All tabletop exercises
Ransomware·Advanced·Executive audience
Pay or not: the ransom decision with backups in doubt
The prompt — read this to the room
Day two of a ransomware outage at a 2,000-person logistics company. Dispatch, billing and the warehouse system are encrypted. The attacker wants 4.2 million dollars in cryptocurrency, offers a 20% discount if you pay within 48 hours, and has published a sample of stolen payroll files. IT says restoring from backup will take nine to fourteen days, and two of the backup sets have not been verified clean. The insurer's panel negotiator is on the line. The CEO turns to the room and asks for a recommendation by 17:00.
Total duration
2 h 30 min
People to involve
7
Best fit
Manufacturing, Retail
Who to involve
Most important first.
- CEO / Managing director
- CFO / Finance
- Legal counsel
- CISO / Head of security
- Board member
- CIO / CTO
- Communications / PR
What it tests
- Weigh restore time, business loss, data-leak exposure and legal risk in one documented decision
- Identify the sanctions, law-enforcement and regulator checks that must happen before any payment
- Agree who has authority to approve or refuse payment and how dissent is recorded
- Plan communications that hold whichever way the decision goes
Outline of activities
- 1The state of play: what is down, what it costs per day, what the backups really look like
- 2The demand and the negotiator: what paying would and would not buy
- 3Legal gates: sanctions screening, law enforcement, regulator and insurer positions
- 4The decision meeting and how it is recorded
- 5A late twist that tests the decision
- 6Debrief: the payment policy you wish you had written in advance
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…