Lion Cipher Lab
Run a ransomware tabletop exercise
- GRC / Compliance
- Beginner
- ~60 min
- Free · no account required
Why it matters
Ransomware is the incident most small teams will actually face, and it forces a handful of hard decisions under a countdown: isolate now or keep working, restore or pay, what to tell customers and press, and — the one that stalls real incidents — who is even allowed to make the call. A ransomware tabletop is the cheapest, safest way to have those arguments in advance: the team sits in a quiet room and talks through one realistic scenario as it escalates, with no real systems affected. It reliably surfaces the gaps you cannot see on paper — the backup nobody has restored, the decision no one…
What you'll learn
- facilitating a ransomware tabletop exercise
- running an escalating injects-based scenario
- walking a team through isolate/contain decisions
- pressure-testing offline backups and tested restores
- reasoning through the pay-or-not decision
- capturing an after-action list of gaps
Steps in this lab
- What you're running, in plain terms
- Set the room, the roles, and who decides
- Day 0 inject: files encrypted, and a ransom note
- Inject: it reached the backups
- Inject: stolen data — the double-extortion turn
- Inject: a reporter calls, and the clock is loud
- Close the scenario and capture the after-action gaps
- Why the calm room is the whole point