Shall We Play a Game?
summary
Practical recipe for turning intelligence into practiced action: pick a breach story, map the attack steps to MITRE ATT&CK, break tactics into line-by-line tests in Excel, run technical tabletops and adversary emulation, and score time to detection, control coverage, and control effectiveness. Quarterly exercises are recommended; one client tested 12 VIP systems and discovered several supposed network-locked endpoints failed under test. The promise: validate assumptions, find gaps you actually fix, and measurably shorten detection and response windows.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 2:28Security incident lifecycle
- 5:16Finding exercise scenarios
- 9:11Creating effective stories
- 12:04Building attack tactics
- 16:38Tabletop exercises basics
- 19:22Defense in depth metrics
- 21:26Adversary emulation testing
- 24:15Scoring and improvement
- 27:25Maturity model for exercises
related talks
40mAdversary Simulation: Close the Gaps in Your Security Posture
48mMITRE ATT&CK: The Play at Home Edition
49mTraining for Incident Response: The Red, the Blue, and the Ugly
25mSecurity Chaos Engr.: Fix Things and Make Friends
40mA Primer: Getting Started with MITRE Shield
59mBackdoors & Breaches: Live Tabletop Exercise Demo
58mMITRE ATT&CK for Developers
54mWant to Play a Game? Get Your Game On with Hacking Gamification