Like Ransoming a Bike: Organizational Muscle Memory Drives the Most Effective Response – Source: www.securityweek.com

Ransomware has become an enterprise boogeyman experiencing 37 percent increase over 2024 according to the Verizon Data Breach Investigations Report (PDF), being present in nearly half of all breaches.  

It would seem that resistance is futile as all the technology and training put in place fail to repel attacks, and all the best practices in backups and redundancy provide only cold comfort. But in the old joke of a tiger pursuing two friends, there are lessons in survivability that translate in a business context. However, in this context It’s not just being the faster friend, it’s organizational athleticism and muscle memory fostering agility and quick, decisive thinking that can make a massive difference in impact. And as with athletic performance, that muscle memory is earned with proper training, form, and practice.  

The key tool for surviving ransomware, or any attack scenario, is an IR plan. But an IR plan is only worthwhile if it’s comprehensive, current, and tested. IR plans are not “best practices”, nor singular documents stored in a safe place. They are living resources that require attention and maintenance. In this way, the proof of an IR plan’s efficacy is in that organizational muscle memory – most effectively trained through Tabletop exercises.  So, what are the primary “muscles,” and the repetitive “exercises” in which you can train an organization to respond decisively, immediately, confidently, and automatically. 

Plan your workout

Any doctor or trainer will tell you that a workout regimen needs to be personalized to fit the body and makeup of each person. Organizations need to know their “body” to understand what will benefit them, and what will break them. The first step is to take the “assume breach” perspective. You need to know your externally facing potential points of compromise, and how a foothold provides an attacker an ability to discern your environment and move within it to inflict the highest amount of pain. 

Once you understand your physical vulnerability, it’s time to scope your mental vulnerability.  You need to strengthen the organizational mind and sharpen your perception.  From employees to executives, this requires creating, reinforcing and maintaining hyper awareness of potential threats.  Complacency or lack of focus are like blood in the water to an attacker. Keeping everyone’s discipline and skepticism sharp is what is needed to disarm attempts at social engineering or deception.

Warm Up

You’ve created a plan and a mindset, now it’s time to get limber and prepare for the real workout. We’ll call this training the cognitive capabilities of your organization. First is your mindset. You should be documenting and understanding your environmental ebbs and flows. What is the normal course of business and what are the most important assets that are touched in that flow. Now as they say, “put yourself out of business.” What are the most dangerous scenarios that could impact business continuity and assets.

Now that you’ve stretched your muscles and visualized your workout, push yourself.  Know your strengths, and acknowledge, document and attack all your weaknesses to take them off the table.

The final step in this stage, is to know your limits. Not just what they are, but what approaching them feels like. More specifically, recognize the business and operational anomalies that indicate something is wrong and when swift investigative action is needed.  And don’t mistake this for “anomaly” detection in technology form. While helpful, you and your team should know your business well enough, and have communication strong enough, to sense when something is “off”.

Train, Recover and Repeat

Now it’s time to sweat…metaphorically. The first part of the workout is to hone your motor skills. You should be performing breach “dry runs”. The organization needs to establish and run through clear and actionable processes for activation, escalation, and response. It’s a top to bottom exercise that needs to become second nature.

Secondly, you need to increase your reps. The efficacy of so many processes lives or dies in communication.  You need to engage and maintain a regular cadence of communication practice between key stakeholders to play out critical potential scenarios until the organization speaks with one fluid voice.

As with any workout, as you become more comfortable with, and stronger in these exercises, it’s time to change it up.  You need to adjust the difficulty and advance your training. You might say the first step is to “spot yourself”.  This means step back from the processes and make an honest assessment of shortcomings. Completion isn’t success. Every process and playbook can be better. Identify and fill in gaps. 

Finally, repetition is great for that muscle memory, but repetition can also breed complacency.  Here’s where “cross training” can be helpful to keep your organizational mind and perspective sharp.  Many successful organizations find it useful to break up and vary response element practices for shorter, more focused sessions.  In this way revisiting and rethinking how to get better can be approached from multiple perspectives and at different points in the process.

Measure your gains

They say measure twice cut once.  However, in this case, once you’ve gotten yourself “cut” you need to be always measuring to make sure you maintain that organizational fitness.  In assessing that fitness, as stated previously, completion does not quantify success.  You need to check performance, not compliance boxes.  After any and all Tabletop exercises you should be asking:

• Did you resolve the incident?
• Can you close the gaps and improve?
• Is your collaboration strong with internal and external stakeholders?
• Is everyone on the same page?
• Are we getting better?

Finally, as with workouts, reinforcement and detachment are also great tools. So, find a workout buddy.  3^rd party Offensive Security firms don’t need to rip down and rebuild your organizational understanding. Once you’ve discovered your process and defined your metrics, Offensive Security partners can provide outside validation and honest unbiased assessment, as well as blueprints for improvement.