5 Pro Tips for Organizing an Effective Team Sim
While scheduling a Team Sim exercise in the Immersive Labs platform is very straightforward, I’m sharing a list of recommendations and tips for making sure your exercise goes the extra mile: 1. Define exercise objectives Know the purpose of the exercise to keep a laser focus and stop scope creep, which can dilute the exercise experience and learning takeaways. Is this a fun exercise that will encourage engagement, or is it a capability assurance exercise? Knowing your objective is essential for effective planning. For example, a fun exercise might include more guidance and hints than a capability assurance exercise. 2. Block out calendars in advance Identify your participant list as early as possible and send placeholders out to ensure the team’s availability. The more advance notice, the better. At a minimum, provide two weeks’ notice, but ideally one month. In some large-scale cases, whole Team Sim exercise programs are planned and booked out over six months in advance. 3. Host a briefing session These sessions provide a great chance to set the expectations and objectives of the exercise, communicate important exercise information, answer any questions, and, most importantly, get the team excited about it! We recommend organizing a briefing call the week before the exercise. 4. Run a systems test The last thing you’ll want to deal with when your exercise launches is any dreaded technical issues. Make sure you run a systems test early in the planning stages, leaving plenty of time for your organization to make any required configuration changes. You can find system requirement details here. 5. Assign preparation labs Some of the catalog exercises may use security tools unfamiliar to your organization. I believe in the benefits of vendor-agnostic learning when it comes to skills development, but understand that unfamiliar tools can be frustrating. If you have access to our hands-on labs, there are preparation labs available tailored for each catalog exercise. Assign these to participants a minimum of two weeks before the exercise. If you need any help or support with planning, ask a question in our Help and Support forum. Following these steps ensures clear expectations from your participants and a smooth lead-up to your exercise, which plays a big factor in making it a success! Do you have any hints or tips for other exercise planners and facilitators? What lessons have you learned, or where have you seen success? Let us know in the comments below.Defend as One: Breaking Down Technical Barriers Across an Organisation Through Technical Team Exercising
This article details how a public healthcare account used Immersive Labs’ Cyber Team Simulation for a cross-departmental May Day programme, benchmarking national cyber capabilities. As their Cyber Workforce Advisor, I’ll outline the steps taken, from planning to execution, to achieve this strategic programme.New Team Sim Content: (Defensive) Operation Vulpes
Operation Vulpes is a defensive scenario and marks a return of using Splunk as the SIEM solution. This scenario sees Orchid Corporation reeling from the aftermath of a ransomware attack. Defenders will need to determine the attacker's path to compromise and infect the network and use information provided by a law enforcement agency to attempt to recover files. Users will need to use a variety of tools and defensive disciplines to solve the scenario – not just the SIEM solution. This sim also utilizes our new user noise generation framework to simulate user web browsing activity on end-user devices. This spawns the Edge browser as a domain user and visits internal and external websites to add additional noise to logs collected by Splunk. Why have we created this content? This Team Sim adds a level of complexity and realism by introducing actual ransomware. So you and your teams can exercise and prepare for the worst-case scenario. (Please be aware that Immersive Labs created the ransomware for exercise purposes only and includes failsafes to control its execution.) In addition, the sim uses popular tools within security stacks, so the simulation is true to life. What are we publishing? A new Team Sim exercise, Operation Vulpes, which will be viewable in the Team Sim catalog for all Team Sim customers. Who is this content for? This Team Sim is primarily focused on testing the defensive and technical capabilities of the following roles: SOC analysts Incident responders Threat hunters Check it out now!Team Sim: Best Approaches for Your Team
A common issue in Team Sim exercises is when one player works in isolation, leaving others behind and missing the chance to build key team skills. To get the most out of a Team Sim exercise, the focus should be on teamwork – it’s in the name! Whether your team is meeting for the first time or has worked together every day for many years, here are some common characteristics and actions I’ve consistently seen in the best-performing teams: 1. Team leader Regardless of the person’s day-to-day role, a nominated team leader is the essential glue for any team. Some responsibilities I’ve seen effective team leaders adopt include chairing discussions, driving the group to a consensus and a clear decision, being the team’s representative for exercise manager communications, ensuring the team stays organized, and encouraging a positive experience for every member. 2. Pre-exercise team meeting A good plan will start the team on solid footing. High-performing teams bring everyone together before starting the exercise to agree on the approaches and rules of engagement. If you’re meeting the team for the first time, taking the time for introductions is critical to a comfortable environment. 3. Clear communication channels Establishing clear communications for sharing technical information and virtual conferencing details (if required). We recommend setting up a temporary private messaging group in your organization’s approved communications platform. Every team member should know how and where to ask questions or ask for support. 4. Blocked out exercise time Depending on how you approach the exercise (more on this later), teams that reserve time in their calendars in advance tend to have greater attendance and engagement. The effectiveness of team exercises depends on factors like team size, communication medium (in-person, virtual, or hybrid), time zones, skill levels, and goals. For example, do you want to put a well-known team to the test or have junior members learn from experienced analysts? In the spirit of collaboration, we have some tried and tested team approaches that we know work well in bringing people together. Each approach has its advantages and disadvantages, so bear this in mind when thinking about what works best for you and your team. One Team This involves the entire team working through the exercise together, either in person or virtually, maintaining constant communication and progressing at the same pace. This is the most common approach and is great for information sharing and peer learning. However, in larger teams, there’s a higher risk of some members falling behind, reducing their engagement. Chairperson Somewhat contrary to our earlier sentiments, this approach requires players to conduct portions of the exercise tasks alone, before coming together as a team during regular checkpoint meetings to discuss and validate each other's answers and findings. The team must agree on an answer before a chairperson submits the answer to a question in Team Sim. This is a slower approach, but it provides every player a chance to experience the whole exercise while encouraging knowledge sharing and exposure to different approaches and styles. Relay This is best for geographically split teams and perfect for exercising handover communication! Teams work on segments (e.g., specific time blocks or question sets) and pass their findings to the next team. Handoffs should mirror real incidents, addressing findings, uncertainties, and further investigations. A post-exercise debrief is a great opportunity to review and improve handover processes and communication skills. Team Strengths No two people are the same, and you may have specialists or people with particular strengths you can lean on. As you progress through the exercise and require different skills and knowledge, engaging those specialists can be an effective way to tackle a problem as a true team. Identify those strengths early on so you know what's in your team’s arsenal! Want a challenge? Do the opposite and encourage the team to use the skills they find challenging! If you want to save a copy of these approach ideas, check out our Team Sim Player Guide, which you can download and share. Share your thoughts This isn’t an exhaustive list of approaches; be creative with your team to find what works best for you. If you’ve participated in a Team Sim exercise before, let us know your tips for creating a top-class team dynamic!
