Tabletop Scenarios
@badthingsdaily
Followers
18K
Following
25
Media
4
Statuses
480
THESE 👏 TWEETS 👏 ARE 👏 FICTION👏 This account tweets fictional or headline inspired breach scenarios. To play: Share opinions on prevention or response steps.
Joined February 2017
All of the below tweets are fictional conversation starters meant to kick off security tabletop conversations. #DontPanic.
6
15
110
Your remote support employees have been successfully bribed.
0
9
70
Billing alerts for outbound data transfer have started going off in object storage where your backup databases are stored. Happy Thanksgiving.
1
12
62
A competitor has submitted a functionally identical proposal to one you’ve submitted that is only dollar under yours. The potential client, confused, asks if this is some kind of joke. They never shared your proposal, nor have you.
1
2
33
A military has found a way to blow up a product you sell, remotely.
1
4
18
An executive of yours has suddenly decided to correct people who are wrong on the internet. The wrong people very quickly start paying attention to your executive, who was not previously in the public eye.
1
4
48
An incident has just been declared after evidence of an intrusion was discovered. All relevant on-calls have been paged. Happy Labor Day.
1
6
52
An unknown threat actor had gained access to the Company’s Google G-Suite account and changed passwords of all users of the Company’s G-Suite products (GMail, GDrive, G-Suite, etc), thereby denying access to all users.
“An unknown threat actor had gained access to the Company’s Google G-Suite account and changed passwords of all users of the Company’s G-Suite products (GMail, GDrive, G-Suite, etc), thereby denying access to all users having an unicoin email address” 👀.
0
10
75
An adversary has sent a specially crafted packet designed to exploit a vulnerable tcp/ip stack in a server you’ve exposed to the internet.
3
4
28
Recovery keys necessary to recover from an outage are inaccessible due to the same outage.
4
40
234
The management control plane you would normally use to respond to an outage is down because of the outage.
0
23
101
Nearly all customers are reaching out simultaneously after your product has triggered an outage.
5
32
165
All systems running a particular EDR are crashing.
3
28
143
All of your corporate cellular call and text records are leaked publicly.
0
12
69
Your hosted data warehouse has notified you of a breach.
1
9
44
Your cloud provider has deleted one of your accounts.
new one for @badthingsdaily: one of the top three cloud providers has a misconfiguration and deletes your entire account by accident and can't recover it.
3
48
210
Your eSignature vendor has announced a breach. All contracts have been exposed to an unknown adversary.
4
22
110
A ransomware gang has listed your company as a victim. They forgot to leave a ransom note, making negotiation or payment impossible. 🙃.
0
8
52
Your response efforts have produced *no root cause* for a data breach that you are obligated to disclose.
1
4
31
A huge fire has erupted at a datacenter you rely on.
12
9
84
A production engineer investigating a poorly performant binary has discovered that it is executing code that isn't possible in its associated source.
4
21
153