Course Outline

Understanding the Ransomware Ecosystem

  • Evolution and trends of ransomware
  • Common attack vectors and tactics, techniques, and procedures (TTPs)
  • Identifying ransomware groups and their affiliates

Ransomware Incident Lifecycle

  • Initial compromise and lateral movement within the network
  • Data exfiltration and encryption phases of an attack
  • Post-attack communication patterns with threat actors

Negotiation Principles and Frameworks

  • Foundations of cyber crisis negotiation strategies
  • Understanding the motives and leverage of adversaries
  • Communication strategies for containment and resolution

Practical Ransomware Negotiation Exercises

  • Simulated negotiations with threat actors to practice real-world scenarios
  • Managing escalation and time pressure during negotiations
  • Documenting negotiation outcomes for future reference and analysis

Threat Intelligence for Ransomware Defense

  • Collecting and correlating ransomware indicators of compromise (IOCs)
  • Using threat intelligence platforms to enrich investigations and improve defenses
  • Tracking ransomware groups and their ongoing campaigns

Decision-Making Under Pressure

  • Business continuity planning and legal considerations during an attack
  • Working with leadership, internal teams, and external partners to manage the incident
  • Evaluating payment versus recovery pathways for data restoration

Post-Incident Improvement

  • Conducting lessons learned sessions and reporting on the incident
  • Improving detection and monitoring capabilities to prevent future attacks
  • Hardening systems against known and emerging ransomware threats

Advanced Intelligence & Strategic Readiness

  • Building long-term threat profiles for ransomware groups
  • Integrating external intelligence feeds into your defense strategy
  • Implementing proactive measures and predictive analysis to stay ahead of threats

Summary and Next Steps

Requirements

  • An understanding of cybersecurity fundamentals
  • Experience with incident response or Security Operations Center (SOC) operations
  • Familiarity with threat intelligence concepts and tools

Audience:

  • Cybersecurity professionals involved in incident response
  • Threat intelligence analysts
  • Security teams preparing for ransomware events
 14 Hours

Testimonials (5)

Upcoming Courses

Related Categories