Tabletop Exercise for Ransomware Negotiations

Ransomware has grown to become one of the most significant cyber threats to organizations worldwide. In the event of an attack, many victims choose to pay in order to restore their systems or prevent stolen data from being published or sold. If this decision is made, organizations should consider entering into negotiations with the attackers, as ransoms are often negotiable. It is important that relevant personnel are prepared for such negotiations. The aim of this work is to evaluate how Tabletop Exercises can be used to prepare for possible Ransomware Negotiations. A concept for Tabletop Exercises is developed, which is slightly adapted to the requirements of Ransomware Negotiation Training. The main modification involves the inclusion of an adversarial team in the exercise, representing the attackers or ransomware operators. This will provide participants with the opportunity to negotiate with an opponent who will react to their actions in a spontaneous and unpredictable manner. A basic model for designing a Tabletop Exercise in this format is provided, supplemented by an exemplary scenario for a Ransomware Negotiation Tabletop Exercise.