Quick Description:
The scenario is based on a bank CISO getting a call one day from one of their largest commercial clients, saying they've discovered their information is for sale on the dark web. As the scenario unfolds, the bank is then suddenly faced with a ransomware situation and they have to decide step by step how to deal with it.
 
It is a very interactive scenario. In between each step (roughly 9 steps in total), we can divide up the room into table groups of anywhere from 4-7 people each. Time is allotted for the smaller groups to discuss how they might handle this situation, and then all tables share in a full group discussion as to what they decided and why. Nice thing with this format is everyone learns from everyone no matter what their experience level is. It also covers all business functions besides IT - marketing for messaging and HR for employee stuff for example.
 
In between the segments too, I can include information on the dark web (demystify some of that), explain how the ransomware groups tend to operate, and give a walkthrough of a recent pentest where we got in from the external perimeter and escalated all the way to taking over the network, which an attacker could've then deployed ransomware - with of course how to prevent a similar attack from succeeding. That will show real world impact of how a similar scenario could play out in real life.