Locked Up

A gripping true story about one ransomware attack and the hands-on lessons you can learn from it In Locked Up: Lessons Learned from A Real-World LockBit Ransomware Response, veteran IT and cybersecurity executive Zachary Lewis, delivers a gripping, first-person account of how a major university squared off against one of the world's most infamous ransomware groups: LockBit. He walks you through his personal experience battling – and negotiating with – LockBit, as well as the strategies, tools, and approaches he used in resolving the crisis. The book is a detailed, darkly funny, and behind-the-scenes account of an increasingly common and feared event for organizations of all types and sizes. It offers up-to-date advice for people tasked with preventing, responding to, and recovering from ransomware attacks. You'll find: Insightful crisis management lessons applicable to both technical and business leaders Hands-on technical solutions you can apply to prevent catastrophic data loss during a ransomware event Techniques to manage the intense operational, emotional, and interpersonal challenges that arise in the midst of an unexpected crisis Perfect for IT professionals, cybersecurity leaders, and business decision-makers in higher education, healthcare, government, and nonprofit organizations, Locked Up is also a must-read for business continuity planners, legal counsel, and anyone else with an interest in real-world cybersecurity.

Foreword xv Introduction: The Attack xix Part I: Leading to the Attack 1 Chapter 1: A New Breed of Criminals 3 Chapter 2: Easy Prey 31 Chapter 3: Cybersecurity at UHSP 51 Part II: Responding to the Attack 67 Chapter 4: The Leadership Response 69 Chapter 5: The War Room 85 Chapter 6: Countdown to the Data Dump 101 Part III: Recovering From the Attack 115 Chapter 7: The Data Dump 117 Chapter 8: Strengthening Security Post-Attack 133 Chapter 9: Reflections and Lessons Learned 151 Part IV: What Organizations Can Do 165 Chapter 10: Building a Resilient Cybersecurity Program 167 Chapter 11: Implementing Strong Technical Controls 193 Chapter 12: Responding to a Cyberattack 215 Epilogue: The Calm We Earned 237 Appendix: Cybersecurity Onboarding Checklist: A 30–60–90–120-Day Plan 241 Acknowledgments 243 About the Author 245 Index 247