed to keep secret.
And I just want you to kind of get a sense
of how this all works.
And the different approach is to kind of
mix it up for people,
to kind of, 'cause tabletop exercises don't tend
to be a whole lot of fun,
and I like to have fun when I'm working.
So this is a good way to do that.
It's also a great way to show people
who are not involved in the incident response process,
because you'll give them a script,
basically of what they need to do
and what they need to say.
And that's what we're gonna do today.
So no experience is needed.
And I hope you have fun.
So let's get started.
Here's the rules.
When we start,
and if you start talking for the first time,
I want you to,
or if you join in a conversation,
I want you to first introduce yourself,
and then the role that you're playing.
So I would be Cheryl O'dell,
information security team member.
The booklet, now if we were in a physical setting,
you would pick up the part of the booklet
that would be only for your role.
But I only have the booklet available in digital form.
And because of the time commitment,
the time limitations,
it's one booklet.
So you're gonna read your role in the booklet,
you're gonna go to your page or pages,
and when you see stop here, stop there.
Don't keep going.
Don't read through the whole booklet,
'cause then you won't have fun.
Follow the instructions of what you can share
and what you should keep secret.
And I want you to play up your role as much as you want.
Ad lib as much as you want.
It takes all types of personalities in IT, right?
And it takes all types of people
to make the diverse and productive team.
So, if you can turn on your camera,
and I fully expect that when you go to talk
that you're gonna unmute yourself and participate.
So let's go.
I want you to select,
here's the list of roles,
and the number that I need.
If we want two or three people
that wanna be incident commanders, that's fine,
you just need to realize that there might be more than one.
But this is what the scenario I've called for.
So think about a role.
Again, you don't have to have any experience.
You are gonna be given information of what's going on,
and what you can share and what you can't.
So I am gonna just kind of call out
and see if we've got these roles filled.
Do we have someone,
or more than one person
that wants to be an incident commander?
Just holler out yeah.
I don't care who it is.
All right.
-: I'll do it.
-: Awesome.
How about an IR coordinator?
I need a couple of those.
-: I can do that.
-: Okay.
All right.
I need a communications response team member.
Man: I can do that.
-: Okay, you're not really
gonna have to communicate anything,
but it's, we're playing the roles, right?
I need three information security analysts.
-: I can be one of those.
-: Awesome.
Two more.
All right, at least we got one.
-: I can do one as well.
-: All right.
How about some server admins?
-: I'll try that.
-: [Woman} I will too.
-: All right.
Awesome.
How about network team member?
Can I have at least one?
All right, we'll come back.
How about a systems team manager?
Come on.
All right, we'll work through that.
How about a data center operations manager?
I thought we had enough people in here,
where are all my people?
-: Cheryl, I'll be a data center person.
-: All right.
Man: Cheryl, in whatever spot you want,
I'll volunteer for anything you want.
-: Okay.
Well, it's more about,
okay, I haven't been keeping track.
So help desk team lead.
-: Gotcha.
-: Awesome.
-: And network team lead.
-: I'll take that.
-: Awesome.
So did anybody decide that they would be
a systems team manager?
Who said that they would do whatever I needed them to do?
Man: I'll take the other Raul.
-: (laughing) all right the other Raul, you're that person,
the systems team manager.
All right, and did we get anybody to be
a network team manager, or team member?
If not, at least we got the team lead.
Sarah: I'll be the network team member.
-: Awesome.
Thanks, Sarah.
All right, let me copy in the link.
I had to share this link from my personal account.
So I'm gonna put it in chat
as soon as I find chat.
Always at the you can lose stuff
when you're in Zoom,
I just don't get that.
-: That's to keep you on your toes,
that's all it is.
When you share something it moves all menus
all over the place.
-: That is true.
All right, where'd you go?
As soon as I find chat.
There it is.
Nope, that isn't.
Okay, I'm gonna stop, I'm gonna chat.
Click on the link in chat,
and then I'll share what you see.
You should see,
you should see this role booklet,
Amplify Your Role.
By the way, while you're going to your role
and reading your information,
this incident is entirely fictional.
I am not representing anybody, anything, any situation,
any story, any technical person, any person alive or dead,
any institution ever.
So I'm not saying this might've happened somewhere,
I'm just saying I've never been involved
in anything like this before.
So I'm gonna give you a couple of minutes
for you to go to your role.
And it's bookmarked so you should be able
just to click on your role link,
and it will take you to your portion
of the incident response.
So this is where I would play music,
but I'll be quiet so you can concentrate.
Now, if you're reading this,
and if you have a question for me,
you can chat me directly.
Looks like people are still reading.
So I know I have one,
I or, IR coordinator,
do I have a second one?
Who all wanted to be an IR coordinator?
Julie, Julia was one.
Oh good, there's our answer, Julia.
So the other Raul,
can you remind me which your role you're doing?
Raul: Would be the teams, systems team manager.
-: Okay.
Thank you.
All right, does anybody need more time
to understand what's going on
with your role?
I'm hearing nothing.
-: I think Julia had her hand up for a second.
-: Oh sorry.
-: Sorry, I just,
I just need about 30 more seconds to finish reading
and then I'm good.
-: Okay.
All right.
-: It was Mr. Mustard in the camel room.
-: (Laughing) You know, I should have used those names.
I was trying to think of names of nobody I knew.
-: Yes, Colonel mustard in the library with the candle stick.
-: With the candlestick.
Not with the candlestick.
I can tell you that. (laughing)
-: It was with a network wire.
(laughing)
-: It's not a wire, it's a cable.
Okay, it's a cable.
-: It's not a program, it's an application.
(laughing)
Okay.
All right, so something has happened.
We're not sure why,
we're not sure who.
what we know, when,
and we're not sure how.
We're pretty sure,
we're pretty sure that an incident happened,
and we need to figure it out.
So now next steps, the phone is ringing at the help desk,
it's ringing all over the place.
Operations team desk, network,
even the security team.
Oh the mayhem.
There's an incident.
So time to pull out the incident response plan.
So you have the characters,
and I'm gonna turn it over to you.
Go.
-: So, what has happened here?
-: At the IT help desk, since seven a.m.,
we've been getting all types of calls
from staff reporting that
their computers were restarted overnight
because of some patches that were applied,
and a lot of people are just calling to double check
that everything was okay.
-: Is that it?
Is there any other information?
-: I know that someone got into the data center,
and it must have been a person who had access,
and used an ax to destroy systems in one rack,
front and back.
So the rack of three servers,
it wasn't a full rack,
was destroyed,
and all three servers have significant damage
on the front and back sides.
One server in particular was attacked,
and is hanging by one side rails.
Whoever did this was really mad at that one server,
they wanted it out of commission for good.
-: Our security team has been looking into these servers
that were affected,
and we don't believe that they should be
affecting any legitimate system or service.
-: (indistinct)
-: Oh, go ahead.
-: I can share that all three servers that were destroyed
were only redundant servers.
Two are actually not even powdered on
because they're ready to be decommissioned,
and the third server we are getting up
because we've had a tape restore system,
in case there was a need to restore from an old tape backup,
but we're not actually using it.
So nothing destroyed should be affecting users.
-: From the network side,
I don't believe equipment has been affected
by this incident.
I don't know if I have any team members that,
if there's any challenges with the network today.
-: No, you're correct.
No network equipment has been affected by this incident.
All network services are working correctly,
the access to the internet is working.
The access to the university servers
and systems are working.
And if there are issues reported by end users,
it is not the network.
No changes have been made on any firewalls
or any network equipment
that would be causing end users issues.
If someone could sneak an ax into the data center
and no one from the data center operations team would know,
hmm.
Stephen: Just a question,
has anyone contacted the CIO
and let him know that somebody managed
to sneak in with an ax and destroy the servers? (laughing)
-: In addition to the CIO,
what about the chief information security officer?
Are they in the know about this incident?
Stephen: There aren't any sort of administration,.
Raul: it looks like that would be me. (laughing)
It says that I have alerted the CIO
and CISO,
and the others that know the data center operations manager,
Mary (indistinct).
So it looks like I have alerted them,
and also the AVP of IT.
-: This is Mary from operations.
In regards to the question
about how did someone with an ax get into the data center?
We're not sure, we're looking into that at this time.
-: Do we know anymore about what caused this incident
so we can keep it from happening again?
Has anyone communicated with end users
about the servers being down?
Do we need to do that?
-: There is no, we don't have any service
or system effected by the problem.
They should not have any problem right now.
Raul: One thing I can say being the system team manager
is I do know that Tabitha, a student employee,
works at the data center during the night shift.
Apparently that log shows
that she entered the data set at six in the morning today,
but left shortly after, without clocking out.
-: That sounds important.
Has anyone keeping notes about this incident,
or writing down details?
-: I'm keeping some locally.
I'm waiting for the document to be created on a server,
and once that's,
or not on a server, but on a,
yeah, on the server.
Once that's done, then I can put them in the,
in that shared document.
-: One thing I can share is
Anderson, the backup restore service coordinator,
and Mary, the data center operations manager,
is dealing with an HR issue right now,
but is aware of this incident,
and will join this call when they can.
-: I think, as Raul mentioned earlier,
potentially the only service not working right now
is that old tape backup and restore service.
-: Yeah, that's correct.
There is some traffic, a little traffic,
but it's not related to the main controller,
so an email or (indistinct).
-: As a coordinator,
I wanna make sure that we're following all of the steps.
And so we've already gone through detection,
and we're trying to figure out what's happened.
So I wanna make sure that I get everything into the notes.
Have we contained everything?
Is there anything that,
that we need to make sure is contained?
And if we figure out what the cause is, can we eradicate it?
Raul: It shows here on my notes
that I, there's a server was struck with an ax
and was left behind.
I don't know where that ax might be.
Let's see.
(indistinct) went back to the office.
Well, the sentence tells me that
Anderson found the server destroyed,
grabbed the ax left behind,
and ran after Tabitha.
And when Anderson realized he looked like an ax murderer
he stopped running and went back into the office
and called to explain.
It looks like at this point,
while Anderson was talking to me on the phone,
the university police showed up to question Anderson.
-: Do we know (indistinct)?
-: Yeah, at this time there isn't anything
that's affected on the network side,
I just had heard from Mary
that three servers were being decommissioned,
and network connectivity was affecting those at that time.
But other than that,
there wasn't anything on the network side
that's being affected.
-: Okay.
I'll call it for y'all,
I know you're struggling.
You did great.
You did awesome.
You shared information that you were supposed to share.
The other Raul, I think you shared a little too much,
but that's okay.
(laughing)
But, so what stands out to you from this exercise?
What, go ahead.
Raul: The one thing I could say,
it's funny, 'cause I was worried that I was gonna
touch on the keep secret,
'cause there was section on my side
that says keep secret.
I was, I can't say that part,
I have to kept going back my other notes.
Anyway, to answer the question you pose,
I believe, basically if there's no preparation
on how to handle an issue,
you get a situation like this,
where everyone's blindly looking for an answer
or providing information that either is relevant,
or if there is a preparation set to say,
well if there is a network down
these are the steps we need to take,
it will make this a lot smoother
rather than calling
okay, who has this information?
If there was preparation,
it would immediately make it
so in the case of the role that I had,
I can present the,
the schedule and the people that work,
and that right there can give
whoever's leading the the investigation
to know who they need to ask questions.
So to me, at least in this experience of what,
when I've run into these types of issues,
is that we neglect to train on how to,
how to react to these types of problems,
or at least have a blueprint of what to do.
-: We're all different, right,
and so we all have different personalities.
Josh was playing the IR commander,
he was new to the university,
you may not have known that.
And so he wasn't sure who all the players were,
but he knew that he's done this for many years,
and he can take over and get this done.
Julia, she was playing both of IR coordinators,
and one of them wanted Josh's job.
She wanted to be the commander,
so she was ready to start taking on Josh,
and saying "Are we doing everything right?
"Are we doing that?"
And then the other IR coordinator,
the two coordinators,
they were supposed to be going,
"Are you taking notes?
"Am I taking notes?
"Who's taking notes?
"Where are the notes?"
You know, that kind of thing.
-: One thing I wanted to add as well,
being part of the network,
it was kind of just describing
"Oh, it's not the network issue,
"not a network issue,"
but I had some information that was HR-related
that I was told not to talk about,
and with the balancing of kind of
is this an HR issue,
and how much can you expose
because of privacy of peoples and investigation thing,
it's hard to balance that, right?
And trying to get to the point of where,
where the issue is coming from,
it is a hard thing to balance for sure.
-: And I should catch you up
and make sure everybody knows
that this incident was Tabitha,
who was a student worker in the data operations center,
she had set up a peer to peer file sharing service
on the old backup, tape backup server.
She had uploaded illegal copies of movies,
which I thought I came up with
some pretty good movie titles.
Stephen: They were pretty good.
They were pretty good.
-: Zombie Apocalypse 27,
T-Rex vs Godzilla,
When Lucy met Charlie,
and the golden oldie, Swept Away with the Breeze.
Anyway, she set that up,
Tabitha set that up
and was sharing the link out with friends.
And so she was using university equipment
to do illegal, illicit activity.
And Anderson, the server admin,
figured it out, saw the service running,
had figured out it was Tabitha,
the Tabitha admin user ID was used,
so he notified Mary,
who was Tabitha's boss.
They notified HR,
and they were gonna meet with Tabitha
at the end of her shift.
But the jig was up because
HR showed up too early.
And so she was asking "Why are they here?"
And they of course didn't let her know why,
and she got scared.
So she grabbed the fire ax,
you know the ax that's in the fire station,
and she decided she was gonna destroy the server,
because if they destroyed the server
they'd never be able to figure out it was her.
Of course she was in there destroying equipment.
And so she destroyed the server with the ax and ran off.
And Anderson walked in just in time
to see her running off.
And why he picked up the ax,
I don't know, but he did.
And then he started running after Tabitha.
And so people saw him in the parking lot with an ax,
chasing Tabitha.
And then he realized what he looked like,
and he decided to go back.
And then university police showed up.
So anyways, that was the whole backstory.
But meanwhile, IT had to handle the issue
that there were some data center issues.
The help desk, that was great, Michael,
the way you shared that information.
What people were calling about
had nothing to do with what was going on in the data center.
But a lot of times that's what it is, right?
You have to piece together,
you get clues from other people,
and you try to piece together.
So what are some other things you might've learned
through this exercise?
-: I would say that one of the things that I learned is
sharing as much as you know,
even if you don't think it's related,
or has anything to do with it,
it might be a piece of the puzzle that's needed for,
to actually solve it.
'Cause I chose not to share a lot
about the decommissioned servers,
well that would've led back to the fact
that they set up a,
that peer to peer file sharing
on those decommissioning servers,
and so then you could have started piecing that together
a little bit better.
-: And I didn't share right away
that Anderson and Mary were meeting with HR right now
either so...
-: Well, but with the decommissioned service stuff,
you can't exactly share that
if it's an active police investigation
to something illegal either
with the incident command group.
So there's a very thin line that you can walk with that.
-: Right, but I didn't know there was,
all I knew is that network connectivity
was affecting those three,
three decommissioned servers.
So I, I could have shared it directly,
and probably should have been earlier.
But, again, it's a personality thing,
it's like "Oh, I didn't think it was that important."
So that kind of comes into play.
So that's a little bit of a downside on my side, my part.
-: Well, you know,
tabletop exercises are really important
in that preparation that Raul was talking about,
that in order to be able to deal with an HR issue,
the university police being involved,
equipment destroyed, help desk calls,
you've gotta be able to quickly respond in the right way.
You don't wanna just respond
because you want to get it done now,
you have to collect the information,
make sure somebody's keeping track.
You gotta, it's important
from an information security perspective
that when we collect the information that's going on
is that we write everything down
that has been done, at what time, who said what,
and the chain of custody is key.
That ax that, even though it's not information,
Anderson should have left the ax alone,
but that has nothing to do with information security,
but it does have to do with the police investigation.
And whenever there's an incident that occurs
you're not quite sure where the incident might lead,
especially if you don't have the details.
All you know is that three servers are down,
and you have no ideas that gonna lead to something else.
And if nobody had known,
if nobody had caught Tabitha doing this,
and all we knew is that there were,
there was, I dunno, a high volume of network traffic
to the tape backup server, the old tape backup server,
they probably could have kept going on forever and ever.
And this never would have come to light,
and it would have never been an incident.
So, you just never know.
So it's important.
So some of the key objectives here.
Yes, there was, sometimes there is information
you can't share from a legal perspective,
whether it's HR related.
In this instance, it was HR related,
so people couldn't share some of that.
But there's also that rumor mill that's going on.
Some people knew that an ax was involved,
and it was like "Wow, why, who got an ax?"
But it's important to share everything else,
every detail.
It's important to have somebody
be responsible for writing it down.
You need the IR commander
to make sure that you keep the conversation going,
that all the details are being thought out,
that the right people are getting communicated
at the right time.
But you need somebody else
to be that communications person
so that the commander can keep the team going,
the communications person can worry about
"Okay, it's time to communicate again,"
and they can start getting the right people engaged
in communicating.
Anyways, so what feedback do you have for me for this?
Did you have fun?
Did you learn anything?
Okay.
What would you, what would you do to make this better?
What could I do to make this better,
besides give you more time? (laughing)
Should I do this again?
Should I hold this again for other people?
Do you think there would be other people
that would be interested in this?
Yeah.
Raul: Definitely, yes.
-: All right, so what questions do you have?
Or comments or anything?
-: Something that will be useful
is in the chat to change our names
to the role that we named.
(indistinct)
-: And I should've reminded all of you to introduce yourself,
and the role that you were playing.
From the beginning I should have done that,
but I just kinda let you all go.
And that's a great idea, Raul,
I just didn't know how much time we would have to do that,
how much time it would have taken,
but we would have had time,
'cause it didn't take us long to get through that,
that one scene and that incident response.
So, yeah, definitely changing the name
in Zoom to the role you were playing.
What do you think next steps would be
for this current incident
if we were playing,
if we had a scene two?
Any ideas?
Stephen: Action I guess.
-: Go ahead.
Stephen: Just looking at it
from the communication response team member perspective,
it would be okay, how much can you actually
tell everyone else about what's going on?
Hey, there was an incident at the,
at the server, but can,
since HR is involved and so forth,
it's figuring out how you can craft your communication,
and you know what you can, and can't say.
-: Would you need to send a communication out?
Stephen: I imagine just because
there might be rumors going around
about an ax wielding person in the parking lot,
you'd want something to clarify.
And just go like "Hey, no one was murdered,
"there's no body, just minor incident."
-: I see Erin's on here,
she may have a suggestion for what not to say. (laughing)
But yes, definitely, you would have to check with HR,
and probably let HR handle that communication.
But from a technical standpoint,
all three servers, they weren't being used by users,
so there's nothing to communicate out there.
Definitely would wanna make sure the CIO,
the ADP of IT and the CISO
were all kept in the loop.
And if I would have had the second scene ready,
that's where we would have come in.
We would have had those players join us,
and they could then be kept up to date.
One of the parts of an incident response plan
is not just preparing and going through the steps
of analyzing, containing, eradicating,
it's also how do we improve our incident response plan?
It's an ongoing thing
because technology changes,
there may be new ways of communicating, who knows.
And so the last step is called an after action plan.
Sometimes it's called a different term,
but what it means is after you're done with the,
the main part of the incident,
you got everything back up,
you give everybody a day or so to,
I guess rest,
but you want that information still fresh in their mind,
and you pull all the players back together,
and you unpack what happened.
And so your facilitator,
it could be anybody,
but usually it's somebody who was not involved
in dealing with the incident.
And that facilitator will lead you through
a list of questions about
okay, what worked well?
What didn't work well?
Does the incident response plan need to be updated?
Are there any policies that need to be looked at?
Any procedures that need to be updated?
And it's a way to continually improve
your incident response plan,
which is a very necessary step,
because it's part of a life cycle.
It's everything that IT is.
It's ongoing.
You have to continue that way.
-: I had a question.
So, do you feel that organizations
concentrate a lot on actually what happened technically,
and kind of improving that
and making sure that doesn't happen
so that all the network doesn't go down,
or this, that and the other
and less on the actual process itself?
So for example teasing out
oh, I should've said something at this point,
or that kind of case?
It seems like IT people like to focus
on solving the problem, not so much improving
maybe the process of what led you
to help solve that problem.
-: You know, I'd say yes and no.
I feel with IT professionals
that I have worked over, worked with overall the years,
they all wanna do the right thing,
it's just that they they're in their mindset.
When I was a desktop technician,
that was my tunnel vision.
When I became a server admin,
suddenly it's like okay, I'm thinking server level,
I'm not thinking customer level.
So it's, it's real easy to,
to get those blocks on your,
those, I guess those virtual blocks
on what you see in the world.
And that's why we need the team to include all
the different IT perspectives.
Well, I think I'm just about out of time.
Are there any other questions or comments?
My, if you have anything you wanna share with me,
I'll chat my new email address.
It's real easy.
It's CO'Dell@Nebraskamed.com.
And it was nice seeing some of you,
well nice seeing all of you,
but some of you I worked on a daily basis with,
so it's nice seeing you all again.
But if there are no other questions,
and let's just make it clear
this was all fictional. (laughing)
It does not represent anything.
Yes, okay, good.
-: Thanks so much.
-: All right, thank you all.
Sarah: Thank you, Cheryl.
Cheryl: You bet.
-: Thank you, Cheryl.
This was an innovative way to present the content,
and a great model that I personally,
I'm gonna take this and use it in
like the gamification in a teaching and learning scenario.
So when I do trainings for
how do you use Zoom,
and how do you unmute and mute your mic?
Rather than teaching our students and faculty
how to mute and unmute themselves,
let's play a game like this.
And if they're muting and unmuting,
coming on and on,
and doing these certain actions,
of they can figure it out
and do it without instructions
to specifically do it in a gaming scenario like this,
what a great way to learn and then apply it later on.
So thanks for sharing this model with us.
-: You're very welcome.
Very welcome.
Man: Thanks.