Enter the War Room- Crisis Simulations (Healthcare)

Hi, everybody. My name is Courtney Gus. I'm the AVP of crisis management here at Semperis, a fancy way of saying I work on the Ready1 team, and I am your facilitator for today at our enter the war room or previously known as Operation Blind Spot for those of you who have joined us in the past. I'm terrible with the mic. I'll try to hold it up higher. Thank you. Today's exercise is not really a tabletop. It's strategic moves and counter moves. The red team and the blue team are gonna come up with plans. You're gonna hear from each other, and then you're going to determine your response. Alright? There's no specific set of expertise required. If you like to win, it's a fun way to play. I'm very competitive, so, you know, act accordingly. And you'll have team leaders that will help guide you guys through the process. Sound good? Alright. Today is a health care crisis. I know it's everybody's worst day. Right? We're gonna walk through what happens during a hospital attack from a blue team perspective and a red team perspective. For your teams, I see all of you invest, which is phenomenal. When we get started, I will have you break out into your respective groups. Okay? One of the groups is gonna be up here. Why don't we do our blue team up in the front, red team towards the back where we've got the tabletops? You're gonna need these easels to make notes because this is where you're gonna plan your attacks or your defense. Alright? So when I say go with your groups, blue team's gonna come up here to the front. In this group, we can move chairs, do whatever we need to, stand, try to spy on the other team. Red team in the back, you guys can take your notes back there. Sound good? Alright. I don't think we need to spend too much time on this because it's gonna eat through your through your attack plans, but health care attacks are severe. They're on the rise. This isn't anything new to this group here. What's interesting about the health care sector, though, is we have zero downtime tolerance. There are patients in the hospital, patients in the building. You're taking care of human lives, which means we have to react quickly, we have to react in a smart way, and we have to have a plan in place because you don't wanna be figuring out how to take care of humans while you're in the middle of a crisis. And it's really just a very unusual or kind of different response process than a lot of other industries. So during our health care meltdown, don't complain about the emergency room waiting times. It's long. It is what it is. This is fictitious. We're meant to have a little bit of fun today. Please don't say anything sensitive or share information that you wouldn't want shared outside your organization, but also be respectful. And remember, this is kind of Chatham House rules, what we talk about here today and we play today, stays here. The goal is to have a little bit of fun, participate as a group, share your insights and ideas. There's no wrong idea. You'll hear it all today, and we're gonna have some fun as we run through. This is a very quick exercise today, so we're gonna have to move fast, which means when I break you out in groups, you get no extra time. I'm not a very nice moderator. I will give you the timer, get your answers on paper as quickly as possible, and then you're gonna share your answers back and forth as groups. Again, I'll cut you off if you don't go fast, so keep that in mind. I know I'm not very nice, am I? So we're gonna set the scene. Blue Harbor Health System, one of the region's largest health care providers, delivers emergency care, surgery, pharmacy services, inpatient, outpatient treatments across its hospitals and clinics, known for high patient volumes and tightly managed clinical workflows. They depend on seamless coordination across the teams, electronic health records, medical devices, and hospital operations. At the center of it all, what will we do without AI, is Blue Harbor's brand new AI enhanced clinical command center. The organization's pride and joy, and they're very vocal about this new command center. It's built to provide real time visibility across patient flow, bed capacity, staffing, and critical systems. It plays a vital role in their operations. Red team. Got my red teamers in the room. You guys are not very nice people. You're here to cause disruption, espionage, maybe gain financial incentive along the way. You're funded to cause reputational damage. They're always out there to make a statement and a name for themselves, Flatline Syndicate. I know. Ominous. Right? We need music. Blue Team, Code Blue Command, world class incident response team in SOC hired by hospitals, health care systems, and medical device manufacturers to protect and respond to cyber threats. They're motivated to be the very best. They're a well paid group. Code Blue Command has strong relationships with federal agencies and health care ISX as well. They do also a lot of well funded research. So this is a very high capacity, high caliber SOC operation, blue team. So today, bom bom bom. It's the ribbon cutting ribbon cutting ceremony for Blue Harbor's Regional Medical Center. They have new partners, North Star Children's Hospital, the Regional Trauma Network, and Vitals Medical Logistics, all designed to expand patient capacity, strengthen emergency and specialty care, and accelerate regional health care access. It also marks the launch of their newly integrated clinical technology and innovation center. Lots of technology dependencies here. Where the EHR, medical imaging, scheduling, pharmacy, and connected medical devices have all been centralized. At the heart of the operation is Blue Harbor's new AI enhanced command center, widely promoted as the most secure hospital environment in the world. Definitely something you wanna share on the news. Just as the event gets underway, the SOC receives an alert. Something's going on. The network supporting Blue Harbor's primary clinical environment is showing signs of degradation. Something's going on. So for our first step, again, once I say go, get into your groups and start working through this. There's no wrong answer. Red team. Begin your reconnaissance. Identify your targets. Start to profile the hospital. Are there doors? Are there weak links? What do you wanna know in order to be effective? Blue team, set up your defenses, tools, policy process, people. What do you need to build a strong security operations center? This is going to be your best defense. This is the perimeter you're going to build that red team has to try to infiltrate. Sound good? Does everyone understand the assignment? You have five minutes to get started. Go. Blue up here. Thanks, MC. Come on, blue team leaders. Alright. Our blue team leaders are Marty Momjin and Tim Beasley from Semperis, and our red team leaders, Sean Dubey and Dan Olemeyer from Semperis on the red team leading up. Alright, guys. I did start the clock. Just like a real incident, the clock started. Did you wanna join the team? You sure? Okay. Alright. Alright. Please hop in. I was not told where to go. You can go anywhere you want. You wanna be on the boat too? Set up your best defense. You have to talk really loud, Marty. Talk louder. Can't hear you in the back. You're my phone. Make sure the red team can hear you guys. I can't. Oh, you're out of time. MZ has a timer on this. Oh, now you're really in trouble. Alright. Put your pens down. Dan, pen. I see your tablet moving. Stop. Stop. Stop. Stop. Stop. Alright. So we are going to share our plans. We will start with the red team planning their attack, and you have a minute to try to share your attack. Alright. So hey. What's going on? Don't listen to him. Alright. So and I'm actually not gonna use it. You guys hear me okay? No. Oh my goodness. Gosh. I hate that. Okay. So right now our goal is to try and gather a bunch of information and we're gonna use the Internet for a lot of that because your employees love to brag about what they do on the Internet. So we're gonna we're gonna look at targeting some of our partners, employees, getting on LinkedIn, doing domain scanning, seeing if we can find any vulnerabilities, you know, WiFi scanning, going to the hospital locations and stuff to collect that information, but we're gonna do as much OSINT gathering as we can. Some of the stuff that we're gonna do is, like, scrape LinkedIn and socials to identify and profile employees who's real chatty and real proud about their job and billing they just got, those types of targets. We're gonna look at oh, ten seconds. Excess creds, stage media to prep, gonna put a mole, rubber duckies in the parking lot, some QR codes on stuff. We're gonna have fake patients come in and get some information. So Is that good? Got rubber ducky from parking lot? I still got the mic. Offshore resource targeting, plug in, pineapples, sniffers. I'm the red team. I don't follow the rules. Mike. Alright. Alright. Alright. Alright. They're out of time. That was good. Alright. I'm not gonna give them the mic next time. You have one minute. And, no, you can't have the mic back. We have a lot of acronyms. So we have EDR, ITDR, Next Generation Firewall, AV, we have an operational SOC and SIM, of course, powered by AI, SOAR implemented, intrusion detection, an IR plan that we test daily, just so you know, every single day, fine integrity monitoring, immutable backups, all of it, on-site, off-site. Right? DNS security, we train all of our employees not to click on ****, Dan, just so you know. AD backups, PAM, PIM MFA, we're five zero two enabled with passkey. We do phishing tests, we have DLP, micro segmentation, social engineering training, and identity proofing. We have a crisis management system, MDM, PKI, CCTV, really tall fences, by the way, with sharp spikes at the top, as well as help desk training, and we do employee ID proofing. I'm actually impressed you got that done in a minute. Alright. So they have an unlimited budget. Yeah. Blue team. Alright. So they set up quite a defense with that unlimited budget. Red team, it sounds like you got your work cut out for you. You're going to look to gain initial access and recon the network. Conduct defensive evasion and persistence. Can you find any high value targets? Blue team, it's one heck of a perimeter you've set up. Initiate your incident response and crisis response. Remember, you started to see some activity in the network. Investigate those issues. You have five minutes. Good luck. Alright. We're out of time. Red team, I'm taking your pen away. I'm just kidding. Do you wanna write one more thing? I'll be nice. Okay. Alright. You can okay. Red Team, access, recon, collection. Alright. So we're gaining access to your environment. We're doing some recon. One of the things we're gonna do, we're still trying to gain and expand access. So we're gonna trick doctors with MFA resets, call them up saying, oh, hey, we gotta work on you on a password reset. I don't even know what I wrote right there. Oh, we had good success with our rubber duckies in your environment because people are like, oh, hey, I'm plugging those suckers in. We're gonna clone some of your key websites to try and continue to glean more access. Since you are so well healed, we need to throw some chaos into your response. So bomb threats, we're gonna have some fake disease locally being spread in the news. The goal is to get everyone all worked up and and and stressing out. We might even try and crash your WiFi because, you know, if we can DDOS stuff and take it down, that's gonna cause you guys problems. Our mole is still undetected and they have really good access. They might be able to put malware inside of your immutable backups And we're gonna go to your med device suppliers and target those soft targets to get some service accounts and stuff like that. And I'm gonna do this because you can't do Alright. You and your bomb threats and your fake diseases. Okay. Red or blue team, you know something's going on, you're trying to figure out what it is, what is your plan? One minute. Taller fences. Dan. I mean, we're doing forensics. Right? There's something happening on network. Check the firewall logs, do forensics, behavioral analytics. Incident responses, of course, stood up and running because we test that every day. We're gonna disable backup expiration just in case by protocol, dig into what we have for micro segmentation rules, check any identities that could be involved, look at the network logs, network services, IDS logs, look at anything third party related if there's any information out there, and DNS logs, all the basics, forensics and incident response stuff. We're gonna check for any recent changes in our network and for change management, we're gonna halt all changes on the network just in case. We're also gonna halt all PR and social media communications and external communications with vendors unless authorized. We're gonna do public monitoring to make sure we check for those websites that you stood up and threat intelligence. Right, and extra scrutiny on critical systems and you suck, Dan. Give me the mic. Okay. Alright. So the blue team has put up a pretty good defense. They're starting to track your behavior. Sorry about that. So red team, start to conduct privilege escalation. Can you exfiltrate any information or data? Maybe stage a pay a ransomware payload. Blue team, conduct counter exfiltration. So you're starting to see things happen, things move. Can you contain and isolate the threat? Alright. Now we're getting very excited up. Okay. Five minutes. Go. Oh, it's done. Oh, ready on time. Alright. Red team's ready. You guys ready? Alright. You can be trained. Alright. Here we go, red team. We've got lateral movement, exfiltration, payload deployment? Maybe payload deployment. So so sorry. I gotta talk quieter. So we're gonna go ahead, we're gonna identify data to extract since one of our goals is just mayhem and reputational harm. We're probably gonna go after patient data because nobody wants to see that out there. We still have our mole, so we're gonna leverage that person to make sure we have some access. And keep in mind, we do also still have some fake patients that went through that environment. Maybe one of them is lounging around waiting to unplug stuff. We're gonna go ahead and we're gonna run Bloodhound or something to identify some of the tier zero accounts. We're gonna leverage ADCS for privilege escalation, forge Microsoft cert in your environment. A lot of what we're gonna do is focus on making you distrust the environment that you trust. Some of the other things is the DHCP and NTP. We're gonna compromise that trust component there so that you guys are sitting there, seeing systems come offline and receiving information that then it turns out not to be true. We're gonna exploit the AI in the environment and then it poison it and deploy ransomware. Did you what's this one? Fake invoices. Fake invoices. Tamper with what? Alright. So I think the bonus for you guys is the red team can't read their plan. So or maybe that's your encryption methods. I'm not sure. Alright. So their plan's encrypted. I can't read it. But here we go. Conduct counter exfiltration, contain, and isolate the threat. I think I found the mole. Found the mole? Yeah. Look at me. No. It's not you. Where were we? We confirm the threat, of course. We are PASCII enabled on all privileged accounts, so good luck with the privilege escalation. We have rollback capabilities with DSP. We're running DLP across the board for data exfiltration. So we might get some data. We're probably gonna stop it in flight. Get your external IP addresses. We're gonna isolate anything we that is touched on the network including identities. Now we are gonna send out a notification for downtime prep, initiate third party incident response, legal and third party insurance, try to share threat intel with the FBI. We are gonna lock down the EMR, so no external IP access including patient portals and care everywhere and all that stuff. We are gonna notify Erin for the fake websites that you created and we're gonna share thread intel. Our SOC is doing their thing, and we have a rubber duck policy now to not allow any rubber ducks within the environment and disable USBs. You suck, Dan. Okay. Okay. Okay. So now that you have your rubber ducky policy in place, red team, look to deploy malware and or detonate ransomware so you know you've got a couple of ways in. Blue team, do you have, like, an 80 person sock? Yes. You're doing a lot of stuff. Are you guys tired yet? Has anyone slept? Counter and eradicate threat actors on the network. K? Go. Red team looks like they're ready. Blue team, are you guys ready? Yeah? Alright. Thumbs up. Okay. So red team, detonate, encrypt, destroy. What's your plan? So we got a couple things. We do have ransomware, so via privileged file share, we're gonna try and get that distributed through the environment. And we're gonna do some interesting things. Maybe we don't necessarily wanna hijack your data but all the people because you put a big fence around that hospital. We contacted the or we got in touch with the supplier, compromised their systems, and we just shut the gates to that thing. So no one's getting in or out of your hospital. And we compromised EMS and are diverting EMS dispatch and diverting all hospital traffic, all ambulance traffic to your hospital. We made a deep fake that Marty is the mole, So we got a video of him that was, like, caught like a webcam style thing where he's talking to his dear diary. And we're releasing that on the Internet and internally at the hospital, so they don't trust Marty anymore. They don't wanna listen to him. The our mole's been recruiting disgruntled employees. So, you know, we do have some other people who wouldn't let the patient mole, remember we locked the hospital down, but we still had patients in there. Patients. Right? They're literally starting fires, setting off sprinkler systems and stuff. Okay. This is better. Better. I like this. I needed it to be more evil. Perfect. Alright. So the hospital's on fire. You can't get in or out, and Marty's the mole. Here we go, blue team. Do you have any kind of eradication plan or maybe just a fire extinguisher? It's a suppression system. We have really good suppression systems. We contain the threat. Right? We're gonna scan the backups again. Malware's gonna be stopped by EDR because we have the signatures. Privilege account escalation, even if you attempt it, we can roll things back and we're PASCII enabled, physical PASCII. We know the mole's identity because of user behavior analytics and it's not me, just so you know. We're gonna send out a preemptive public notice that there is an incident happening and we're gonna consult legal to do that because, you know, we should always do that first before your boss gets mad at you, Charlie. Figured that out. We're gonna rotate our Incident Response team to make sure they are fresh. We're gonna get some stress relieving puppies for the IR team and they're very cute puppies. Crisis communications, there's We tunnels. Crisis communications are up also, nothing is down yet. The most important part is we're gonna go on the offensive because Dan sucks and then we're gonna ensue physical violence against the mole. Alright. Alright. Alright. Alright. Alright. I'm not the mole have gotta be the famous last words. Alright. Red team, demand ransom. You locked them in. You locked them in, and you set the hospital on fire. Alright. If that's not enough, you got the puppies, though, you guys. You got the puppies. Negotiate, restore, recover, pay, don't pay. Play with the puppies. I don't know. You got five minutes. Figure it out. Three, two, one. You're out of time. Alright, red team. So what we're gonna do is we're gonna show the world just how cheap and calloused and greedy you guys are for the measly sum of $1,000,000. We'll open the gates up, everyone's free. But no, you guys wouldn't pay because you're greedy. So we will let them know that for every hour you don't pay, a puppy dies. We're gonna report that to the media. We got a AI deep fake of Marty herding puppies. Also gonna continue to flood the market with video of Marty being this whiz bang super villain and we're gonna have his dear journal diaries where he's all like, oh, I compromised this hospital blah blah blah blah. What else did I put on here? Just general media mayhem. We're going to beat you guys to the punch. We're gonna release information saying we stole stuff. We're gonna talk about how we did all these things, and you wouldn't agree. You're out. You're out. You're out. I don't want to put my hand right up to your mouth. Alright. So you didn't you demanded the ransom, and they already said no. And so now you're killing puppies. Okay. Interesting. Well, I don't know whether or not you guys were going to pay the ransom or not, but No. So one, we have a very tall ladder to get out of the fence. We thought about that. Hospital fires are put out. By the way, if you start a fire at a hospital, that's an act of war. Just throwing that out there. We're gonna contact our insurance provider for fire insurance unless you're in the state of California. You don't get that. We're gonna contact third party firms for negotiation. We want proof. If you wanna negotiate anything, need data proof. We're gonna release Seal Team six. We're gonna go back to a backup hospital because we have that much money. A reminder that Dan sucks. This was not written by me. And we're gonna tackle the reputational damage because that's what matters because we care about patients, not our reputation, Dan. Thank you. Thank you. You're out of time, blue team. Alright. So I don't hear anyone saying they're gonna pay or not to pay or that you made any kind of decision on that. So red team, triple extortion? You said no. That was a no. Okay. So that that the tall ladder was a no. Okay. Blue team said no. Surprise triple extortion. Do you have any levers to pull? What are they? Blue team, You've moved on. You said no. After action report, we're moving on with life. Puppies are fine. Puppies weren't real. Right? Alright. What is your final comment to the other team? You have thirty second or no. Michelle gave you two minutes. Yeah. You have thirty seconds. Make it quick. Then I should write What is your final plan? What is our final plan? Well, one, we're gonna get the State Department to say it is not an act of war if we set your hospital on fire because the State Department's gonna do the calculus and realize they don't wanna actually go to war with another nation. So maybe, maybe not. I mean, officially, unofficially, who knows? We are gonna build a dirty bomb with some of the stuff from your nuke med office and have that hanging around. It doesn't need to be super powerful. It just needs to be radioactive and the theater will take care of everything else. And we're gonna say give us the money, please. Okay. Please. Please. But they ask so nicely. A dirty bomb. Alright. Blue team, do you have a plan? Anything? You do? Okay. Share it. Very quick. Instead of paying you, we're gonna give all of our employees raises because we are a good health care system. Also, in very big letters, Dan, say it with me, sucks. And then we're gonna do our after action report, all of our lessons learned, share all the details, and have a lot of fun.