Vulnerability management tabletop exercise: Disclosure, response and risk

This workshop is a facilitated tabletop exercise with role-based participation, timed injects and involvement from attendees in a scenario. Attendees are placed in a realistic vulnerability management scenario. In teams, participants will work through discovery, triage, disclosure, coordination, prioritisation, communications, and remediation while balancing incomplete information and active attacker interest.

A fictional scenario is presented of a network and services. The scenario is designed so participants play different stakeholders:

• System Vendors
• CNA (CVE Numbering Authority)
• System defender
• Researchers
• Attackers

Each stakeholder is scored based on their ability to optimise their desired outcomes. For example, the vendor will seek to control the narrative and ensure the vulnerability does not result in financial or legal risk. In contrast, the system defender will seek to reduce the risk of a vulnerability leading to system compromise.

Participants will be provided partial information, conflicting incentives and time pressure. The objective of the workshop is to educate participants on the vulnerability ecosystem and demonstrate effective practices to manage vulnerabilities as system defenders.

The full lifecycle of a vulnerability will be demonstrated including the different stakeholders involved. Different types of vulnerabilities will be exposed. System defenders will need to prioritise and manage these vulnerabilities to reduce risk, whilst external stakeholders seek to manage their own incentives and objectives.

This workshop will be delivered for the first time in this format at CyberCon Melbourne.