Hooked By Phisherman: Quarterbacking Breach Response with Law Enforcement
summary
A phishing link leads to an Office365 credential theft, ransomware encrypts files and posts a $5 million demand, and responders must choose between restoring from backups, negotiating, or involving law enforcement; the US Secret Service provides indicators of compromise, sometimes decryptors, and can trace funds if notified within a 72‑hour kill chain window. Success depends on a tested incident response plan, a current data inventory tied to contracts and insurance panels, and the reality that a decryptor is rare.
AI-written summary · about
chapters (43)
- 0:00Welcome
- 1:47Ransomware scenario setup
- 3:11First steps after attack
- 4:37Ransomware response examples
- 5:39C-suite versus IT communication
- 7:04Law enforcement in cybersecurity
- 8:29Insurance in breach response
- 9:54Tabletop exercises and contacts
- 10:57Law enforcement in ransomware response
- 11:40Tracking ransomware trends
- 12:46Recovering BEC funds
- 13:49Timing for fraud recovery
- 14:52Strain identification by law enforcement
- 15:56OFAC compliance for ransomware
- 16:39OFAC sanctions and liability
- 18:09Prosecution risks for payments
- 19:34Contacting law enforcement
- 20:38Jurisdiction and reporting
- 21:42Building law enforcement ties
- 22:44Law enforcement communication role
- 24:32Public sector ransomware challenges
- 25:56Data inventory for breach response
- 27:44Legal risks in ransomware
- 29:35Vendor breach notification
- 31:00Vendor breach contract gaps
- 32:26Ransomware targeting MSPs
- 33:12International ransomware compliance
- 34:54Sanctions guidance limitations
- 36:40Contract review for cyber risks
- 38:50Cybersecurity for legal/accounting
- 41:00Regulatory reporting obligations
- 42:46SMB cybersecurity support
- 43:52Insurance for breach recovery
- 46:01Cyber insurance limitations
- 47:47Avoiding coverage gaps
- 49:10Deductibles versus response costs
- 49:53Law enforcement for SMBs
- 51:40Zurich vs Mondelez case
- 53:05Insurance policy complexity
- 54:11Prevention over insurance
- 55:14AXA coverage withdrawal
- 55:56Next steps for preparedness
- 58:21Final thoughts
related talks
51mSurvive the Breach-Protecting People & the Company When the Worst Happens
37mRansomware Resilience: Holistic Defense for SOC Leaders
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
52mStart covering your bases & Stop chasing APT headlines
52mRansomware 101: Get Smart Understanding Real Attacks
24mThreat Response Needs New Thinking. Don't Ignore This Key Resource.
21mRansomware Attack: Lessons Learned
39mHow Security Incidents Are Different ... and How They're Exactly the Same