New Monthly CRA Brief – Mini Exercise Scenarios
February 20, 2024
Today, the California Resiliency Alliance launched a new monthly brief that provides several mini exercise scenarios and a few accompanying thought prompting / discussion prompting questions for each scenario. These can serve as either individual thought exercise, small group discussion scenarios, or as a basis for other exercises.
Each month the emailed brief will contain 4-5 mini scenarios covering themes such as natural hazards, physical security, cyber, reputation/information risks, personal preparedness, cross-sector collaboration, and strategic foresight.
Since the CRA uses a dynamic distribution list the mini scenario brief will be shared with all CRA members interested in exercises and those interested in any of the topics related to that month’s scenarios. Visit the Dynamic Distribution List Overview page to learn more about how the CRA’s distribution list is not an all or nothing model.
This first brief included scenarios on:
- Road Access Disruption due to a Sink Hole
- Unknown Substance in the Mail
- Unintended Proprietary / Confidential information Leak via Social Media
- Neighborhood Gas Leak
- Personal Preparedness: Flat Tire in an Area Without Cell Coverage
Here is a sampling of two of the mini scenarios included:
Unintended Proprietary / Confidential information Leak via Social Media
The teenager of an employee who often works from home took some selfies in the home office and posted them on a personal, but publicly accessible, social media account. Visible (readable) in the background of the pictures is information that is confidential and/or proprietary to the organization. While this posting was posted without any intent to purposefully disclose such information, there are entities that use AI to scrape and search social media postings for espionage, social engineering, and other data exploitation purposes.
Some Questions to Consider
How might your organization find out about such an information leak?
Once known, what steps can be taken to minimize the current and future damage of the information leak? The scenario does not specify exactly what the information was, so consider various types of information that are relevant for your organization.
What reporting requirements might the incident trigger?
Unknown Substance in the Mail
While passing by other employees you overhear one share a story about an employee who complained about having to clean up powder that had been folded into some random mail. You have seen in the news lately stories about various incidents of suspicious white powers being sent to individuals via the mail, some of which have turned out to be substances such as fentanyl. The employee sharing the story can’t tell you more details, but is able to tell you the name of whom they heard it from. Tracing it back you are able to identify the employee who cleaned up the powered and confirm that the incident did actually occur, but three days ago. The employee, while frustrated with having to clean up the mess, did not think anything of the incident and tossed the letter along with the paper towels used to clean the desk into the trash. When asked about what the letter was about, the employee could remember it was typed, but could not remember any specifics as to what it said. To date, the employee has had no adverse effects.
Some Questions to Consider
What are your / your organization’s next steps?
What are areas of concern regarding the lack of information about the contents of the letter (what it said and the unknown substance)?
Does your company have a policy/procedure for handling suspicious mail? If yes, how well do employees actual know it? What if the mail is delivered to an employee’s home address?
Interested in connecting into the California Resiliency Alliance? You can learn more about how to get connected into the California Resiliency Alliance on our Join page.