Re: Ransomware Playbook

[Valerie Vogel <vvogel () EDUCAUSE EDU>]

The NSC has shared two playbooks and they are now available to download in the EDUCAUSE library:
https://library.educause.edu/resources/2019/10/national-student-clearinghouse-playbooks

You’ll find the ransomware playbook, as well as a DDoS Incident Response playbook. We’ll post other playbooks here and 
let the CG know when those topics are available.

Thank you,
Valerie

Valerie Vogel
Senior Manager, Cybersecurity Program

EDUCAUSE
Uncommon Thinking for the Common Good
direct: 202.331.5374 | Follow HEISC on 
LinkedIn<https://www.linkedin.com/showcase/higher-education-information-security-council-heisc-/> | twitter: 
@HEISCouncil | vvogel () educause edu<mailto:vvogel () educause edu>

From: Security Discussion Group List <SECURITY () LISTSERV EDUCAUSE EDU> on behalf of "Fugett, Julie C" <jcf () KU EDU>
Reply-To: Security Discussion Group List <SECURITY () LISTSERV EDUCAUSE EDU>
Date: Monday, October 7, 2019 at 7:25 AM
To: Security Discussion Group List <SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] Ransomware Playbook

I would also like a copy! Thanks so much.

-Julie

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Amanda Williams
Sent: Monday, October 7, 2019 9:25 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Ransomware Playbook

I would like a copy as well.  Thank you!


Amanda Williams

IT Security Officer

Information Technology Services

Pittsburg State University

620.235.4657





Simple. Safe. Smart. You are receiving this email because you are a Pittsburg State University student, employee, or 
other University community member. If you have questions or concerns regarding the validity of this email, please 
contact the individual or department that sent this email, ITSecurity () pittstate edu<mailto:ITSecurity () pittstate 
edu> , or Gorilla Geeks at 620-235-4600<callto:620-235-4600>.

________________________________
From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV 
EDUCAUSE EDU>> on behalf of John Horace McMoy, III <Johnny.McMoy () WALLACESTATE EDU<mailto:Johnny.McMoy () 
WALLACESTATE EDU>>
Sent: Monday, October 7, 2019 9:07 AM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU> <SECURITY () LISTSERV EDUCAUSE 
EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>>
Subject: Re: [SECURITY] Ransomware Playbook


I would love to have this. Thank you!



Johnny





Johnny McMoy, Ed.D.

College Dean

Wallace State Community College

801 Main Street NW

Hanceville, AL 35077

256-352-8117 W

256-352-8392 F







From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV 
EDUCAUSE EDU>> On Behalf Of John Ramsey
Sent: Thursday, October 03, 2019 3:50 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] Ransomware Playbook



I have one and am happy to share!

Sent from my Verizon, Samsung Galaxy smartphone

Get Outlook for 
Android<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Foffice365.us.vadesecure.com%2Fsafeproxy%2Fv3%3Ff%3DR_Nj8WYsaiuSe-wzg4bFdT3bgKilC4shpQyJiMY3m_eZcCaEMzbzhxcInG2rjNa0%26i%3DfE7zmiSJ7fVsIDNoHqfgXbEUYGXL-dVn87xFUZVG6NpNF_5DGB7iHqkNBiBAx2R7y66TSINgsml0hurw8r5drw%26k%3DLOG0%26r%3D8M0dCWk_dUrGXy-oSRr9-bErlGsNfCksVwuNpPs7atJC7rpsqijT86I6TTw5EvIE%26u%3Dhttps%253A%252F%252Faka.ms%252Fghei36&data=02%7C01%7Cjcf%40KU.EDU%7Cd2abdb8f69584e05b48d08d74b321d62%7C3c176536afe643f5b96636feabbe3c1a%7C0%7C0%7C637060550929172199&sdata=isAPp4NJFJ8qww3dBDwUJVaUQz5RMeI3kyhEs4ZU%2BkU%3D&reserved=0>



________________________________

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV 
EDUCAUSE EDU>> on behalf of Kip Bates <kbates () HOUSING UCSB EDU<mailto:kbates () HOUSING UCSB EDU>>
Sent: Thursday, October 3, 2019 4:34:08 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU> <SECURITY () LISTSERV EDUCAUSE 
EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>>
Subject: [SECURITY] Ransomware Playbook



Colleagues:

I am hoping that I can find someone or someplace that has made an effort to develop a Ransomware Response playbook that 
they would not mind sharing. I understand all the preparation that needs to occur prior to an attack but I am looking 
for something that we can provide users, help desk folks, technicians and such on what actions to take if (when) they 
experience a ransomware attack. I have found a few on the web and I was wondering if someone has adapted one of these 
for their institution or have developed one that they think is particularly good.

Feel free to comment here or off-list.




Kip Bates

Associate Chief Information Security Officer

University of California, Santa Barbara



**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Foffice365.us.vadesecure.com%2Fsafeproxy%2Fv3%3Ff%3Dh5lOc7hez0o17sdCUXTj5oADv9Xm2ReonuF_4jGJGy1JkWmfpYaqeegIBJhup8cp%26i%3DgdqzYKiuQmVPb1zDYjdeotf2aYiDjaUUIop5t-SsqONIBf8puuKn7jq441SfHR5kw3xHBxu81Eqme8gljJe33g%26k%3DnnvA%26r%3DpGJU4DpMpTWYJoQODkM0zg7Kf8DjSOwKsXR9SBlesnmTzoWkpQxNE4UcUmA7EBXj%26u%3Dhttps%253A%252F%252Fnam01.safelinks.protection.outlook.com%252F%253Furl%253Dhttps%25253A%25252F%25252Fwww.educause.edu%25252Fcommunity%2526data%253D02%25257C01%25257Cjramsey%252540studentclearinghouse.org%25257Ceeb9effb345442318b0a08d748429912%25257C8cc02fea054043a688b6069d3eac0119%25257C0%25257C1%25257C637057323178918904%2526sdata%253DjUWrk2Wt4Gr%25252BBW9ZZXxvxCnl0II1IpaYOvaKgjB5XWY%25253D%2526reserved%253D0&data=02%7C01%7Cjcf%40KU.EDU%7Cd2abdb8f69584e05b48d08d74b321d62%7C3c176536afe643f5b96636feabbe3c1a%7C0%7C0%7C637060550929182194&sdata=w6WiFExMQDEkTU5NAbdaTW8%2F616ynfKkR7dh13TTVtM%3D&reserved=0>

=======================================================

This message has been analyzed by Deep Discovery Email Inspector.

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Foffice365.us.vadesecure.com%2Fsafeproxy%2Fv3%3Ff%3DC5laXne3g8z90J9iTO3XL6uImjhNin4wpuvwx-fZUcx5c-33SQxSfMhenU-SwZkD%26i%3DoBBIDDXMRv7l6LzD7QT3WVxlYfPgQzoSjolQpMAODrWoKG0IXnhJnmrfN1Z2F_M_EronomcgA5H07MWK4NA1uQ%26k%3DN3FJ%26r%3DEAos6DLj4dATuXNajiEcCZ6Uhlxa3PV0c2msaF3lyWdiUXCpPpE6_4c0eF7PNINQ%26u%3Dhttps%253A%252F%252Fwww.educause.edu%252Fcommunity&data=02%7C01%7Cjcf%40KU.EDU%7Cd2abdb8f69584e05b48d08d74b321d62%7C3c176536afe643f5b96636feabbe3c1a%7C0%7C0%7C637060550929182194&sdata=csUo5r9l3UVORAJSXVC5txoCijIWYfpz7ZCMn%2Fm0d%2Fw%3D&reserved=0>
Confidentiality Notice: This transmission (including any attachments) may contain confidential information belonging to 
the sender and is intended only for the use of the party or entity to which it is addressed. If you are not the 
intended recipient, you are hereby notified that any disclosure, copying, distribution, retention or the taking of 
action in reliance on the contents of this transmission is strictly prohibited. If you have received this transmission 
in error, please immediately notify the sender and erase all information and attachments.

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C01%7Cjcf%40KU.EDU%7Cd2abdb8f69584e05b48d08d74b321d62%7C3c176536afe643f5b96636feabbe3c1a%7C0%7C0%7C637060550929192188&sdata=g5XqqU4YewjyHuy0G4Ylae0kx3WcwV3BHJWwDb%2B9xkM%3D&reserved=0>

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at 
https://www.educause.edu/community<https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity&data=02%7C01%7Cjcf%40KU.EDU%7Cd2abdb8f69584e05b48d08d74b321d62%7C3c176536afe643f5b96636feabbe3c1a%7C0%7C0%7C637060550929192188&sdata=g5XqqU4YewjyHuy0G4Ylae0kx3WcwV3BHJWwDb%2B9xkM%3D&reserved=0>

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community