Day five of ransomware recovery: everyone wants to be first
The prompt — read this to the room
It is day five after ransomware hit a 1,400-person insurance broker. Identity has been rebuilt and the attacker appears to be out. The infrastructure team can restore about twelve systems a day. Twenty-three business owners have each told the CEO their system is the most critical: claims, policy administration, finance, the broker portal, email archives. Two large clients threaten to move their accounts if the portal is not back by Monday. Yesterday a restored file server was found to contain the attacker's remote access tool and had to be taken down again. Who decides what comes back next, and on what basis?
Who to involve
Most important first.
- CEO / Managing director
- CIO / CTO
- CISO / Head of security
- Incident response lead
- IT operations
- CFO / Finance
- Communications / PR
- Legal counsel
What it tests
- Agree one recovery priority order based on business impact, dependencies and regulatory obligations, with a single named owner.
- Set a clean-restore standard that every system must pass before reconnection, and hold to it under pressure.
- Set client, regulator and staff expectations for a recovery that will take weeks, not days.
- Manage the risk of reinfection without stalling recovery.
Outline of activities
- 1Day five: where recovery stands
- 2The reinfected file server and the clean-restore standard
- 3Building one priority order
- 4Clients, regulators and the Monday deadline
- 5Running the business on partial systems
- 6Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…