Ransomware, Data Extortion, and Essential Service Continuity
A leadership course for agency and district leaders, IT, security, emergency management, and communications. Distinguish operational disruption from confidentiality loss, understand why restoring backups does not undo data theft, and prepare the containment, continuity, and communications decisions you will need to make in the first 24 hours.
What you'll learn
- Distinguish the two faces of modern ransomware — operational disruption and confidentiality loss (data theft) — and understand why restoring from backups addresses the first but does nothing about the second.
- Prepare an isolated recovery capability: owned backups, protected backup credentials, immutable or air-gapped copies, and tested restoration against the actual applications and dependencies your organization runs.
- Define authorized containment in writing before an incident — who may isolate systems, who may revoke accounts and sessions, who may notify partners, and who may preserve evidence under incident conditions.
- Plan manual alternatives for the essential services your organization provides — schools, benefits, permitting, utilities, emergency services, citizen communications — so operations can continue while systems are being rebuilt.
- Preapprove the communications pattern used during an incident — who speaks, through which channels, to employees, to the public, to regulators, and to the attacker — with legal counsel and the relevant authorities involved from the start.
- Run realistic tabletop and restoration exercises on a cadence, capture the gaps honestly, assign owners for the corrective actions, and measure recovery against the service-level objectives the organization has already set.
Requirements
- Appropriate for leaders and decision-makers in agencies, districts, municipalities, IT, security, emergency management, and communications.
- Audio or captions enabled so you can follow the narrated video for each module.
- No specialized cybersecurity background required — this course focuses on leadership decisions and policy, not technical implementation. Technical implementation is covered in companion courses CS-208 (Cloud SaaS and Identity) and CS-209 (Vulnerability and Patch Management).
Course content
7 chapters · 6 lectures · 50m total
Module 1 — Data Theft Without Encryption
Modern ransomware is a two-faced incident: operational disruption from encryption, and confidentiality loss from exfiltrated data. Why restoring backups addresses the first but does nothing about the second, and why every preparation decision has to account for both.
1 item
Module 1 — Data Theft Without Encryption
Modern ransomware is a two-faced incident: operational disruption from encryption, and confidentiality loss from exfiltrated data. Why restoring backups addresses the first but does nothing about the second, and why every preparation decision has to account for both.
-
Data Theft Without Encryption Free preview8 minutes
Module 2 — Prepare Isolated Recovery
Backups are the first thing attackers target. Isolated recovery — separate credentials, immutable or air-gapped storage, owned copies, and tested restorations — is a different thing from simply having backups, and it is what determines whether the operational face of an incident lasts three days or three weeks.
1 item
Module 2 — Prepare Isolated Recovery
Backups are the first thing attackers target. Isolated recovery — separate credentials, immutable or air-gapped storage, owned copies, and tested restorations — is a different thing from simply having backups, and it is what determines whether the operational face of an incident lasts three days or three weeks.
-
Prepare Isolated Recovery9 minutes
Module 3 — Practice Authorized Containment
The hardest decisions in a ransomware incident have to be made in the first hour, by named roles, under authority already granted. Who may isolate systems, who may revoke sessions, who may notify partners, who may preserve evidence — written down in advance, trained to, and understood by the people who will have to act on them.
1 item
Module 3 — Practice Authorized Containment
The hardest decisions in a ransomware incident have to be made in the first hour, by named roles, under authority already granted. Who may isolate systems, who may revoke sessions, who may notify partners, who may preserve evidence — written down in advance, trained to, and understood by the people who will have to act on them.
-
Practice Authorized Containment8 minutes 30 seconds
Module 4 — Keep Essential Services Operating
Behind every system a ransomware event takes offline is a service real people depend on — attendance, permitting, benefits, utility billing, emergency communications. The leader's job is to activate pre-planned manual alternatives so those services continue while the technical team rebuilds the systems that support them.
1 item
Module 4 — Keep Essential Services Operating
Behind every system a ransomware event takes offline is a service real people depend on — attendance, permitting, benefits, utility billing, emergency communications. The leader's job is to activate pre-planned manual alternatives so those services continue while the technical team rebuilds the systems that support them.
-
Keep Essential Services Operating8 minutes 30 seconds
Module 5 — Coordinate Communications
In the first 24 hours of an incident, more organizational damage is done through poorly handled communications than through the technical event itself. Preapproved playbooks that name, for each audience — employees, public, regulators, the attacker, reporters — the spokesperson, the channel, and the review step before anything is sent.
1 item
Module 5 — Coordinate Communications
In the first 24 hours of an incident, more organizational damage is done through poorly handled communications than through the technical event itself. Preapproved playbooks that name, for each audience — employees, public, regulators, the attacker, reporters — the spokesperson, the channel, and the review step before anything is sent.
-
Coordinate Communications8 minutes
Module 6 — Exercise and Improve
A plan on a shelf is not preparation. The habits that turn plans into reflexes: regular tabletop exercises, scheduled restoration drills, honest gap capture, and tracked corrective actions on the leadership agenda until each one is closed or formally accepted as a risk.
1 item
Module 6 — Exercise and Improve
A plan on a shelf is not preparation. The habits that turn plans into reflexes: regular tabletop exercises, scheduled restoration drills, honest gap capture, and tracked corrective actions on the leadership agenda until each one is closed or formally accepted as a risk.
-
Exercise and Improve8 minutes
Final Assessment
A 12-question scenario-based quiz covering all six modules, aimed at leadership-level decision-making. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
1 item
Final Assessment
A 12-question scenario-based quiz covering all six modules, aimed at leadership-level decision-making. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
-
Final Assessment — Ransomware, Data Extortion, and Service Continuity