Exercises in a Box
For Business and Organisations of all types and sizes
What are Exercises in a Box?
Cybata is running expert led Exercises in a Box. These are a series of short specialist Cyber Security and Data Protection exercises developed by the UK’s National Cyber Security Centre (NCSC).
All of our Exercises in a Box are expert-led by one of Cybata’s GDPR or Cyber Security specialists, who provide advice, structure and valuable context around the discussion-based, simulation-based or micro exercises. This ensures that the time spent on each exercise is valuable and applicable to your particular industry
Some exercises can take as little as 15 minutes to complete, with the longest estimated to take only a few hours. This gives both you and your staff the flexibility to progress learning at your own pace. Continually advancing your employees knowledge and expertise. Each of our specialists will work closely with you to ensure that your learning is done at the pace that best suits you.
We have provided an overview of all the Exercises in a Box below. We have also provided a breakdown of the costs:
Discussion-Based Exercises
From £154 + VAT for a group of up to 5 people
Simulation-Based Exercises
From £590 + VAT for a group of up to 5 people
Micro-Exercises
£320 + VAT for all 3 micro exercises delivered within an agreed 4 week period, for a gropu of up to 5 people.
Mobile phone theft and response
Discussion-Based Exercise
Explore how you would be protected from a thief who steals a mobile phone and tries to use it to extract confidential information.
- Keeping your smart phones and tablets safe
- Using passwords to protect your data
This exercise will take an estimated 30 – 60 mins
Insider Threat resulting in a Data Breach
Discussion-Based Exercise
Understand how your organisation would respond to an insider threat, specifically a user allowing unauthorised third parties access to sensitive information.
- Identifying and understanding a suspected data breach
- Controlling file sharing including removable media
- Responding and communicating in response to a data breach
Difficulty rating: Hard. More challenging than Scenarios 1, 2 & 3 and will require some technical knowledge
This exercise will take an estimated 30 – 60 mins
Bring Your Own Device
Discussion-Based Exercise
Understand the controls your organisation has in place to minimise risk from a Bring Your Own Device (BYOD) policy, specifically how to respond when a user’s personal device is compromised or when business data is leaked from a personal device.
Requirements
This scenario assumes your organisation operates a BYOD policy and associated procedures.
This exercise will take an estimated 30 – 60 mins
Supply Chain
Discussion-Based Exercise
Understand and discuss the risks associated with relying upon suppliers to deliver products, systems and services, and the processes that your organisation has in place to mitigate these risks.
Requirements
This scenario assumes that your organisation works with suppliers to deliver some part of your business operations.
This exercise will take an estimated 30 – 60 mins
Managing a Vulnerabilty Disclosure
Discussion-Based Exercise
Understand best practice for handling a vulnerability disclosure on one of your online systems.
- Managing communication for vulnerability reporting
- Responding to the public exploitation of a security vulnerability in your system
- Mitigating further problems by implementing an effective vulnerability disclosure process
This exercise will take an estimated 90 – 120 mins
Cyber threat simulation exercise – A simulation to see if your organisation can locate and stop a mock threat
Simulation Exercise
Making sure your response team is prepared to deal with an incident
- Incident management
- Network security
This exercise will take an estimated 3 – 4 hours
Essential attendees
- Network defenders (player) – Those with the knowledge and understanding of your network, and who would be doing network defence during a cyber attack.
- Technical administrators (player) – Roles with more junior responsibilities but who would be essential in supporting an incident response.
Desirable attendees
- Senior IT stakeholder/decision maker (observer). The individual with overall responsibility for your network may wish to observe this scenario.
- Scribe/observer – someone to take notes during the exercise delivery.
