One of the most important things you can do when you have a plan is to make sure it will survive Mr. Murphy, to the best of your effort.
We've talked about this many times in the blog, but here's a small brain dump of what Red Teaming the plans would look like. Your mileage may vary, though, depending on the plan.
Once you have a plan in place, bring your team and identify the risks, threats and vulnerabilities.
- Risk: is the the likelihood of being targeted by a given attack.
- Threat: is what could happen.
- Vulnerability: is the weakness that an adversary will exploit to make the attack successful.
Translated to the plan: what could break the plan, how and by what.
There are three steps to follow now.
- Identify the key aspects of the plan.
- Identify threats most likely to impact those parts of the plan.
- Determine the vulnerabilities that might make those threats real.
Start by listing the most important parts of the plan, those parts that would cause it to fail if they don't happen. Rank them by criticality:
- Critical: the plan will fail.
- Essential: the plan might fail but you can still run a contingency.
- Non-Essential: good to have, but it if doesn't happen the plan will still succeed.
Write them on a whiteboard, make a table listing each one by critical ranking.
Next, ID the threats. Ask questions like: What can happen? When? What is most likely to happen? How? Write the questions and the answers next to each part identified. Give a probability rank to those threats:
- High: this will most likely happen.
- Medium: there is a chance of this happening, but we have mitigating controls.
- Low: it will rarely happen.
You should have in front of you now, a table with the most important parts of the plan, how critical they are and the threats to those parts marked by probability. You can begin to see already the parts that are most likely to fail and how important they are.
The next step is thinking about the vulnerabilities. Which of the threats identified above have the greatest likelihood of disrupting the plan? How? What is the thing that can break that would cause that threat to become real? Things like equipment failure due to batteries, weather causing traffic and delaying execution, etc.
Add them to the table you are drawing.
You should have, at this point, a clear picture of the things that could go wrong with the plan.
Now focus on the critical parts and high probability threats. Discard for now anything else. List the possible solutions for those and add them to the plan.
When you are done, bring the 10th man. Bring an external party and show him/her the entire plan. Check what he/she can see. Now you are ready.
Remember Rule 29: If you’re happy with your security, so are the bad guys.
Oh, and don't forget to play with the CARVER Matrix.