Exercise in a Box (Cyber Threat Response)

This free online tool is available to help organisations find out how resilient they are to cyber attacks and practise their response in a safe environment.

Exercise in a Box is an online tool from the NCSC which helps organisations test and practise their response to a cyber attack. It is completely free and you don’t have to be an expert to use it.

The service provides exercises, based around the main cyber threats, which your organisation can do in your own time, in a safe environment, as many times as you want. It includes everything you need for setting up, planning, delivery, and post-exercise activity, all in one place.

Exercise in a Box has been piloted with small and medium sized enterprises, local government and the emergency services, but the NCSC is seeing other private and public sector communities benefiting from using it, depending on their needs.

To use Exercise in a Box you need to register for an account. This enables NCSC to provide you with a tailored report, helping you identify your next steps and pointing you towards the guidance which is most relevant for your organisation.

Once you have registered, you set your profile, pick your exercise(s), and download the materials.

There are a number of exercises to choose from that include:

• A ransomware attack delivered by phishing email
• Mobile phone theft and response
• Being attacked from an unknown Wi-Fi network
• Insider threat leading to a data breach
• Third party software compromise
• BYOD
• Threatened leak of sensitive data
• Supply chain risks
• Home & remote working
• Managing a vulnerability disclosure
• Supply chain software
• Supply chain ransomware attack
• Technical scenario
• Micro-exercises;

- Responding to ransomware attacks
- Identifying and reporting a suspected phishing email
- Using passwords
- Connecting securely
- Securing cloud productivity suites
- Securing video conferencing services

Exercise in a Box is a live tool which will keep evolving, based on user feedback, to ensure it stays current, relevant, and engaging.