Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

On boxing, tabletop exercises and threat models


on 10 March 2020

This article was last updated 4 years ago.

‘Everybody has a plan until they get hit. Then, like a rat, they stop in fear and freeze.’ Mike Tyson

At Canonical we have recently performed a series of cyber tabletop exercises (TTX). A TTX is an information security preparedness drill where a cyber incident scenario is played out to improve your tactics, techniques and procedures (TTPs).  When performing a TTX it is important to use the same amount of staff and effort as though a real incident were occuring. This helps to uncover deficiencies in your TTPs and address those issues before a real event occurs. Being as efficient as possible is critical during incident response because as time passes data that can help determine root cause is lost and the attacker may still be causing harm to the environment. 

This past month we performed two TTXs with different groups within Canonical. This type of exercise requires support from the top down, you will be interrupting work for up to a day and it is imperative that the management of each team is behind this effort. At Canonical security is in our DNA and this exercise was performed with full support of everyone within the company. 

When performing a TTX it is important to not only include your engineering teams but also include representatives from each organizational unit; support, web, marketing, etc. For our TTX we measure our success by tracking time from the malicious act, detection, reaction, internal communication, external communication and remediation. Each subsequent TTX should be more efficient than the previous.

To aid in construction of our TTX scenarios the Ubuntu Security team produces threat models of our products and services. By performing a threat model we can identify weaknesses, work with the engineering product owners to prioritize fixes and use the threat model to create realistic TTX events.  We use the STRIDE methodology for threat modelling, which breaks threats in to 6 categories:

  • Spoofing
  • Tampering
  • Repudiation
  • Information disclosure
  • Denial of service
  • Elevation of privilege

Cyber incidents can happen, it is imperative that part of your overall security plan not only include preventative measures but also include reactive plans. As Ben Franklin is often credited with saying “ if you fail to plan, you are planning to fail”.  How we react to an incident is as important as how we strive to prevent them. By exercising your cyber response plans you will be better prepared if a hack happens. If you have any questions about setting up your own threat models or table top exercise just let us know – @ubuntu_sec on twitter.

Talk to us today

Interested in running Ubuntu in your organisation?

Newsletter signup

Get the latest Ubuntu news and updates in your inbox.

By submitting this form, I confirm that I have read and agree to Canonical's Privacy Policy.

Related posts

Data Centre AI evolution: combining MAAS and NVIDIA smart NICs

It has been several years since Canonical committed to implementing support for NVIDIA smart NICs in our products. Among them, Canonical’s metal-as-a-service...

From support engineering to UX: Piper’s career progression at Canonical

Career progression is crucial to employee engagement and retention. At Canonical, we encourage employees to develop their own personal development journeys, ...

Navigating the cost of cloud storage in the public sector

Like many other industries, organisations in the public sector have been keen to make use of the flexibility offered by cloud computing, but are now observing...