Tabletop Exercises as a Tool for Third-Party Risk Management

Tabletop exercises are a great way to strengthen your organisation’s cybersecurity posture and mitigate threats, including third-party attacks.

According to a report by SecurityScorecard, 98.3% of organisations are associated with at least one third-party entity that has witnessed a security breach within the past two years.

No wonder, there have been many occurrences of third-party security risks recently.

If you associate with a company that has a weak security posture, it will affect yours too.

This is why modern organisations need a proactive approach to minimising third-party risks and staying digitally safe.

Conducting regular and effective tabletop exercises based on third-party attack scenarios prepares your organisation against third-party risks.
In this article, we’ll discuss what these tabletop exercises are and how helpful they are for your security.

Third-party risk management (TPRM) is the process an organisation follows to manage the risks that come along when working with a third-party entity. In this process, the organisation utilises risk assessment tools, risk mitigation techniques, and other strategies to identify, evaluate, and control third-party risks.

The aim of third-party risk management is to:

• Strengthen the primary organisation’s cybersecurity posture
• Improve supply chain security
• Safeguard sensitive data
• Comply with applicable regulations
• Avoid security risks and disruptions
• Support a secure work environment
  
  

To understand third-party risk management deeply, let’s define what third parties and third-party risks are:

Third-party: A third party can be an entity that directly works or is associated with your organisation, such as software vendors, service providers, suppliers, business partners, contractors, freelancers, affiliates, agents, distributors, resellers, etc.

Third-party risks: A third-party risk refers to the likelihood for a primary company to suffer a cybersecurity threat, data breach, or negative impact from a third-party entity. These risks could be security risks, compliance risks, operational risks, financial risks, and more.

Importance of Third-Party Risk Management

If an attacker manages to compromise one of your third-party providers and gains access to their customers, partners, or clients, they may breach your security as well. This is how a this-party attack happens. They are becoming more frequent these days with the evolving technologies and hyper-connected world with complex supply chains.

According to a 2023 study, 61% of respondents witnessed a third-party security incident including data breaches in the last 1 year. Some of the prominent security incidents related to third-party attacks include:

• Microsoft Midnight Blizzard attack in January 2024
• American Express data breach in March 2024
• Infosys McCamish data breach in February 2024
  
  

Even the tech giants like above aren't spared by third-party attacks. This is why you must have a strong system to manage third-party risks, doing everything you can to safeguard your organisation from attacks. Third-party vendor risk management helps you to do just that.

Third-party risk management tabletop exercises (TTX) are simulated, discussion-based activities mimicking real-world third-party security incidents.

Organisations conduct these exercises to test and improve the preparedness of their systems, processes, and people against third-party attacks. In addition, cybersecurity tabletop exercises help you detect potential vulnerabilities and fix them before hackers do, improving your organisation’s overall security posture.

A tabletop exercise involves three parties:

Participants: They participate in the exercise where they’re given a security scenario to deal with. They are assessed based on how they respond to the incident.

Facilitators: They could be internal employees of a third-party tabletop exercise service provider to conduct exercises for you. They plan the exercise, build scenarios, invite participants, and evaluate results.

Observers: They observe the exercise and may participate in the exercise if needed.

TPRM TTXs involve people from various departments of an organisation - IT, HR, legal, compliance, marketing, sales, and so on. Today, security is not only the responsibility of your security team; it’s for all. Each member of your organisation must follow security best practices to ensure they leave no room for attackers to come through.

Some benefits of conducting third-party risk management tabletop exercises:

Vulnerability Detection
One of the biggest advantages of TTX is it helps you detect vulnerabilities in your systems, devices, processes, and tools. So, while you train your employees for various attack scenarios, you can find vulnerabilities hidden from view and resolve them before the real attackers exploit them.

Faster Response Times
Each moment counts when you’re under attack. Rehearsing various scenarios improves your team’s response to third-party attacks. This way, they learn to identify vulnerabilities, communicate effectively, make better decisions, and respond to the incident faster in a real attack. You can compare before and after scenarios to calculate how much the response time has improved over time.

Effective Communication
Communication gaps lead to confusion and misunderstanding, which you’d never want in a critical situation like a cyberattack. It worsens the scenarios, even if your security breach response plan is effective. With an incident response tabletop exercise, you can polish the communication systems in your organisation, bridging gaps and improving channels. With tabletop exercise scenarios, you can teach them who to report the incident to, through which communication channel, and what steps to take quickly. This removes doubts and miscommunications.

Risk Reduction
Since tabletop exercise scenarios help organisations discover weak points in their network, risk assessment methodologies, and systems, it reduces the risk potential. Your entire organisation, from IT to marketing, sales, legal, HR, etc. will feel more confident about their response. Similarly, it also provides greater confidence to leaders and decision-makers about the organisation’s security posture.

Compliance
With third-party risk management tabletop exercises, your team will learn how to manage customer and business data effectively as a best practice. This helps reduce the risk of data theft and breaches. In addition, you can teach participants the value of proper reporting through scenarios, useful for auditing and third-party risk compliance. Overall, these exercises help enhance your organisation’s regulatory compliance efforts, minimising non-compliance risks and reputation damages.

Secure Work Environment
Whether you work internally or with third-party entities, you must ensure a secure work environment for all. With increasing digital connectivity, compromising systems and supply chains has become easier for attackers.

Using the insights you gain from tabletop exercises, you can communicate with your third-party vendors, suppliers, etc. and adjust contracts and policies related to security and privacy. It will improve your risk management/mitigation efforts.

Now, let’s understand how to create a tabletop exercise for third-party risk management:

Involve Leaders
Involve key decision-makers, stakeholders, C-suite executives, and leaders in your tabletop exercises. With exercise scenarios, you can make them understand third-party risks and their potential impacts on the organisation. This allows them to make strategic decisions when dealing with third parties, reducing risks.

Create Industry-Specific and Realistic Scenarios
Creating any tabletop exercise with no strategic intent or relevance to your organisation’s security needs or industry won’t cut it. It won’t give you results that you wish to use in improving your third-party risk management.
This is why the cybersecurity tabletop exercise scenarios you design for third-party risk management must be realistic and specific to your industry.
Cybersecurity tabletop exercise example: If you are a financial institution, your third-party risks would be different from those of a healthcare provider. So, tailor scenarios that can reflect real-life challenges. Create something like your financial institution is hit by a data breach attack, compromising customers’ credit card details and account numbers.

Define KPIs and Metrics
Conducting tabletop exercises for the sake of it is not helpful. It needs to be measurable, so you can improve your tabletop exercise strategies and prepare your organisation for attacks.
So, measure how effective your tabletop exercises are by defining clear metrics and KPIs, such as response time, incident detection speed, issue resolution time, communication efficiency, and more. Compare your previous and current results to track improvements and areas that need more attention. Adjust your strategies accordingly to improve the security preparedness of participants.

Regular TTX
Conducting tabletop exercises is not a one time-deal, it needs regular practice much like how you should exercise regularly to keep yourself physically fit.
Cyberthreats, including third-party attacks are evolving and intensifying both in number and sophistication. This is why you must conduct tabletop exercises regularly to keep up with evolving risks. Create tabletop exercise scenarios that reflect the latest changes and trends and see how participants respond to them. You can conduct these exercises once every quarter or every six months.

With the help of an experienced tabletop exercise facilitator like Microminder, you can improve your company’s preparedness against third-party attacks. We provide comprehensive cybersecurity tabletop exercise services tailored to meet the security goals of your organisation. Our scenarios are industry-specific and based on the latest, real-life incidents.
Let us conduct third-party risk management tabletop exercises for you to improve your security strategy and build stronger, more resilient partnerships.
Schedule a call with our experts today!