The crisis that tests every foundation at once. The winning moves are made before the incident: resilience funded, decisions pre-made, and the plan rehearsed.
Day 3RansomwareResilience
Notes: Frame it as a leadership-and-readiness topic, not a technical one. The decision to be made is made in advance.
Lesson 12 · Slide 2
A criminal economy, not a lone hacker
Ransomware-as-a-service — tooling rented out; a whole supply chain of crime
Initial-access brokers — specialists who sell the way in
Double extortion — encrypt and steal, then threaten to leak
Triple extortion — add pressure: harass customers, partners, the press
Why it matters
You're not facing one person. You're facing an industry that has professionalised every step.
Notes: Reveal each. The economy framing explains why volume and sophistication keep rising. Double/triple extortion means backups alone don't save you from the leak.
Lesson 12 · Slide 3
The kill-chain — and the cheap place to stop it
Encryption is the last step, not the first. Press →.
By the time you see encryption, they've been inside for days or weeks. The cheapest place to stop it is at the very first step (recall Lesson 01 and 04).
Notes: Reveal step by step. The hot node is what victims notice; everything before it was the opportunity to intervene. Ties directly to Lesson 01's kill-chain.
Lesson 12 · Slide 4
Destructive & wiper malware
Looks like ransomware, but there is no payment path
The goal is destruction and disruption, not money
Prominent in geopolitical conflict — relevant to high-sensitivity organisations
"Paying" is not even an option; only resilience saves you
The distinction
Ransomware wants your money. A wiper wants you gone. For high-sensitivity targets, assume the destructive variant is possible.
Notes: Important for this audience: state-aligned wipers masquerade as ransomware. Recovery, not negotiation, is the only lever.
Lesson 12 · Slide 5
Resilience is the real defence
Offline / immutable backups — the 3-2-1 rule; copies the attacker cannot reach or alter
Tested restoration — a backup you have never restored is a hope, not a plan
Segmentation — limit the blast radius so one foothold isn't everything
Incident-response readiness — roles, comms, and authority pre-arranged
Leadership move
These cost money and attention before any incident. Funding resilience is a decision only you can make — and only in advance.
Notes: Reveal each. The "tested restoration" point is the one leaders assume and rarely verify. Immutability defeats attackers who target backups first.
Lesson 12 · Slide 6
The decision to pay
Against paying
Funds and encourages the crime
May be sanctioned or unlawful
No guarantee of recovery
Does not un-leak stolen data
The reality
Sometimes framed as the only route to continuity
Legal, ethical, and safety dimensions collide
Must be a pre-decided policy, never a panic call
Notes: Present it honestly. The teaching point is not "never pay" but "decide the policy, legal position, and backup posture before the day, not during it."
Lesson 12 · Slide 7
Your systems are encrypted and data is stolen. The attackers demand payment. What most determines your response?
C. The ransom amount (A) and the attacker's promises (B) are the adversary's framing, and press exposure (D) is a consequence to manage, not the decision driver. What actually determines a sound response is what you decided in advance: your policy, whether you can restore from tested backups, and your legal and sanctions position. Deciding in the moment is the failure mode.
Notes: The distractors are all things attackers or events push at you. The answer is entirely about prior preparation. Deciding under duress favours the attacker.
Lesson 12 · Slide 8
The first hour
Contain — isolate affected systems; slow the spread
Preserve — don't destroy evidence you'll need later
Convene — the pre-named crisis team, with clear authority
Communicate — legal, regulators, and stakeholders per the plan, not by instinct
Tension
Contain vs preserve, speak vs stay silent — these conflicts are why you rehearse. Day 3's tabletop makes them real.
Notes: Reveal each. Note the built-in tensions; they set up Lesson 13 (decisions under uncertainty) and Lesson 15 (the tabletop).
Lesson 12 · Slide 9
Two-minute drill: your first-hour orders
Imagine you learn, right now, that your organisation is being encrypted. In two minutes, write the first three things you would order — not do yourself, but direct.
Notes: Start the timer. The exercise reveals whether the crisis team, authority, and comms plan exist. Gaps found here are the takeaway.
Lesson 12 · Slide 10
Recap & what's next
Ransomware is an industry; encryption is the last step of a long intrusion
Resilience — immutable, tested backups and segmentation — is the real defence
The pay/no-pay call is a pre-decided policy, not a panic decision
Next
Lesson 13 — Decision-Making Under Uncertainty: how leaders decide well when information is incomplete and the clock is running.
Notes: Bridge: this crisis forces hard calls on partial information — exactly the subject of the next lesson.