Situation for tactical and executive report

[rilutham]

When is the right situation to create a tactical and executive report in the crisis? And who are the right people that should receive it?

[kevgliss]

Generally speaking, we think about the two reports mostly around the level of detail provided.

For instance, tactical reports are generally for folks that are direct participants (e.g. people that are working the incident and are in the slack channel). These messages are direct status updates of the current incident itself, helping ensure that the people in the incident are aligned and moving toward a common goal.

Executive reports on the other hand are higher level and are more narrative focused. These are also status reports but are for individuals that are not directly involved in resolving the incident/crisis. These reports leave out technical details and focus on the overall impact of the incident.

A security-based example:

Tactical Report Example

Conditions
MS released announced some CVEs affecting the TCP/IP stack in windows (see https://msrc-blog.microsoft.com/2021/02/09/multiple-security-updates-affecting-tcp-ip/ ) that could result in a wormable RCE affecting all unpatched windows installations. There are deployable workarounds and patches available to mitigate the problem. Industry analysis suggests that these RCE vulnerabilities are likely to be developed into a wormable public exploit within a week. We need to make sure our environment is fully patched or mitigated.

Actions
- Application security is working with TechOps to implement a GPO that will mitigate the attack.
- Application security is working to identify any additional affected systems

Needs
- Any other services that could be impacted by the CVE

Executive Report Example

Current Status
Security has been notified of a potential windows based vulnerability, we are currently investigating possible risk and the scope of the issue.

Overview
A networking vulnerability in Windows could result in an intrusion if left unpatched. 

Next Steps
Security is working to identify all impacted assets and to patch them accordingly.

Hope this helps.