Building a ransomware decision tree before the call comes in
Arctic Wolf's IR VP urges pre-deciding ransomware response choices on containment, negotiation authority, law enforcement engagement, and crisis communications.
A Help Net Security video features Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walking through a ransomware decision tree. She recommends settling four decision areas in advance: containment, extortion negotiation limits, law enforcement involvement, and communications. She frames paying as a business decision that can cost less than insurance retention and renewal hikes, and notes agencies may know the threat actor and help avoid sanctions issues.
- Pre-decide containment so staff know the impact of taking systems offline
- Treat ransom payment as a business decision with an authorized negotiator and ceiling
- Include law enforcement in the playbook to avoid sanctions complications
- Prepare communications: legal counsel, spokesperson, and help desk in advance
- Vendors
- Arctic Wolf
- Organizations
- Arctic WaveHelp Net Security
From the original article
1 min read at helpnetsecurity.com
In this Help Net Security video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walks through the ransomware decision tree in this video. She covers four areas where decisions need settling in advance, starting with containment. Someone has to know the network well enough to judge what pulling a system offline does to client data, a manufacturing line, or a website.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.