Locked Up

A gripping true story about one ransomware attack and the hands-on lessons you can learn from it

In Locked Up: Lessons Learned from A Real-World LockBit Ransomware Response, veteran IT and cybersecurity executive Zachary Lewis, delivers a gripping, first-person account of how a major university squared off against one of the world's most infamous ransomware groups: LockBit. He walks you through his personal experience battling – and negotiating with – LockBit, as well as the strategies, tools, and approaches he used in resolving the crisis.

The book is a detailed, darkly funny, and behind-the-scenes account of an increasingly common and feared event for organizations of all types and sizes. It offers up-to-date advice for people tasked with preventing, responding to, and recovering from ransomware attacks. You'll find:

• Insightful crisis management lessons applicable to both technical and business leaders
• Hands-on technical solutions you can apply to prevent catastrophic data loss during a ransomware event
• Techniques to manage the intense operational, emotional, and interpersonal challenges that arise in the midst of an unexpected crisis

Perfect for IT professionals, cybersecurity leaders, and business decision-makers in higher education, healthcare, government, and nonprofit organizations, Locked Up is also a must-read for business continuity planners, legal counsel, and anyone else with an interest in real-world cybersecurity.

Introduction: The Attack xv

PART I: LEADING TO THE ATTACK 1

Chapter 1: A New Breed of Criminals 3

Chapter 2: Easy Prey 31

Chapter 3: Cybersecurity at UHSP 51

PART II: RESPONDING TO THE ATTACK 67

Chapter 4: The Leadership Response 69

Chapter 5: The War Room 85

Chapter 6: Countdown to the Data Dump 101

PART III: RECOVERING FROM THE ATTACK 115

Chapter 7: The Data Dump 117

Chapter 8: Strengthening Security Post-Attack 133

Chapter 9: Reflections and Lessons Learned 151

PART IV: WHAT ORGANIZATIONS CAN DO 165

Chapter 10: Building a Resilient Cybersecurity Program 167

Chapter 11: Implementing Strong Technical Controls 193

Chapter 12: Responding to a Cyberattack 215

Epilogue: The Calm We Earned 237

Appendix: Cybersecurity Onboarding Checklist:

A 30–60–90–120-Day Plan 241

Acknowledgments 243

About the Author 245

Index 247