Malware
& Management

A tabletop incident-response game for executives

2The game
Executives take the Executive Decisions that contain the incident, under pressure, in about one hour.
  • A session of about one hour
  • Four fixed executive seats
  • Incident Master runs it
Up to three Executive DecisionsNot to scale
Brief
Executive Decisions
Verdict
Debrief
Malware & Management

3First-order rules
Eight rules hold in every session. Where they are silent, your Incident Master rules.
1 ObjectiveWhat the table is here to do
2 Executives decideThe IM rules; a roll only in doubt
3 Three risksWhat a decision puts at stake
4 Executive DecisionsThe big calls, at most three
5 Risk triangle12 points: Money, Time, Quality
6 Timer adds pressureA timer runs on every decision
7 Lasting effectsCondition cards the IM tracks
8 How it endsThe IM declares containment
Malware & Management

4How a session runs
Four executives decide. The Incident Master runs it until containment.
Incident MasterRuling authority

Four seats

They vote
CEOCFOCIOCISO

NPCs

Played by the Incident Master. They advise, never vote.
General CounselHead of CommunicationsCOOChief Risk Officer
Open
Play, one inject at a time
One full brief
Short brief at each inject
Executive Decisionat most three per game
Move risk board
Roll only in doubt
IM declares containment?
Two-part verdict
no doubt
in doubt
no, next inject
yes
Malware & Management

5The decision
Executives decide. A strict majority carries it, and a tie fails.
  • Up to three Executive Decisions per game
  • Options and costs printed on the card
  • A timer runs on each
  • Conditions: lasting effects
Executive DecisionTimer
Cost on the boardRoll targetComplication
AOption AFinancial +110+Financial +1
BOption BSecurity +110+Security +1
COption CSecurity +215+Security +1, Financial +1
Votes
CEO
CFO
CIO
CISO
Majority 3 of 4. A tie fails.
Condition card
A lasting effectThe Incident Master tracks it
Malware & Management

6Every decision moves risk
Every Executive Decision moves the risk board.
  • Three risks: Security, Financial, Reputational
  • Four steps: Steady, Strained, Serious, Critical
SecurityIs the attacker still in, and how far can they reach?
Steady
Strained
Serious
Critical
+1
FinancialWhat the response is costing, and what the business can afford.
Steady
Strained
Serious
Critical
ReputationalTrust with stakeholders, the CSIRT and the public.
Steady
Strained
Serious
Critical
+1
Example decisionA bounded exposure windowPrinted cost: Security one step worseResult: Security holds. Reputational one step worse.
Points the table put on each arm
TIME 7MONEY 3QUALITY 2
ShieldTime 7 cancels the Security step
SameMoney 3 leaves Financial as printed
StarveQuality 2 adds a step to Reputational
12 points in total, 4 each to start. 7 or more shields, 2 or less starves.
Malware & Management

7How it ends
The Incident Master declares containment. The verdict reads the board.
  • Containment: reached, or not yet reached
  • Cost: one sentence read off the board
  • No score
SecurityIs the attacker still in, and how far can they reach?
Steady
Strained
Serious
Critical
FinancialWhat the response is costing, and what the business can afford.
Steady
Strained
Serious
Critical
ReputationalTrust with stakeholders, the CSIRT and the public.
Steady
Strained
Serious
Critical
The verdict, for example

ContainmentReached

The costSecurity Strained, Financial Strained, Reputational Strained

Malware & Management

8Example: Operation Silk Harvest
A biotech firm, an attacker stealing research, three Executive Decisions.
Act 1: setup
Act 2: escalation
Act 3: climax
Brief and opening riskEach seat names the one risk it owns
Leadership callWho leads, who owns the old system
Executive Decision 1What stops today
Executive Decision 2Whose time, what exposure
Executive Decision 3What do we say
Containment?After the last decision, both marks set
Verdict and debriefContainment, then the cost on the board
Malware & Management