Ransomware is an attack in which hackers encrypt data and demand payment. Attackers may also threaten to release compromised data on the dark web if the ransom is not paid. That combination puts data protection and recovery decisions under pressure. section 1.4
A ransomware response must address more than the encrypted files. Teams need to decide how to confirm and contain the breach, handle a ransom demand, communicate with stakeholders, and recover data. A tabletop exercise lets them test those decisions before an incident. section 9.3.1
A four-day response scenario
IT support detects unusual traffic from a critical server holding customer data. The next day, the incident response team finds that much of the data has been encrypted and the attacker is demanding payment for a decryption key. The team must apply its policy on ransom demands, plan containment, and communicate the escalation. When a journalist asks about the breach, the response expands to public statements, customer concerns, and legal implications. Finally, the team restores the data from backups, secures the network, documents its response, and reviews what to improve. section 9.3.1
The practical test is whether the organization can make and communicate these decisions while restoring access to its data. Use the exercise’s recovery and lessons-learned phase to identify improvements to security measures, data protection, and recovery plans. section 1.4 section 9.3.1
