Lesson 5.51: Ransomware: making the decision
At some point in a ransomware incident, leadership will ask: can we restore, how long will it take, and should we pay? The answer must come from facts: which systems have clean backups and how long restores take, what was stolen, what the law allows and what the board decided in advance. Paying doesn't guarantee working keys or deleted data, and paying a sanctioned group can itself be illegal, as the US Treasury's OFAC has warned. In the lab you build the decision for Northwind from its restore estimates, a sanctions screening, the police report and its board policy, and record it.
18 min
You will learn to
- Compare restore times with recovery objectives
- Identify systems that need rebuilding
- Explain sanctions risk in ransom payments
- Check law-enforcement and insurer contact
- Record a decision with owner and legal basis
Key terms
- Double extortion
- Encrypting data and also threatening to publish stolen copies.
- Clean backup
- A backup taken before the attacker's access and not modified by them.
- OFAC
- US Treasury's Office of Foreign Assets Control, which administers US sanctions.
- Sanctions screening
- Checking whether a payee (or wallet) is linked to a sanctioned person or entity.
- Decision log
- The incident record of decisions with time, owner, rationale and advice.
← Tabletop exercises · All lessons · Linux package management →