Ransomware Readiness Workshop: Backups, Recovery and the First 72 Hours
Ransomware Readiness Workshop: Backups, Recovery and the First 72 Hours
Duration: 90 minutes
Format: Self-paced workshop guide
Level: Intermediate
Ransomware attacks often succeed not because defenses fail completely, but because recovery was never tested. Backups turn out to be connected to the same network, nobody knows who can authorize shutting down systems, and the first critical hours are spent finding phone numbers.
This workshop guide walks you through practical preparation. You'll review how attacks typically unfold, harden your backups, build a recovery plan based on business priorities, assign decision-making roles, and step through what to do in the first 72 hours of an incident.
Audience
IT administrators, security staff, operations managers and executives who would be involved in responding to a ransomware incident.
Guide Outline
How ransomware attacks typically unfold
Most attacks follow a pattern: initial access through phishing, stolen credentials or an unpatched internet-facing system; quiet movement through the network; theft of data; and finally encryption, often timed for nights or weekends.
Each stage is a chance to detect and stop the attack. The earlier you catch it, the smaller the damage.
Hardening your backups
Attackers look for backups and try to delete or encrypt them first. Keep at least one copy offline or immutable, protect backup consoles with separate credentials and multi-factor authentication, and monitor for unexpected deletion or changes to retention settings.
Back up configuration as well as data: identity systems, network settings and key applications.
Testing recovery, not just backups
A backup job that reports success is not proof you can recover. Schedule regular restore tests for critical systems and record how long they actually take.
Compare those times to how long the business can tolerate an outage, and close the gap with priorities, extra capacity or process changes.
Deciding who does what
Define who can declare an incident, who can approve shutting down systems, who talks to leadership, customers and regulators, and who contacts legal counsel and insurers. Keep an offline copy of contact details.
Decide in advance how decisions about ransom demands will be made and who must be involved, including legal advice.
The first 72 hours
Hours 0 to 4: contain the spread by isolating affected systems, preserve evidence, and activate the response team. Hours 4 to 24: understand the scope, notify required parties, and begin restoring the most critical services from clean backups. Hours 24 to 72: continue recovery in priority order, rotate credentials, and communicate regularly with staff and customers.
These timeframes are a planning guide, not a promise. Real incidents vary, which is why practice matters.
Running a tabletop exercise
Walk the team through a realistic scenario in a meeting room. Introduce new information every few minutes and ask people what they would do. Record gaps and assign owners to fix them.
Repeat the exercise at least once a year and after major changes.
Key takeaways and next steps
Protect backups, test restores, assign roles, and rehearse. Preparation turns a crisis into a difficult but manageable event.
The free Incident Response Playbook Template on this site gives you a structure to document your plan.
Related on DimensionStone Security
Educational guide only. It is not legal, audit or compliance advice, and it is not a certification, accredited training or a credential of any kind. Product and framework names mentioned are trademarks of their owners; DimensionStone Security is not affiliated with or endorsed by them.