All tabletop exercises
Ransomware·Advanced·Technical audience
Ransomware reaches the backups
The prompt — read this to the room
It is 05:40 on a Tuesday. Hundreds of servers are rebooting into a ransom note. The infrastructure team goes to restore and finds the backup console showing the same note: the backup server was joined to the domain, and the attacker deleted the restore catalogue and encrypted the on-site repository. An offsite copy exists in cloud object storage, but nobody has restored from it in fourteen months and nobody is sure whether its retention lock can be overridden. The business wants a restore time by 09:00. What do you tell them, and what do you touch first?
Total duration
2 h 30 min
People to involve
6
Best fit
Any sector
Who to involve
Most important first.
- Incident response lead
- IT operations
- Cloud engineer
- CISO / Head of security
- SOC analyst
- CIO / CTO
What it tests
- Establish whether any backup copy survived that the attacker could not delete, and prove it is clean before restoring from it.
- Produce a dependency-ordered recovery sequence (identity, network, core data, applications) with times based on measured throughput.
- Decide how to preserve evidence on encrypted systems without stalling recovery.
- Give leadership a restore estimate with a stated confidence level and the assumptions behind it.
Outline of activities
- 1Discovery: encryption confirmed and the backup server compromised
- 2What survived: the offsite copy, its retention lock and who can delete it
- 3Containment before recovery: cutting the attacker out of identity and backups
- 4Recovery sequencing and the first clean restore
- 5The 09:00 estimate to the business
- 6Hot wash: backup architecture gaps and owners
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…