Ransomware Stages of Grief
summary
Secureworks runs ~1,000 IR engagements a year and has done >600 post‑detonation ransomware responses since 2018 and maps victim behavior to a grief curve, arguing reaching acceptance speeds recovery. Typical timelines: containment in hours/days, eviction/eradication in days, and recovery weeks to months (examples range from 1–2 weeks to 4 months, one case stalled by resetting 80,000 passwords). Practical tactics used: send an incident commander, build red/amber/green segmentation, leverage third parties for commodity rebuilds while keeping institutional staff for dependencies, enforce shift tempo and no‑blame culture.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 3:30Stages of Grief
- 10:45The KublerRoss Model
- 13:38Denial
- 15:47Anger
- 17:46Depression
- 19:31Bargaining
- 21:30Acceptance
- 22:49Conclusion
- 26:00Bonus Stage
- 27:10Timeframe
- 31:00Containment decisions
- 32:50Getting to acceptance
- 34:50Live fire exercises
related talks
21mRansomware Attack: Lessons Learned
54mExperience a simulated ransomware event: Learn now to prevail later
46mNegotiating with Terrorists: The High Stakes Game of Ransomware Response
19mThe aftermath of a crypto-ransomware attack at a large academic institution
06mA Battle Plan for Disaster Recovery in the Wake of Ransomare
55mNavigating Top Cyber Risks And Regulatory Requirements
32mSurviving a Ransomware Attack - Lessons from the Field
49mDissecting The Ransomware Kill Chain: Why Companies Need It