Healthcare organizations seeking to identify security gaps have several options, ranging from vulnerability scans to third-party penetration tests. These technical assessments reveal obvious holes in defenses and find more subtle weaknesses. However, for an organization to be truly cyber resilient, it must know with confidence exactly how it will respond to an actual cyberattack. Scans and pentests cannot provide this assurance.
To understand the response process, leaders must conduct a tabletop exercise. During these sessions, a facilitator often hired from an incident response firm walks decision-makers through a scenario where unexpected information is introduced. Scenarios can come from the Cybersecurity and Infrastructure Security Agency or be built from past incidents, threat intelligence, and audit findings. The exercises can be run verbally in a meeting, over a phone line, or through simulation platforms.
Why Tabletop Exercises Are Essential
“Tabletops vary greatly in scope and execution, from simple ‘everyone sits at the table and reads the plan’ to complex, simulated events where a third-party acts as an attacker while the organization’s security operations center and incident response teams are tested,” says Heather Hinton, an advisory board member of the Harvard cybersecurity program. “Whichever approach you take, the goal is the same: Build muscle memory and relationships so you can respond quickly.”
It is during these scenarios where the parties discuss their procedures and the chain of command. While technical exercises let IT teams know where their security issues lie, other, non-technical issues often arise that need to be addressed. “The biggest findings are almost always about process and coordination,” says Jess Burn, a principal analyst at Forrester. “Exercises reveal whether people agree on incident severity, who has authority to shut down a system, when executives or the board get involved, who approves customer or media communications, and when to contact the cyber insurance representative.”
An effective tabletop exercise is designed to throw untested scenarios at its participants and get them to rely on their instincts. “A simulated event that was not announced, where people are not prepared, will expose the fundamentals: What can I do right now to contain, and who do I contact to help with next steps?” says Hinton. “These are exceptionally valuable and very hard to implement in a manner that gets the adrenaline going in a way that actually simulates — and stimulates — the response process.”
Related Post: Healthcare IT lifecycle upgrades cut costs, improve security and care
New Challenges in Cybersecurity Drills
Exercises will become more dynamic as AI-enabled attacks create faster-moving incidents and messier evidence trails. “Scenarios will need to account for prompts, model outputs, agent actions, data pipelines, access controls and human approvals alongside endpoint, identity, cloud and network evidence.” Quantum computing cyberattack scenarios are also being developed, because algorithms that can crack current cryptographic systems are ready to be implemented by bad actors as soon as the technology is mature.
Burn says that these exercises should be run regularly, ideally before an incident happens. “I recommend at least one cross-functional executive tabletop each year, supported by more frequent technical drills using a cybersecurity skills and training platform with a cyber range that provides a realistic simulation of the organization’s environment.” The frequency may vary by organization, but healthcare organizations need to come out of each exercise with a plan of action for each participant.
“Organizations should leave the exercise with an owner, deadline and expected outcome for each finding,” Burn says. “Some fixes, such as updating contact lists or drafting communication templates, can happen quickly. Issues involving authority, governance, contracts, staffing or business continuity usually take longer.” The hardest fixes are those involving gaps in authority, she says, “because the security team cannot resolve them alone. Deciding who can take a critical system offline, approve an emergency expenditure, determine materiality or speak publicly requires agreement across legal, financial, operational and executive teams.”
Uncomfortable Truths for Senior Leaders
Organizations need to accept that tabletop exercises will expose uncomfortable truths. The process involves senior leaders who are used to making decisions based on a full analysis of the situation. In a drill, they must rely on instincts and trust the experts in the security operations center. This creates a significant challenge for most executives. They must understand the incident without seeing the technical details of the environment. They also cannot second-guess the trained subject matter experts.
The difficulty of this dynamic requires careful facilitation. The incident response team knows exactly what to do to contain an incident. The executive team must be taken on the journey of explaining what happened and what was done to fix it. This is extraordinarily difficult for senior leaders. It forces them to make decisions without the full picture they usually require. The exercise becomes a learning moment for everyone involved about the limits of their information.
