Arctic Wolf Video Urges Organizations to Plan Ransomware Decisions in Advance
Summary
Arctic Wolf’s Kerri Shafer-Page outlines decisions to prepare for ransomware incidents, including containment, negotiation authority and limits, payment tradeoffs, law-enforcement involvement, legal advice, and communications.
Key points
- Assess in advance how taking systems offline could affect client data and business operations.
- Decide who may negotiate with attackers and establish spending limits.
- Evaluate ransom payment as a business decision, weighing the demand against insurance retention and potentially higher renewal rates.
- Include law enforcement in the response plan; Shafer-Page says agencies may know the threat actor and help address sanctions concerns.
- Plan for legal advice on disclosure deadlines, a spokesperson, and help-desk communications.
Article Details
- Defense Focus
- Prepare organizational decisions and coordination for ransomware incidents before a demand occurs.
- Defensive Actions
- Map systems and assess the operational and data impact of isolating them.
- Predefine who is authorized to negotiate with attackers and establish spending limits.
- Evaluate ransom payment as a business decision, including insurance retention and renewal-cost tradeoffs.
- Include law enforcement, legal counsel, communications, a spokesperson, and help desk staff in the response plan.
- Resolve key incident-response decisions before a crisis.