Building a Ransomware Incident Response Plan

The talk opens with the growing scale of ransomware and the point that many organizations feel prepared until an attack hits. It then breaks a typical intrusion into stages: initial access through purchased footholds, credential reuse, third-party compromise or exploited flaws, followed by lateral movement, data theft and encryption. A standard incident response plan usually assumes a few machines fail, so ransomware needs its own supplement covering whole-network outages.

The core of the talk covers preparation and early response. Preparation means choosing which logs to keep, such as PowerShell, endpoint and DNS data, deciding who beyond the security team must be involved, including legal, insurance, communications and HR, and setting up an out-of-band channel before an incident. During response, the speaker recommends confirming the actor, containing spread by segmenting or cutting network access, protecting backups and servers first, and finding the entry point so it cannot be reused. Recovery means hunting for persistence and rebuilding segments in isolation before reconnecting them.

The talk closes with lessons learned: reviewing how the attacker got in, tuning alerting and configuration before buying new tools, keeping the plan written and current, and testing it through tabletop exercises. Staff wellbeing during long hours and consistent messaging to vendors and customers also get attention.