All tabletop exercises
Ransomware·Intermediate·Mixed audience
Ransomware, DDoS and extortion in the same week
The prompt — read this to the room
Monday: ransomware encrypts file servers at your online travel agency, but customer bookings still work. Wednesday: after you decline to engage, a DDoS takes the booking site down at peak hour. Thursday: the attacker emails journalists a sample of passport scans and threatens to call your largest corporate customers. Each pressure point lands on a different team that is already exhausted. The attacker's latest message sets a 24-hour deadline and promises the DDoS will stop the moment you pay.
Total duration
2 h
People to involve
8
Best fit
Retail
Who to involve
Most important first.
- CISO / Head of security
- Incident response lead
- IT operations
- Communications / PR
- CEO / Managing director
- Legal counsel
- Privacy officer / DPO
- CFO / Finance
What it tests
- Run three workstreams (recovery, availability, extortion) under one command without losing any
- Activate DDoS mitigation and provider escalation quickly enough to matter
- Hold the organisation's position on payment under escalating pressure, or change it deliberately
- Manage staff fatigue so the response is still functioning on day five
Outline of activities
- 1Monday recap: where the ransomware recovery stands
- 2Wednesday: the DDoS and the provider escalation
- 3Thursday: passport scans, journalists and corporate customers
- 4The 24-hour deadline and the payment question again
- 5Running the team: shifts, fatigue and handovers
- 6Debrief: triple extortion as one playbook
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…