1. Mission Continuity Program
FY 2019 Tabletop Exercise

2. Introduction Time of year: September 25, 2018 Time of day: 8:00 AM
Weather: Warm weather—no rain.
As a part of this exercise, please inform the Mission Continuity Program by September 10, 2018 of the most critical systems (2-4 total) in rank order that your organization would request to be restored first in this type of disruption, in order to continue your critical operations.
FY 2019 MCP TTX scenario

3. 8:00 AM, Day One
ISC Networking observes unusually high usage of PennNet, the University's internet network. 
Websites and network resources (including internal Penn applications) load slowly and only succeed 50% of the time.
Using your BIA, can you identify the critical processes your organization needs to continue even if PennNet is degraded?
Do you have manual processes defined to continue these critical processes in the event key systems are unreliable or unavailable?
FY 2019 MCP TTX scenario

4. 8:45 AM, Day One
ISC Networking suspects a Distributed Denial of Service(DDoS) attack from outside the University is occurring.  Network congestion is getting worse.  
IT systems now load only 25% of the time.
WebLogin (Pennkey) is completely unavailable.  This means users cannot access any application that uses Weblogin to authenticate, such as Penn+Box.  Also, poor network connectivity means that Cloud (vendor-provided) services like Penn O365 and Amazon Web Services are only intermittently available, making them unreliable and/or unusable from on-campus.
Your organization's leadership decides to have an emergency meeting/conference call with all your organization's critical staff to determine course of action.
Do you have an Incident Response Team designated?
Do you have a Call List for the people who need to be contacted about this disruption, so they can be contacted easily?
Do you have an out-of-band communications channel (such as Slack, MS Teams or xMatters) that will allow you to text everyone on your Call List?  If not, does leadership have a means (e.g. personal cell #s) to reach key individuals?
FY 2019 MCP TTX scenario

5. 11:30 AM, Day One The attack continues and shows no signs of stopping.
Phone systems that rely on VoIP (digital Voice Over IP as opposed to traditional landlines) are severely degraded.  Call quality is very choppy and calls fail 50% of the time.
Do you have a fallback means of real-time communication?
Do staff know where to find this information?
Is this information accessible and up-to-date?
Do you have access to your Mission Continuity plans, either in hard copy of saved on a flash drive, so you can access them even if there is not internet available?
FY 2019 MCP TTX scenario

6. 9:00AM, Day Two
After a meeting with senior leadership, including the Provost and EVP, the University makes the decision to temporarily block all access to or from the Internet to stem the attack.
This succeeds and allows internal Penn applications to function normally, but requires you to be on-campus to access them.  Also, Cloud-based applications are not available.
VoIP phone systems begin to work normally again.
 How does the continued lack of external Internet access affect your organization’s ability to pursue its critical processes and functions?  
Are alternate processes available and defined?
Are continuity plans in use?
 How is your organization affected by the lack of remote access capabilities (e.g., no VPN, Remote Desktop, etc.)?
 Can your organization's staff support the requirement to be on-campus without issue?
What Cloud-based applications are critical to operations?
FY 2019 MCP TTX scenario

7. 11:30AM, Day Two
Affected users have been posting on social media about the attack and complaining that they can’t access the Internet from on-campus.
You receive a call from the Daily Pennsylvanian and other outlets asking for details and what your organization is doing to recover.
They inform you they have other “inside sources” and will be running a story shortly, with or without your input.
Do you have a communications plan to activate, informing your constituents about what is going on in your organization during this event? 
Does this include a plan for managing public communications, such as print media and social media?
Are you aware of the guidance provided from University Communications when approached by the media?
FY 2019 MCP TTX scenario

8. 8:00AM, Day Three (“Zombie Apocalypse”)
ISC Networking has worked with Penn’s Internet providers to track and shut down the source of the attack.  External internet access to Penn has been restored.
However, ISC Security now reports that a large number of systems were compromised, using the attack as cover.
Although the attack has been blocked, the compromised machines have now spread ransomware to a number of machines across campus, including several in your organization, which have made critical Penn applications and data, including BEN Financials and PennWorks, inaccessible.
 Check your BIA to determine how long your organization can continue critical operations without access to these key systems (RTO).  Does this need to be updated?
Can you continue to use manual workarounds in the event these systems remain unavailable?
FY 2019 MCP TTX scenario

9. 1:00PM, Day Three (“Zombie Apocalypse”)
The ransomware outbreak has been contained, but there are still quite a number of systems and applications that need to be recovered.
 Does the priority list of your most critical systems that need to be brought up first (balancing organizational and client needs) and identified in advance of this tabletop continue to be in the correct ranked order?  
 Are your IT disaster recovery plans documented in your Mission Continuity plans?
FY 2019 MCP TTX scenario

10. Mission Continuity Planning
Were our plans adequate for this type of loss and disruption to normal operations?
Are we able to continue operations without major impact to our constituents?
Post-exercise analysis:
How could we improve communications?
Do we need to modify our Mission Continuity plans, DR plans, and BIA?
What was missing in the steps we took during the scenario?
What would we do differently?
What are the most important lessons learned?
Are we comfortable with our response and ability to recover?
Did we succeed in protecting Penn assets?
FY 2019 MCP TTX scenario