Operation: Defend The North 2025 (Vancouver)

Join us for breakfast and start your day off right!

Kick off "Defend the North" with an exciting overview of our mission and prepare for a dynamic cyber defence simulation.

The sun rises over Canada’s east coast—and as ODTN Mart, a national grocer and pharmacy chain, prepares to unlock its doors to early morning customers, something is off. Point-of-sale systems won’t boot. Pharmacy terminals freeze. Across the Maritimes, store managers frantically reboot systems, only to hit the same dead ends. Calls to the outsourced IT help desk flood in. The queue fills with Priority 1 tickets, but support agents are stuck. The systems look online—but nothing works. Their playbooks don’t cover this. And worse? The POS systems are managed by yet another third party—one no one seems to know how to reach. Escalations to ODTN Mart’s headquarters in Vancouver go unanswered. It’s still 5 a.m. on the West Coast and store managers are forced to keep the doors locked. The initial hours are a flurry of frantic reports and rudimentary checks. The challenge now is to move beyond simple detection of the widespread failure and begin the critical analysis: What is the root cause? Is this a technical malfunction, a systemic error, or the tell-tale signs of a malicious intrusion?

Recharge with a tasty snack break!

As the scope of the disruption becomes apparent, the initial focus shifts to containment. The priority is to prevent further spread and isolate affected systems to limit the damage. Network segments in the Maritime region may be temporarily isolated, and remote access points are scrutinized. Simultaneously, the discovery phase intensifies. Technical teams in Vancouver begin a deeper dive into system logs, network traffic, and any available diagnostic data. They are searching for anomalies, patterns, or indicators of compromise that might explain the widespread outages. The lack of direct access to the third-party POS infrastructure presents a significant obstacle to thorough discovery. Investigators must rely on indirect evidence and the limited information trickling in from the affected stores and the overwhelmed support channels. Understanding the adversary's methods and objectives, if this is indeed an attack, is paramount.

Refuel and re-energize with a warm lunch!

Once the root cause is identified and the extent of the compromise (if any) is understood, the eradication phase begins. This involves removing the threat actors, malicious software, or underlying issues from the affected systems and the wider network. Depending on the nature of the incident, this could involve patching vulnerabilities, removing malware, resetting compromised accounts, or reconfiguring systems. The challenge is amplified by the reliance on a third-party for the critical POS systems. Eradication efforts may require close coordination and cooperation with this external vendor, assuming contact can be established. Ensuring the threat is completely eliminated and that no backdoors or persistent access remains is crucial before full recovery can commence.

Recharge with a tasty snack break!

With containment and eradication underway, the response efforts broaden. Communication becomes critical – keeping stakeholders informed, managing public perception, and coordinating with any external agencies, such as law enforcement or cybersecurity firms. Recovery plans are activated, focusing on restoring critical services and bringing systems back online in a controlled and prioritized manner. Post-incident activity begins even as recovery is ongoing. This involves documenting the incident in detail, preserving evidence for potential legal or investigative purposes, and starting to formulate lessons learned. Initial assessments of the incident response process itself are conducted to identify areas for improvement.

Take a moment to stretch and breathe deep!

As systems are restored and the immediate crisis subsides, the final phase involves closing remarks and a comprehensive hotwash. Leadership provides an overview of the incident, the response efforts, and the initial impact. The hotwash is a critical debriefing session involving all key stakeholders who participated in the response. The goal is to openly and honestly discuss what went well, what could have been done better, and to identify concrete action items for improving future preparedness and response capabilities. This session ensures that the lessons learned are captured, documented, and translated into tangible improvements in ODTN Mart's security posture, incident response plans, and third-party risk management strategies.