Ransomware Decision Tree Insights from Arctic Wolf

• •Establish a ransomware decision tree to guide incident response.
• •Involve law enforcement to understand threat actors and avoid sanctions.
• •Make critical decisions about containment and payment during business hours.

Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, discusses the importance of establishing a ransomware decision tree in a recent Help Net Security video. She emphasizes four critical areas for preemptive decision-making: containment, negotiation authority, payment considerations, and communication strategies. Organizations must assess the impact of pulling systems offline on client data and operational continuity. The decision to pay a ransom should be treated as a business decision, considering potential costs versus insurance implications. Law enforcement involvement is recommended to navigate potential sanctions and understand threat actors. Clear communication plans must be in place, including legal counsel and designated spokespeople. Shafer-Page advises that these decisions should be made proactively, ideally during regular business hours.