SUMMING IT UP CHAPTER 8 SUMMING IT UP Well-crafted and well-executed exercises are proven to be valuable and effective tools for raising cyber security awareness among senior leaderships, managers, and IT professionals. Exercises with integrated operational and decision-making components can serve to test real-world procedures, communication flows and improve decision-making at strategic levels, as well as to enhance the technical skills of cyber security operators. Exercises are perfectly targeted at the human element which poses the weakest link in the security chain. However, the aim of exercises is not to expose individuals to stressful situations and to punish them if they fail. Nor is the aim to publicly expose institutional gaps and jeopardize institutional reputations. On the contrary, the benefit of exercises lies in the opportunity to educate personnel and improve the functioning of institutions in an exciting way. Additionally, an exercise fiasco does not necessarily mean a disaster. It can identify an issue to be addressed before an actual emergency occurs. Hence, from this perspective, sometimes failure might be better than success. Demonstrative and engaging exercises enable participants to take away more knowledge and experience than from the most dense and comprehensive lecture. It is the intent of this handbook to provide useful guidance and practical advice for designing and carrying out such cyber table-top exercises. 28/29