WorksheetsFirst Bank Plc Cybersecurity Training - Tabletop Exercise
Total questions: 7
Worksheet time: 5mins
It is 10:00 AM on a Thursday morning, when this email was sent to Banking
Operations HOD, by a Cybersecurity Firm named Cyberhubs, regarding potential
data breach of your bank's customers records. They have also offered to help
you at a minimal one-time cost
What is your first course of action? *
Inform your CISO and ask for further investigation and guidance
Put out communication on your website
Pay Cyberhubs to rectify the issue
Does this incident call for assembling the crisis management team?
Yes
No
How will you handle external communication?
Handle only affected customers individually, without releasing any information publicly yet
Communicate with only high valued customer and provide assurance on their data and
financial safety
Engage the PR and media team for public and external communication through different
channels, providing limited information to avoid panic and provide assurance on their data
and financial safety
Engage the PR and media team for public and external communication through different
channels, being transparent about a potential breach and providing guidance on next steps
to customers
What is your immediate next step?
Probably its best to be cautious and act on the information available and start preparing for
the worst
It is too early to act, so keep it within this information within a closed group, until further
Involve police and law enforcement
Report the data breach to regulators
Interlude - Breaking News
While the bank was still deciding whether to release a holding statement or not,
Media broke the news.
Damage Control
All the teams have been working together, following protocols, to assess and
handle the damage done.
1. The bank identified the compromised data, informed affected customers, and
implemented measures to prevent card fraud.
2. Employees under investigation were suspended, and HR documented all
events before deciding on further actions.
3. The incident response team completed the report, which was reviewed by the
Crisis Management Team (CMT). The CMT is planning communication with
stakeholders and next steps.
Which part of investigation is the Incident Response Team in?
Preparation
Identification
Containment
Eradication
Recovery
Scenario 2: Technology Failure or Outage
A critical technology system, essential for core banking operations, has experienced a major outage. This has resulted in significant disruptions to customer services, including online banking, ATM services, and branch operations.
5. What is the most appropriate communication strategy during this outage?
A. Avoid communicating until services are fully restored
B. Share regular updates with customers and stakeholders
C. Communicate only with regulators to avoid panic
D. Issue a single statement once the outage is resolved
6. How can the Board ensure that the organization is prepared for future technology disruptions, especially in the face of evolving threats?
A. Perform routine testing of backup and disaster recovery plans
B. Stay updated on emerging threats and vulnerabilities
C. Automate all backup and recovery processes
D. All of the above
