Datadog Shares New Backdoors & Breaches Scenarios for Security Tabletop Exercises
Summary
Datadog introduces four Backdoors & Breaches starter scenarios based on current threat trends and shares game adaptations for security tabletop exercises, including open-face play and using real logs.
Key points
- The four scenarios cover a backdoored software supply chain, exposed cloud credentials in a vibe-coded app, prompt injection in a Kubernetes-hosted AI app, and a compromised GitHub Action.
- Scenario attack paths include credential theft and persistence, cloud IAM abuse, Kubernetes privilege escalation, SaaS tunneling, and data exfiltration.
- Datadog suggests an open-face format: reveal attack cards and discuss why a detection might work and whether a tool could help resolve the issue.
- Players can use screenshots of detection tools or search existing logs for evidence matching a scenario.
- The scenarios can be used as written, adapted, or used as starting points for custom exercises.
Article Details
- Topic
- Backdoors & Breaches incident-response card game adaptations and tabletop exercise scenarios