A Ransomware Incident Response Plan Your Team Can Actually Follow

Most ransomware plans fail on decisions, not technology. Here is a short checklist for the first hour and beyond. First hour Confirm the incident and rate its severity. Isolate affected systems from the network, and do not power them off until evidence is captured. Name an incident lead, a technical lead and a communications lead, each with a backup. Preserve logs, ransom notes and disk images…