Image Placeholder


Table of contents


 Rich media
Long-format writing
 - Videos
- News articles
 - Audios
- Emails
 - Images
Websites
 - Documents
Personas
  Pattern of Life

Content is also organized by stages of a crisis:
1️⃣ Inciting incident
2️⃣ World reaction
3️⃣ Ripple effect
4️⃣ Resolution


VIDEO

Image Placeholder
Here are some videos that you can use for a cyber-attack scenario (or other tech-related issues)
Learn how to add your customized ticker and image overlay to any breaking news video.
Looking for something else? Check out the Breaking news clip list for any type of incident

1️⃣ INCITING INCIDENT


📺 News about a ransomware attack (News24)

"A major financial services company has been left paralyzed by a ransomware attack. Cyber experts claim the disruption could cost the company millions in lost business and cancellations."



📺 News about companies without cloud computing services (News24)

"Thousands of businesses are without so-called cloud computing services while the denial of service attack leaves a major data centre operator paralyzed. It's not the first time hackers have mounted such attacks but why this attack right now is unclear"



3️⃣ RIPPLE EFFECT


📺 Website traffic dropping to zero (Google Analytics)

No audio



4️⃣ RESOLUTION


📺 News about the end of exercise (News24)

"In Breaking News, this is the end of the training exercise. I hope now you're better prepared for an uncertain future"




AUDIO

Image Placeholder

Here are some audios for possible phone calls in case of cyber attack


1️⃣ INCITING INCIDENT


🔊 Problems with the CRM system

"Yeah, hi, it's Bill. Sorry to start the day off with a problem but, do you know what's happening with the CRM system? It keeps crashing on me and I've got a lot of stuff I need to import. Cheers."

🔊 Problems with the CRM system

"Hi, it's Carol. Can you give me a call when you get this? I've got a problem with the CRM system. I don't know what the issue is but it's affecting a few of ours."

2️⃣ WORLD REACTIONS


🔊 Have we been hacked?

"Hi, it's Alison. I'm getting calls from the press asking if we've been hacked. Have we?"

🔊 Blogger asking for an interview

"Hi, yeah, look. This is Damian Greene at the Geek Crib blog. I wanted to ask you a few questions about your IT problems. We are hearing that you might have a serious problem. I'm doing a story on serving problems and I wanted to see if you'd be willing to be interviewed. Thanks."

🔊 Employees asking for information

"Hi, it's Linda from the Press Office of HQ. We're picking the news report mentioning PurpleDay. Can you call me back and let me know what is going on? Social media speculate of the story as well."

3️⃣ RIPPLE EFFECT


🔊 Backups didn't work

"Yeah, hi, this is Mike from IT operations. I've looked into restoring the systems from backups and I just discovered we've been having problems with the backups, and it's quite way behind, it's probably about I don't know about, 15 times, a thousand records, that will be out of date, that will be missing when we restore. I've checked everything, there's nothing we can do. That's where we are. I'm sorry."

🔊 The website's been hacked

"Hi, it's Mike. The website's been hacked. Please, can you get back to me as soon as possible? I'm gonna send you an email. We've been inundated with customer calls, they've all got the same problem. Nobody can access their accounts."

🔊 Board worried

"The board are really worried about the share price falling even further and I'm wondering how I can help. I'm going to send you some suggestions of things you might be considering right now."

4️⃣ RESOLUTION


🔊 Website working again

"Hi, the website is finally working again. Well done handling the situation. Thank you for your help."


IMAGES

Image Placeholder

You can always look for images you may need for your scenario in Pixabay or Unsplash, among others.

Try to search:

🔍 Code
🔍 Phone
🔍 Server


DOCUMENTS

Image Placeholder

Here are some files that you can use in your scenarios:


1️⃣ INCITING INCIDENT


📄 Issue report
Document to report an issue

2️⃣ WORLD REACTIONS


📄 Generic annual report

3️⃣ RIPPLE EFFECT


📄 Corrupted PDF file

A broken PDF file, representing an encrypted or non-accesible file.

4️⃣ RESOLUTION


📄 Issue fix

A crisis and incident alert document.


PATTERN OF LIFE (Stacks)



Not familiar with Pattern of Life? Learn more about the use of smartwords - i.e. {data.company} 

1️⃣ INCITING INCIDENT


💬 Tweets from angry customers that can't log in (23 messages)

Sample: 
  • {data.company} I just got logged out and can't log in again. Any ideas what I could do?
  • {data.company} hi hope you can help regarding my account. I forgot my password and now I can't log in. I think I may be using the wrong email
  • {data.company} you logged me out and now I can't log in
Download all 23 messages as STAX file: Can't Log In.stax


💬 Messages for team members about internal problems (5 messages)

Sample: 
  • Anyone having issues with {data.system_name}?
  • {data.system_name} won't let me in
Download all 5 messages as STAX file: Internal Problems.stax

2️⃣ WORLD REACTIONS


💬 Customers complain on social media (11 messages)

Sample:
  • Can't access your online portal {data.company}
  • Can't access my {data.company} account. Looks like others are having the same problem...
Download all 11 messages as STAX file: Customers complain.stax

3️⃣ RIPPLE EFFECT


💬 Customers about company being hacked (11 messages)

Sample:
  • {data.company} has been hacked!
  • Come on {data.company}, these hackers have stolen your data and you're keeping us in the dark
Download all 11 messages as STAX file: Hacked company.stax

4️⃣ RESOLUTION


💬 Company solved the issue (4 messages)

Sample:
  • We are very happy to announce that we finally resolved the cyber attack we suffered. We apologize for the inconvenience and we will ensure that this does not happen again.
  • We sent emails to those who may have suffered data leak and we will provide assistance to all our customers. All clients can access their accounts as normal again.
Download all 4 messages as STAX file: Company solved cyber-attack.stax

* Remember that you can upload this content as a Pattern of Life Stax or directly in your MEL view (Master Event List).


BLOG POSTS & NEWS ARTICLES



1️⃣ INCITING INCIDENT


✒️ Company has signed an agreement recently

Title: Smarter Homes, Smarter Lives
Subtitle: {data.partner}'s smart city gets financing from {data.company}

{data.partner}, the country's leading property developer, will be able to undertake their breath-taking new project, thanks to {data.company}'s financing

{data.partner} plans to build the first smart city in the country, near the river Stour, in John Harbor. The project will start at the beginning of next year.

2️⃣ WORLD REACTIONS


✒️ Customers angry at company

Title: {data.company} in trouble
Subtitle: Customers really angry 

{data.company}'s customers are complaining on social media due to the recent events around the company, which may mean a reputational crisis.

The company has not pronounced yet while people want to know if they are going to act.

3️⃣ RIPPLE EFFECT


✒️ Company has been hacked


Title: {data.company} Hacked
Subtitle: Activists object to {data.partner} financing

{data.country}’s largest financial services group {data.company} has found itself in the dark when it comes to who's hacked the company.

Although the hackers are unknown, their motives are clear: prevent the building of 250 homes by {data.partner} on John Harbour countryside. {data.company} has agreed to finance {data.partner}'s project to develop an intelligent community with high-speed internet an artificial intelligence. While the goal might be innovation and efficiency, local activists object to what they see as the destruction of natural wasteland.

✒️ People are biggest weakness

Title: Cyber-attack remains the biggest concern
Subtitle: People are the weakest link

Although companies are spending millions of anti-virus software and firewalls, experts agree that the biggest cyber risk to business are the employees.

Too few employees are aware of their responsibilities and the social engineering techniques used to part people from their passwords.

4️⃣ RESOLUTION


✒️ Successful event

Title: {data.company} solved the issue
Subtitle: Business back to normal

{data.company} has finally raised an official statement where they affirm to have fixed the issue found earlier, which made people complain on social media and gave the company a headache. 


EMAILS



1️⃣ INCITING INCIDENT


📧 Customer information stolen

Subject: Data breach

I'm not going to tell you to keep calm because this is bad for us. It looks like we've had a data breach and lifestyle information for about 2000 customers is probably now in the hands of those rotters.
I'm calling in an outside forensics security company

2️⃣ WORLD REACTIONS


📧 We hacked you

Subject: {data.company} is about to END

You have been hacked!
{data.company} is going to be destroyed. You won't be able to help your friends mess up our countryside. It's going to cost you big time.

3️⃣ RIPPLE EFFECT


📧 Bitcoin ransom request

Subject: Bitcoin payment of 4BTC requested

You have been sent a payment request from Hack4Loot. He asks for the amount of 4 bitcoin to be paid to the following address: 1HrHpg9ThhfgujEFSahCt7YLYmA54rfSgR
____________________________________
Attached message:
Your files will remain encrypted until you pay...
____________________________________
You can scan this QR-code to send the requested payment or enter the above mentioned payment information manually.
Bitcoin payment of 4BTC requested



📧 Concerned partners

Subject: Hacking

I'm very concerned that your hacking incident is going to de-rail the intelligent homes project. I've seen the fuss on social media: What's the news from your side?

📧 Hackers angry if no decision is made

Subject: Ignoring us?

Oh... this is going to be even worse than you thought. You think you can ignore us?
Think again

📧 Security assessment of damages

Subject: Security Assessment: Analysis Summary

1. Several vulnerabilities were discovered relating to poor management of network security updates. 
2. Several administrative accounts of past employees were active. These have been closed. 
3. Website has been restored.

📧 Company's share price is going down

Subject: Share price in free-fall

Our shares are in a nose-dive. This makes us very vulnerable to take-over if we make it out of this with any business at all.
The incident response team is being assembled. You're not familiar with the procedures or the people so you stay there and I'll keep you in the loop.

4️⃣ RESOLUTION


📧 Issue solved

Subject: Thank you

Hello everyone,

I just wanted to thank you all for your hard work and quick response during the crisis. It has been difficult times, but the end of the storm is finally here. Let’s get back to business as usual!


WEBSITES



Check out how to insert any real or fictional website in the browser channel.

🌐 Gh0sthers - Hackers' organization

🌐 Sectors directory - normal websites and hacked websites for different industries


PERSONAS



📌 If you are looking for employees or customers, search in each company page in the sector's area.

📌 If you are looking for people in general, you can find them in the people's page.