Building an incident response team before ransomware hits is the difference between a bad day and a business-ending week. Here’s who you need.
Prasanna, Dr. Mike Saylor, and I are back after a few weeks off, and we’re talking about the people you need lined up before something goes wrong. The middle of an incident is the worst time to start recruiting.
When I cracked a rim on my Tesla, I didn’t watch YouTube videos and grab a wrench. I called a team of people who know tires. Your cyber incident deserves the same approach. You want a real team with real names and real phone numbers, not YouTube University.
We walk through every role on the team. The incident commander keeps executives off the backs of the people putting out the fire. Subject matter experts cover network, systems, backup, apps, and database. The executive sponsor makes the business calls you’re not allowed to make, like which application comes back first when everybody swears theirs is the most important one.
Then we cover the people outside IT. Legal handles ransom decisions and attorney-client privilege. Compliance decides whether this is a reportable incident. PR keeps you from becoming the next LastPass. Finance knows what every hour of downtime costs.
We also get into outside help: your cyber insurance carrier, a third-party incident response firm on retainer, law enforcement, and vendors who will answer the phone on a Sunday. Mike explains what the FBI will and won’t do for you, and why paying a ransom to someone on the OFAC list can land you in a jumpsuit.
If your incident response plan is “we’ll figure it out,” watch this one. Then go write down some names.
⏱️ CHAPTERS
00:00 Cold open
01:30 We’re back (and Gemini let me down)
03:27 Why you need a team, not YouTube University
04:29 Know your team before the house is on fire
07:43 Fire crews, training, and the USS Constellation
09:27 Incident response is a business problem
12:02 Core roles: leaders and subject matter experts
14:14 Executive sponsors and who comes back first
16:09 Asset lists, owners, and pre-authorization
17:11 Incident commander vs. incident leads
20:00 Legal, compliance, and attorney-client privilege
22:59 PR and the LastPass problem
24:47 Finance and cyber insurance
27:07 Third-party incident response teams and retainers
32:06 Bringing in law enforcement
33:48 Sanctions, Bitcoin, and paying the ransom
38:05 Vendors who answer the phone on a weekend
39:34 Write it down and name your deputies
40:20 Tabletop exercises
43:06 Wrap-up
📘 Get the book, Learning Ransomware Response & Recovery:
O’Reilly: https://www.oreilly.com/library/view/learning-ransomware-response/9781098169572/
Amazon: https://www.amazon.com/Learning-Ransomware-Response-Recovery-Stopping/dp/1098169581
🛡️ See what Mike and I are building: https://www.stopransomware.com
🎧 Listen to the podcast: https://www.backupwrapup.com/building-an-incident-response-team/
