CornCon_11 FRI-T3-9:45 Barry Suskind

Purpose of tabletops

Barry Suskind at CornCon, drawing on three decades in security and SANS/Golden Institute work, frames tabletop exercises as dry-run disaster recovery for cyber incidents. They reveal gaps, stress-test teams, and teach containment of information flow so breaches are not discussed over open email or ticketing systems that could tip attackers or leak to the public.

Exercise types

Technical tabletops gather CISOs, engineers, and adjacent staff to walk through realistic scenarios inspired by current news such as ransomware. Business tabletops assume breach declaration and train executives on messaging, regulatory reporting, and crisis decisions. Combined end-to-end runs expose both sides but are hard to schedule because executives rarely sit for multi-hour sessions.

Planning essentials

Suskind recommends two- to four-hour formats, current incident response plans with accurate tooling and contact lists, clear incident command (CISO as liaison, not sole commander), separate defensive and investigative leads, and advance scheduling. He contrasts poor CrowdStrike CTO communications with stronger CEO messaging after the July outage as a lesson in public response.