War gaming supply chain compromise

Overview

Supply-chain attacks abuse trust in software updates, RMM platforms, signed binaries, and third-party remote-access paths. War games build healthy skepticism and clear decision rights without paralyzing the business with fear.

Scenario ideas

• A compromised MSP tool pushes malicious code to a subset of managed tenants.
• A vendor code-signing certificate is stolen; malware bearing a valid signature enters the patch channel.
• A poisoned open-source dependency or typosquat package enters a CI pipeline.

Objectives

• Detect anomalous RMM mass actions or script tasks within minutes (tabletop clock).
• Decide when to isolate all agents versus a targeted tenant scope.
• Communicate in parallel with legal and affected clients without causing unnecessary public panic.

Participants

Include engineering, legal, procurement, and optionally a key vendor TAM as observer—coordination breaks in the exercise, not during a live event.

Outputs

Document a kill-switch authority matrix for RMM-wide actions: named primary, deputy, and when legal must pre-approve.

Controls to stress-test

Code-signing verification, SBOM depth, and realistic limits on vendor SOC attestations (“they are certified” is not a control).

Follow-up

Track gaps as POA&M or security-roadmap items with budget and owners.

Culture

Reward analysts who report suspicious binaries or update anomalies through a blameless intake process.

Recordings

Keep recordings internal; sanitize before any partner or marketing reuse.