Table of contents
| Rich media | Long-format writing |
| - Videos | - News articles |
| - Audios | - Emails |
| - Images | Websites |
| - Documents | Personas |
| Pattern of
Life |
Content is also organized by stages
of a
crisis:
1️⃣ Inciting incident
2️⃣ World reaction
3️⃣ Ripple effect
4️⃣ Resolution
VIDEO
Here
are some videos that you can use for a
cyber-attack scenario (or other
tech-related issues)
Learn
how to add your customized ticker and
image overlay to any breaking news
video.
Looking for something else?
Check out the Breaking news clip
list for any type of
incident
1️⃣ INCITING INCIDENT
📺 News about a ransomware
attack (News24)
"A major financial services
company has been left paralyzed
by a ransomware attack. Cyber
experts claim the disruption
could cost the company millions
in lost business
and cancellations."
📺 News about companies without cloud
computing services (News24)
"Thousands of businesses are
without so-called cloud computing
services while the denial of service
attack leaves a major data centre
operator paralyzed. It's not the first
time hackers have mounted such
attacks but why this attack right now
is unclear"
3️⃣ RIPPLE EFFECT
4️⃣ RESOLUTION
📺 News about the end of exercise
(News24)
"In Breaking News, this is the
end of the training exercise. I hope
now you're better prepared for an
uncertain future"
AUDIO
Here are some audios
for
possible
phone calls in case of
cyber
attack
1️⃣ INCITING INCIDENT
🔊 Problems with the CRM
system
"Yeah, hi, it's Bill. Sorry to start
the day
off with a problem but, do you know
what's
happening with the CRM system? It
keeps
crashing on me and I've got a lot of
stuff
I need to import. Cheers."
🔊 Problems with the CRM
system
"Hi, it's Carol. Can you give me a
call when
you get this? I've got a problem with
the
CRM system. I don't know what the
issue is
but it's affecting a few of
ours."
2️⃣ WORLD REACTIONS
🔊 Have we been hacked?
"Hi, it's Alison. I'm getting calls
from the
press asking if we've been hacked.
Have
we?"
🔊 Blogger asking for an
interview
"Hi, yeah, look. This is Damian Greene
at
the Geek Crib blog. I wanted to ask
you a
few questions about your IT problems.
We
are hearing that you might have a
serious
problem. I'm doing a story on serving
problems and I wanted to see if you'd
be
willing to be interviewed.
Thanks."
🔊 Employees asking for
information
"Hi, it's Linda from the Press Office
of HQ.
We're picking the news report
mentioning
PurpleDay. Can you call me back and
let me
know what is going on? Social media
speculate of the story as
well."
3️⃣ RIPPLE EFFECT
🔊 Backups didn't work
"Yeah, hi, this is Mike from IT
operations. I've looked into restoring
the systems from backups and I just
discovered we've been having problems
with the backups, and it's quite way
behind, it's probably about I don't
know about, 15 times, a thousand
records, that will be out of date,
that will be missing when we restore.
I've checked everything, there's
nothing we can do. That's where we
are. I'm sorry."
🔊 The website's been hacked
"Hi, it's Mike. The website's been hacked.
Please, can you get back to me as soon as
possible? I'm gonna send you an email.
We've been inundated with customer calls,
they've all got the same problem. Nobody
can access their accounts."
🔊 Board worried
"The board are really worried about the
share price falling even further and I'm
wondering how I can help. I'm going to
send you some suggestions of things you
might be considering right now."
4️⃣ RESOLUTION
🔊 Website working again
"Hi, the
website is finally working
again. Well done handling
the situation. Thank you
for your
help."
IMAGES
| | Use
these PowerPoint files to
create your own images (save
the slides as JPG) for web
details and broken
web
pages |
🔍 Phone
🔍 Server
DOCUMENTS
Here are some files that you can
use in your
scenarios:
1️⃣ INCITING INCIDENT
📄 Issue report
Document to report an
issue
2️⃣ WORLD REACTIONS
📄 Generic
annual
report
An industry-agnostic annual
report in PDF.
3️⃣ RIPPLE EFFECT
📄 Corrupted PDF
file
A broken PDF file, representing
an encrypted or non-accesible
file.
4️⃣ RESOLUTION
📄 Issue fix
A crisis and incident alert
document.
PATTERN OF LIFE (Stacks)
1️⃣ INCITING INCIDENT
💬 Tweets from angry customers
that can't log in (23
messages)
Sample:
- {data.company} I
just got logged out and can't log in
again. Any ideas what I could
do?
- {data.company} hi hope you can help
regarding my account. I forgot my
password and now I can't log in. I
think I may be using the wrong
email
- {data.company} you logged me out and
now
I can't log in
Download all 23 messages as STAX
file: Can't
Log In.stax
💬 Messages for team members
about internal problems (5
messages)
Sample:
- Anyone having issues with
{data.system_name}?
- {data.system_name} won't let me
in
Download all 5 messages as STAX
file: Internal
Problems.stax
2️⃣ WORLD REACTIONS
💬 Customers complain on social
media (11 messages)
Sample:
- Can't access your online portal
{data.company}
- Can't access my {data.company} account.
Looks like others are having the same
problem...
Download all 11 messages as STAX
file: Customers
complain.stax
3️⃣ RIPPLE EFFECT
💬 Customers about company being
hacked (11 messages)
Sample:
- {data.company} has been hacked!
- Come on {data.company}, these hackers have
stolen your data and you're keeping us in
the dark
Download all 11 messages as STAX
file: Hacked
company.stax
4️⃣ RESOLUTION
💬 Company solved the issue (4
messages)
Sample:
- We are very happy to announce that we
finally resolved the cyber attack we
suffered. We apologize for the
inconvenience and we will ensure that this
does not happen again.
- We sent emails to those who may have
suffered data leak and we will provide
assistance to all our customers. All
clients can access their accounts as
normal again.
Download all 4 messages as STAX
file: Company
solved cyber-attack.stax
* Remember that you can upload this
content as a Pattern of Life
Stax or directly in your MEL view (Master
Event List).
BLOG POSTS & NEWS ARTICLES
1️⃣ INCITING INCIDENT
✒️ Company has signed an
agreement recently
Title: Smarter
Homes, Smarter Lives
Subtitle: {data.partner}'s
smart city gets financing from
{data.company}
{data.partner}, the country's leading property developer, will be able to undertake their breath-taking new project, thanks to {data.company}'s financing{data.partner} plans to build the first smart city in the country, near the river Stour, in John Harbor. The project will start at the beginning of next year.
2️⃣ WORLD REACTIONS
✒️ Customers angry at
company
Title: {data.company} in
trouble
Subtitle: Customers
really angry
{data.company}'s customers are complaining on social media due to the recent events around the company, which may mean a reputational crisis.The company has not pronounced yet while people want to know if they are going to act.
3️⃣ RIPPLE EFFECT
✒️ Company
has
been hacked
Title: {data.company}
Hacked
Subtitle: Activists
object to
{data.partner} financing
{data.country}’s largest financial services group {data.company} has found itself in the dark when it comes to who's hacked the company.Although the hackers are unknown, their motives are clear: prevent the building of 250 homes by {data.partner} on John Harbour countryside. {data.company} has agreed to finance {data.partner}'s project to develop an intelligent community with high-speed internet an artificial intelligence. While the goal might be innovation and efficiency, local activists object to what they see as the destruction of natural wasteland.
✒️ People are biggest
weakness
Title: Cyber-attack
remains the biggest concern
Subtitle: People are the
weakest link
Although companies are spending millions of anti-virus software and firewalls, experts agree that the biggest cyber risk to business are the employees.Too few employees are aware of their responsibilities and the social engineering techniques used to part people from their passwords.
4️⃣ RESOLUTION
✒️ Successful event
Title: {data.company}
solved the issue
Subtitle: Business back
to normal
{data.company} has finally raised an official statement where they affirm to have fixed the issue found earlier, which made people complain on social media and gave the company a headache.
EMAILS
1️⃣ INCITING INCIDENT
📧 Customer information
stolen
Subject: Data
breach
I'm not going to tell you to keep calm because this is bad for us. It looks like we've had a data breach and lifestyle information for about 2000 customers is probably now in the hands of those rotters.I'm calling in an outside forensics security company
2️⃣ WORLD REACTIONS
📧 We hacked
you
Subject: {data.company}
is
about to END
You have been hacked!{data.company} is going to be destroyed. You won't be able to help your friends mess up our countryside. It's going to cost you big time.
3️⃣ RIPPLE EFFECT
📧 Bitcoin ransom
request
Subject: Bitcoin payment of
4BTC requested
You have been sent a payment request from Hack4Loot. He asks for the amount of 4 bitcoin to be paid to the following address: 1HrHpg9ThhfgujEFSahCt7YLYmA54rfSgR____________________________________Attached message:Your files will remain encrypted until you pay...____________________________________You can scan this QR-code to send the requested payment or enter the above mentioned payment information manually.Bitcoin payment of 4BTC requested
📧 Concerned
partners
Subject: Hacking
I'm very concerned that your hacking incident is going to de-rail the intelligent homes project. I've seen the fuss on social media: What's the news from your side?
📧 Hackers angry if no decision
is made
Subject: Ignoring
us?
Oh... this is going to be even worse than you thought. You think you can ignore us?Think again
📧 Security assessment of
damages
Subject: Security Assessment:
Analysis Summary
1. Several vulnerabilities were discovered relating to poor management of network security updates.2. Several administrative accounts of past employees were active. These have been closed.3. Website has been restored.
📧 Company's share price is going
down
Subject: Share price in
free-fall
Our shares are in a nose-dive. This makes us very vulnerable to take-over if we make it out of this with any business at all.The incident response team is being assembled. You're not familiar with the procedures or the people so you stay there and I'll keep you in the loop.
4️⃣ RESOLUTION
📧 Issue solved
Subject: Thank you
Hello everyone,I just wanted to thank you all for your hard work and quick response during the crisis. It has been difficult times, but the end of the storm is finally here. Let’s get back to business as usual!
WEBSITES
Check out how to insert any real or
fictional website in the browser
channel.
🌐 Gh0sthers - Hackers'
organization
🌐 Sectors directory - normal
websites and hacked websites for
different industries
PERSONAS
📌 If you are looking for employees or
customers, search in each company page in
the sector's
area.
📌 If you are looking for people in
general, you can find them in the people's
page.