EXERCISE PURPOSE
Test cyber incident reporting and public-private coordination during a major incident affecting a critical open-source project.
A critical open-source build-toolchain vulnerability exploited across downstream critical infrastructure
← Exercise library
Stock photography via UnsplashCISA.GOV CTEP · SOFTWARE & SUPPLY CHAIN
CISA Open-Source Software Compromise
A remote-code-execution flaw deep in an open-source toolchain enables repeated intrusions. Patch complexity, ransomware, public proof-of-concept code, account takeovers, and a DDoS attack challenge maintainers and downstream consumers.
3 HRSuggested duration10Participant roles11Scenario stages
DECISION PRESSURE
Questions the team must answer together
The facilitator releases facts in stages. Participants should identify the decision owner, the authority being used, the information still needed, the immediate action, and the next escalation point.
How is suspicious maintainer or contributor behavior escalated?
Can releases be reproduced and signatures, builders, and dependencies trusted?
Which products and customers contain the affected component?
Who coordinates disclosure across maintainers, repositories, vendors, and government?
How does the organization ship a corrective release without compounding harm?
INSIDE THE EXERCISE
A scenario that changes as the response develops
The template is already populated with public injects, facilitator-only context, discussion prompts, private role messages, and a final hotwash.
- Day 1Module 1
Persistent intrusion at critical infrastructure entity
A major critical-infrastructure entity reports intrusion and data exfiltration to CISA. The intruder repeatedly returns after the entity believes the issue is fixed.
- Day 10Module 1
Toolchain vulnerability discovered
Investigators identify a previously unknown remote-code-execution vulnerability deep in the community’s build toolchain. It affects a core language library used across the ecosystem. CISA notifies the project’s security point of contact.
- Day 11Module 1
CISA and FBI issue joint alert
CISA and the FBI release a joint threat alert about the compromise.
- Day 14 · MorningModule 1
Additional entities report anomalies
More critical-infrastructure organizations investigate and report anomalous activity to CISA.
- Day 14 · AfternoonModule 1
Global disruptions and patch mobilization
Minor critical-infrastructure disruptions are reported globally, though the cause is not public. Public- and private-sector organizations begin helping open-source developers prioritize a patch.
- Day 17Module 2
Fix requires ecosystem rebuild
Developers determine that developing, testing, and deploying the fix will take about a month because downstream dependencies must be rebuilt and repackaged.
- Day 18 · MorningModule 2
Ransomware activated
A threat group claims responsibility, encrypts several critical-infrastructure entities, and demands payment to stop disruption and prevent release of stolen data.
PARTICIPANTS
Bring the decision-makers who would own the real event
Assign people to functions, not titles alone. If one person owns several functions, keep the roles distinct during discussion so conflicts and handoffs remain visible.
Open-Source Security Point of ContactProject MaintainerBuild and Release LeadPackage Repository OperatorCritical Infrastructure ConsumerIncident CommanderGovernment Coordination LiaisonGeneral CounselCommunications LeadHosting Provider Liaison
REAL-WORLD INCIDENTS
Ground the exercise in events teams can recognize
Use these cases during planning or the prebrief. They are factual anchors, not scripts. Adapt the scenario to the organization’s technology, industry, geography, contracts, regulators, and risk profile.
XZ Utils backdoor↗
A sophisticated actor spent years building maintainer trust before inserting a backdoor into widely distributed compression-library releases.
Log4Shell↗A critical vulnerability in the widely embedded Log4j library forced organizations to discover hidden dependencies, patch quickly, and monitor ongoing exploitation.
LEGAL, REGULATORY & STANDARDS LENS
Authorities worth testing against the scenario
Applicability depends on the organization and facts. Use counsel and subject-matter owners to tailor deadlines, thresholds, privileges, preservation, reporting, and communications.
CISA Cybersecurity Scenarios↗
The source collection for CISA Tabletop Exercise Packages covering ransomware, insider threats, phishing, supply-chain compromise, and sector incidents.
CISA Secure by Design↗Use the principles to test product accountability, secure defaults, evidence, and customer communications.
NIST Secure Software Development Framework↗A reference for testing release, provenance, vulnerability, and supplier practices.
PRACTITIONER PERSPECTIVES
Law-firm and security-professional guidance
External perspectives help the design team challenge internal assumptions. They do not replace organization-specific legal or technical advice.
EXPECTED OUTPUT
Finish with an improvement plan, not a score.
- Defined open-source security ownership
- Faster component and customer impact analysis
- Release and repository response playbooks
- Coordinated vulnerability disclosure decisions
- Sustainable maintainer and dependency controls