Cybersecurity Preparedness: A 60-Minute Exercise for Distributors

AdobeStock Photos

A vendor emails accounts payable on a Tuesday morning to update its remittance details. New bank, new routing number, same contact name and the same signature block as the last four emails from that vendor. The batch runs Thursday.

Somebody must decide whether it runs.

That decision belongs to the business, and in most distributorships, nobody has said out loud who owns it.

Ask how cybersecurity is handled at a mid-size distributor and the answer points somewhere: an IT director, a managed provider, a firewall renewal that came up last spring. The answer is fine as far as it goes. It does not go where the trouble is. A provider can patch software, rotate credentials, and rebuild a file server. Nobody outside your building decides whether to hold a payment batch, whether to call the customer whose order data was sitting in that mailbox, or whether the counter opens in the morning.

In April, ASA wrote about the vendor payment scam that runs this play, and in July about the exposure that arrives through a connection you do not own. Both pieces described the problem. The question underneath it goes to a different set of people. If that email landed at 11:40 this morning, who in your company says pause?

Five scenarios. Sixty minutes. Real answers.

ASA published an exercise in April that forces the answer, and what it asks of you is small.

Sixty minutes. Your own conference room. You run it yourself, and you do not need to be a security expert to do it.

The format is five injects, nine minutes each, and a ten minute close. An inject is a slide read aloud exactly as written, then silence.

At 9:15 on Tuesday morning, your AP manager did not send those emails. Who owns this, and what happens in the next ten minutes? By 11:40 the request looks completely legitimate. Do you pause the batch, or run it? By 3:20 that afternoon the scenario has eighty-five thousand dollars out the door, and the question turns to who runs the financial response and what happens in the next hour.

By Wednesday morning the question is how far they got, what else they saw, and who has to be told. By Friday the channel has found out.

The company in the scenario is fictional. The facilitator guide tells you to swap in your own details before you start, and the list it gives is the tell that this was built for this industry rather than bought off a shelf. Branch count. ERP name. Counter hours. Average daily shipments.

 One instruction in that guide decides whether the hour was worth anything. It tells the facilitator to redirect the room every time it starts solving the problem technically. Assume IT handles the mechanics. Ask what the rest of the business does in the next hour. Then the line that earns the exercise its keep: if IT answers every inject, the exercise failed.

A room that has outsourced the technical work will sit and wait for the technical answer. The technical answer was never the hard part.

The room the exercise asks for is finance, IT or security, operations, sales and whoever else faces the customer, and somebody who can sign. The same request lands at manufacturers and rep agencies. The functions in the room do not change.

Send the list in advance. If a function cannot make it, that absence is your first finding, and the guide says to write it down rather than let somebody answer on that person's behalf. It is blunt about why. The person who would make the highest-stakes call has never discussed it.

Turn the unknowns into action

Somewhere in the hour a room usually hits a question nobody can answer. The guide calls that the most valuable moment in the exercise and tells the facilitator to stop, say it out loud, and write it on the action plan before moving on. Unknowns are the output, not a failure. Rush past that and a company can run the full sixty minutes and leave with nothing.

Then the close, which is the actual product. Ten minutes, and the guide says it is not optional. Name the three gaps that would hurt most. Give each one an owner by name, because a department is not an owner. Put a real date on each, because a quarter is not a date. Book the thirty day review before anyone leaves the room.

The whole cost is twenty minutes of reading for whoever runs it, an hour for the room, and a printer. Against a payment batch that goes out Thursday, that is not a hard trade.

Ransomware is the second scenario and it is in development now. The two connect on purpose. Inject five of the payment exercise is where a company that runs both sees how the first becomes the second, because stolen credentials are how most ransomware starts.

The exercise sits on the ASA cybersecurity page in the Innovation section at asa.net. Run it, then tell ASA what landed, what did not, and what your room argued about. That feedback is what shapes the next scenario.

Nobody is coming to run this for you. That is the point of it.

By Nils Swenson

ASA guided tabletop exercises are educational preparedness materials for member companies. The scenarios are fictional and are not legal, insurance, or technical advice. Each company consults its own counsel, carrier, and security advisors on its own circumstances.