Incident Response Plans and Tabletop Exercises May Be A Waste of Time

In my 23 years of delivering incident response and digital forensics services to companies I've become fairly adept at predicting how an incident response engagement will go, based on the first 10 minutes of an initial call with a client. Some clients are well prepared and able to chug through the incident process with our team and get back to routine operations in a couple of days. Other, less prepared clients are in for a painful experience that could drag on, consuming resources and dollars for more than two or three weeks. It is entirely how those clients prepared for the incident that makes the difference.

Unfortunately, most people with roles and responsibilities defined within your IRP will not remember exactly what they are supposed to do when a breach actually occurs. One-time or annual refresher training on IRP or TTE is insufficient to build the cyber resilience and effective response capabilities you seek. Ebbinghaus' Curve of Forgetting hypothesizes that people forget up to 70% of new material they learned within two days. What are the chances people will recall their duties and responsibilities when the time comes 10 months after a drill? Does everyone remember where they placed their copy of the incident response manual? Will they truly understand what we need to do to combat the situation? Furthermore, experience tells us that often clients do not even pull out their IRP when in crisis. Instead, they call external resources and rely on their expertise and experience to guide them through the response.