Darren is a Partner at McGrathNicol in the Technology & Cyber team who specialises in advising businesses on both proactive and reactive uses of technology in the areas of cybersecurity, privacy, digital forensics and technology-led investigations.

Darren is a highly respected, qualified investigator and forensic technology expert with more than 25 years of specialist forensic experience and more than five years as a foundation member of the Forensic Computer Examination Unit with the Queensland Police. Held in high regard by attorneys and the courts, he has undertaken complex computer forensic examinations for both criminal and civil litigation in Australia and overseas.

He works regularly with boards, executives and senior business leaders in organisations of every size to consider and set technology strategies for cyber, privacy, data protection and information risk management. His extensive experience spans across a wide range of industries, including business services, construction, entertainment, financial services, government, healthcare, insurance, leisure, manufacturing, retail and technology. He also regularly applies his digital forensic and investigative expertise to help resolve time- critical and highly sensitive issues as they arise. These matters range from large-scale data breaches or theft, through to employee misconduct or intellectual property matters.

Tutorial: Conducting Cyber Tabletops – A Practical Guide on How to Develop a Scenario Exercise

Technical Level (3 being the highest score): 1

A consistent industry theme is that organisations of all shapes and sizes should conduct cyber table top exercises.

By working through breach scenarios organisations can improve their ability to respond to a real cyber threat. Despite proven benefits few Australian organisations have the confidence to perform scenario tabletops.

This often stems from difficulty in understanding how a cyber scenario should be developed, and how effective tabletop exercises are delivered.

There is no one size fits all approach for workshops however common key principles exist. The purpose of this tutorial is to provide audience members with an overview of the steps involved in preparing for and delivering cyber tabletop exercises, and strategies to maximise the benefit of a scenario workshops.

Some of the issues this session will explore include:

a) Preparation that should be undertaken prior to developing a tabletop workshop such as incident response plan development, IR team identification, accountability assessments, threat identification and gaps analysis resilience;

b) Identifying the individuals within the organisation and any third parties that should be involved in the cyber risk scenario;

c) The factual investigations that should be performed to help develop an appropriate cyber risk scenario, including how to identify industry specific risks, incorporating legal and regulatory items, and leveraging available information on breach costs and reputational harm example;

d) How a tabletop should be customised to the organisation’s incident response process and what critical thinking issues the scenario should raise for participants;

e) Options for delivering the workshop scenario including event structure, formulating what information to provide to participants, developing evolving scenario elements and facilitating discussion items; and

f) How to incorporate information and lessons learned from a tabletop to improve the organisation’s resilience and ability to respond to an event.