Ransomware stops a logistics company's warehouses and trucks
The prompt — read this to the room
At 05:00 on a Wednesday, your logistics company's warehouse management and transport management systems go dark across six distribution centres. Ransom notes are on the servers. Forty trucks are queued at the gates, the handheld scanners cannot print labels, and a pharmaceutical customer has temperature-controlled stock that must ship by 14:00. Customs declarations for two ports are filed from the same encrypted system. Your largest retail customer's contract has a penalty clause for missed delivery windows. The operations director wants to restart on paper. Can you, and what has to be true first?
Who to involve
Most important first.
- CEO / Managing director
- CIO / CTO
- Incident response lead
- IT operations
- CFO / Finance
- Vendor / procurement manager
- Communications / PR
What it tests
- Prioritise shipments by contractual, safety and regulatory consequence
- Decide whether and how to run manual operations without re-infection or loss of traceability
- Contain and restore in an order set by business priority, with clean-build verification
- Manage customer, carrier and customs communications and contractual notices
Outline of activities
- 105:00: systems down, trucks at the gate
- 2Business triage of shipments
- 3Paper operations and safe-restart conditions
- 4Containment, restore order and the ransom question
- 5Customers, carriers, customs and contract notices
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…